add images

Signed-off-by: Tim Ramlot <[email protected]>

.github/actions/presubmit-variant/action.yml

@@ -0,0 +1,41 @@
+name: presubmit
+inputs:
+  variant:
+    required: true
+  archs:
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Setup QEMU
+      uses: docker/[email protected]
+
+    - name: Populate workspace with variant source only
+      shell: bash
+      run: |
+        shopt -s dotglob && tmp="$(mktemp -d)" && \
+          mv ${{ inputs.variant }}/* ${tmp}/ && \
+          mv .github ${tmp}/ && \
+          rm -rf ./* && mv ${tmp}/* . && \
+          echo ".github/" >> .melangeignore && tree -a . && \
+          sudo rm -rf /work && sudo mkdir /work
+
+    - uses: chainguard-images/actions/apko-build@main
+      with:
+        config: apko.yaml
+        tag: ghcr.io/${{ github.repository }}/${{ inputs.variant }}
+        archs: ${{ inputs.archs }}
+
+    - name: Load image from apko-produced tarball
+      shell: bash
+      run: |
+        docker load < output.tar
+
+    - name: Smoke test
+      shell: bash
+      run: |
+        ref="ghcr.io/${{ github.repository }}/${{ inputs.variant }}"
+        docker run -d --rm -p 8080:8080 --name smoketest "${ref}"
+        trap "docker rm -f smoketest" EXIT
+        sleep 5 # Give server a few seconds to come up
+        curl -v --max-time 10 http://localhost:8080/ | grep 'Hello World!'

.github/actions/release-variant/action.yml

@@ -0,0 +1,27 @@
+name: release
+inputs:
+  variant:
+    required: true
+  archs:
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Setup QEMU
+      uses: docker/[email protected]
+
+    - name: Populate workspace with variant source only
+      shell: bash
+      run: |
+        shopt -s dotglob && tmp="$(mktemp -d)" && \
+          mv ${{ inputs.variant }}/* ${tmp}/ && \
+          mv .github ${tmp}/ && \
+          rm -rf ./* && mv ${tmp}/* . && \
+          echo ".github/" >> .melangeignore && tree -a . && \
+          sudo rm -rf /work && sudo mkdir /work
+
+    - uses: chainguard-images/actions/apko-snapshot@main
+      with:
+        config: apko.yaml
+        base-tag: ghcr.io/${{ github.repository }}/${{ inputs.variant }}
+        archs: ${{ inputs.archs }}

.github/workflows/base-csi-presubmit.yml

@@ -0,0 +1,24 @@
+name: base-csi-presubmit
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - .github/actions/presubmit-variant/action.yml
+      - .github/workflows/base-csi-presubmit.yml
+      - base-csi/**
+jobs:
+  build:
+    name: Verify base-csi image (single arch)
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      packages: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: ./.github/actions/presubmit-variant
+        with:
+          variant: base-csi
+          archs: amd64

.github/workflows/base-csi.yml

@@ -0,0 +1,27 @@
+name: base-csi
+concurrency: base-csi
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  push:
+    branches:
+      - main
+    paths:
+      - .github/actions/release-variant/action.yml
+      - .github/workflows/base-csi.yml
+      - base-csi/**
+jobs:
+  build:
+    name: Release base-csi image
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      packages: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: ./.github/actions/release-variant
+        with:
+          variant: base-csi
+          archs: amd64,aarch64,armv7

.github/workflows/base-static-presubmit.yml

@@ -0,0 +1,24 @@
+name: base-static-presubmit
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - .github/actions/presubmit-variant/action.yml
+      - .github/workflows/base-static-presubmit.yml
+      - base-static/**
+jobs:
+  build:
+    name: Verify base-static image (single arch)
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      packages: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: ./.github/actions/presubmit-variant
+        with:
+          variant: base-static
+          archs: amd64

.github/workflows/base-static.yml

@@ -0,0 +1,27 @@
+name: base-static
+concurrency: base-static
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  push:
+    branches:
+      - main
+    paths:
+      - .github/actions/release-variant/action.yml
+      - .github/workflows/base-static.yml
+      - base-static/**
+jobs:
+  build:
+    name: Release base-static image
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      packages: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: ./.github/actions/release-variant
+        with:
+          variant: base-static
+          archs: amd64,aarch64,armv7

base-csi/apko.yaml

@@ -0,0 +1,18 @@
+contents:
+  repositories:
+    - https://dl-cdn.alpinelinux.org/alpine/edge/main
+  packages:
+    - tzdata
+    - ca-certificates-bundle
+    - mount
+    - umount
+
+accounts:
+  groups:
+    - groupname: nonroot
+      gid: 65532
+  users:
+    - username: nonroot
+      uid: 65532
+      gid: 65532
+  run-as: 65532

base-static/apko.yaml

@@ -0,0 +1,16 @@
+contents:
+  repositories:
+    - https://dl-cdn.alpinelinux.org/alpine/edge/main
+  packages:
+    - tzdata
+    - ca-certificates-bundle
+
+accounts:
+  groups:
+    - groupname: nonroot
+      gid: 65532
+  users:
+    - username: nonroot
+      uid: 65532
+      gid: 65532
+  run-as: 65532