@docker/actions-toolkit
Version:
Toolkit for Docker (GitHub) Actions
314 lines • 13.6 kB
JavaScript
/**
* Copyright 2023 actions-toolkit authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import fs from 'fs';
import os from 'os';
import path from 'path';
import * as core from '@actions/core';
import * as httpm from '@actions/http-client';
import * as tc from '@actions/tool-cache';
import * as semver from 'semver';
import * as util from 'util';
import { Buildx } from './buildx.js';
import { Cache } from '../cache.js';
import { Context } from '../context.js';
import { Exec } from '../exec.js';
import { Docker } from '../docker/docker.js';
import { Git } from '../git.js';
import { GitHub } from '../github/github.js';
import { Sigstore } from '../sigstore/sigstore.js';
import { Util } from '../util.js';
import { SEARCH_URL } from '../types/sigstore/sigstore.js';
export class Install {
standalone;
githubToken;
sigstore;
constructor(opts) {
this.standalone = opts?.standalone;
this.githubToken = opts?.githubToken || process.env.GITHUB_TOKEN;
this.sigstore = opts?.sigstore || new Sigstore();
}
/*
* Download buildx binary from GitHub release
* @param v: version semver version or latest
* @param ghaNoCache: disable binary caching in GitHub Actions cache backend
* @returns path to the buildx binary
*/
async download(opts) {
const version = await Install.getDownloadVersion(opts.version);
core.debug(`Install.download version: ${version.version}`);
const release = await Install.getRelease(version, this.githubToken);
core.debug(`Install.download release tag name: ${release.tag_name}`);
const vspec = await this.vspec(release.tag_name);
core.debug(`Install.download vspec: ${vspec}`);
const c = semver.clean(vspec) || '';
if (!semver.valid(c)) {
throw new Error(`Invalid Buildx version "${vspec}".`);
}
const installCache = new Cache({
htcName: version.key != 'official' ? `buildx-dl-bin-${version.key}` : 'buildx-dl-bin',
htcVersion: vspec,
baseCacheDir: path.join(Buildx.configDir, '.bin'),
cacheFile: os.platform() == 'win32' ? 'docker-buildx.exe' : 'docker-buildx',
ghaNoCache: opts.ghaNoCache
});
const cacheFoundPath = await installCache.find();
if (!opts.disableHtc && cacheFoundPath) {
core.info(`Buildx binary found in ${cacheFoundPath}`);
return cacheFoundPath;
}
const downloadURL = util.format(version.downloadURL, vspec, this.filename(vspec));
core.info(`Downloading ${downloadURL}`);
const htcDownloadPath = await tc.downloadTool(downloadURL, undefined, this.githubToken);
core.debug(`Install.download htcDownloadPath: ${htcDownloadPath}`);
if (opts.verifySignature && semver.satisfies(vspec, '>=0.31.0-0', { includePrerelease: true })) {
await this.verifySignature(htcDownloadPath, downloadURL);
}
const cacheSavePath = await installCache.save(htcDownloadPath, opts.skipState);
core.info(`Cached to ${cacheSavePath}`);
return cacheSavePath;
}
/*
* Build buildx binary from source
* @param gitContext: git repo context
* @param ghaNoCache: disable binary caching in GitHub Actions cache backend
* @returns path to the buildx binary
*/
async build(gitContext, ghaNoCache) {
const vspec = await this.vspec(gitContext);
core.debug(`Install.build vspec: ${vspec}`);
const installCache = new Cache({
htcName: 'buildx-build-bin',
htcVersion: vspec,
baseCacheDir: path.join(Buildx.configDir, '.bin'),
cacheFile: os.platform() == 'win32' ? 'docker-buildx.exe' : 'docker-buildx',
ghaNoCache: ghaNoCache
});
const cacheFoundPath = await installCache.find();
if (cacheFoundPath) {
core.info(`Buildx binary found in ${cacheFoundPath}`);
return cacheFoundPath;
}
const outputDir = path.join(Context.tmpDir(), 'buildx-build-cache');
const buildCmd = await this.buildCommand(gitContext, outputDir);
const buildBinPath = await Exec.getExecOutput(buildCmd.command, buildCmd.args, {
ignoreReturnCode: true
}).then(res => {
if (res.stderr.length > 0 && res.exitCode != 0) {
throw new Error(`build failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
}
return `${outputDir}/buildx`;
});
const cacheSavePath = await installCache.save(buildBinPath);
core.info(`Cached to ${cacheSavePath}`);
return cacheSavePath;
}
async installStandalone(binPath, dest) {
core.info('Standalone mode');
dest = dest || Context.tmpDir();
const binDir = path.join(dest, 'buildx-bin-standalone');
if (!fs.existsSync(binDir)) {
fs.mkdirSync(binDir, { recursive: true });
}
const binName = os.platform() == 'win32' ? 'buildx.exe' : 'buildx';
const buildxPath = path.join(binDir, binName);
fs.copyFileSync(binPath, buildxPath);
core.info('Fixing perms');
fs.chmodSync(buildxPath, '0755');
core.addPath(binDir);
core.info('Added Buildx to PATH');
core.info(`Binary path: ${buildxPath}`);
return buildxPath;
}
async installPlugin(binPath, dest) {
core.info('Docker plugin mode');
dest = dest || Docker.configDir;
const pluginsDir = path.join(dest, 'cli-plugins');
if (!fs.existsSync(pluginsDir)) {
fs.mkdirSync(pluginsDir, { recursive: true });
}
const binName = os.platform() == 'win32' ? 'docker-buildx.exe' : 'docker-buildx';
const pluginPath = path.join(pluginsDir, binName);
fs.copyFileSync(binPath, pluginPath);
core.info('Fixing perms');
fs.chmodSync(pluginPath, '0755');
core.info(`Plugin path: ${pluginPath}`);
return pluginPath;
}
async buildCommand(gitContext, outputDir) {
const buildxStandaloneFound = await new Buildx({ standalone: true }).isAvailable();
const buildxPluginFound = await new Buildx({ standalone: false }).isAvailable();
let buildStandalone = false;
if ((await this.isStandalone()) && buildxStandaloneFound) {
core.debug(`Install.buildCommand: Buildx standalone found, build with it`);
buildStandalone = true;
}
else if (!(await this.isStandalone()) && buildxPluginFound) {
core.debug(`Install.buildCommand: Buildx plugin found, build with it`);
buildStandalone = false;
}
else if (buildxStandaloneFound) {
core.debug(`Install.buildCommand: Buildx plugin not found, but standalone found so trying to build with it`);
buildStandalone = true;
}
else if (buildxPluginFound) {
core.debug(`Install.buildCommand: Buildx standalone not found, but plugin found so trying to build with it`);
buildStandalone = false;
}
else {
throw new Error(`Neither buildx standalone or plugin have been found to build from ref ${gitContext}`);
}
const args = ['build', '--target', 'binaries', '--platform', 'local', '--build-arg', 'BUILDKIT_CONTEXT_KEEP_GIT_DIR=1', '--output', `type=local,dest=${outputDir}`];
if (process.env.GIT_AUTH_TOKEN) {
args.push('--secret', 'id=GIT_AUTH_TOKEN');
}
args.push(gitContext);
//prettier-ignore
return await new Buildx({ standalone: buildStandalone }).getCommand(args);
}
async isStandalone() {
const standalone = this.standalone ?? !(await Docker.isAvailable());
core.debug(`Install.isStandalone: ${standalone}`);
return standalone;
}
async verifySignature(binPath, downloadURL) {
const bundleURL = `${downloadURL.replace(/\.exe$/, '')}.sigstore.json`;
core.info(`Downloading keyless verification bundle at ${bundleURL}`);
let bundlePath;
try {
bundlePath = await tc.downloadTool(bundleURL, undefined, this.githubToken);
core.debug(`Install.verifySignature bundlePath: ${bundlePath}`);
}
catch (e) {
if (e.message && e.message.statusCode === httpm.HttpCodes.NotFound) {
core.info(`No signature bundle found at ${bundleURL}, skipping verification`);
return;
}
throw e;
}
const verifyResult = await this.sigstore.verifyArtifact(binPath, bundlePath, {
// TODO: add githubWorkflowRepository , runnerEnvironment and sourceRepositoryURI extensions when supported by sigstore module
subjectAlternativeName: /^https:\/\/github\.com\/docker\/(github-builder-experimental|github-builder)\/\.github\/workflows\/bake\.yml.*$/,
issuer: 'https://token.actions.githubusercontent.com'
});
core.info(`Buildx binary signature verified! ${verifyResult.tlogID ? `${SEARCH_URL}?logIndex=${verifyResult.tlogID}` : ''}`);
}
filename(version) {
let arch;
switch (os.arch()) {
case 'x64': {
arch = 'amd64';
break;
}
case 'ppc64': {
arch = 'ppc64le';
break;
}
case 'arm': {
// eslint-disable-next-line @typescript-eslint/no-explicit-any
const arm_version = process.config.variables.arm_version;
arch = arm_version ? 'arm-v' + arm_version : 'arm';
break;
}
default: {
arch = os.arch();
break;
}
}
const platform = os.platform() == 'win32' ? 'windows' : os.platform();
const ext = os.platform() == 'win32' ? '.exe' : '';
return util.format('buildx-v%s.%s-%s%s', version, platform, arch, ext);
}
/*
* Get version spec (fingerprint) for cache key. If versionOrRef is a valid
* Git context, then return the SHA of the ref along the repo and owner and
* create a hash of it. Otherwise, return the versionOrRef (semver) as is
* without the 'v' prefix.
*/
async vspec(versionOrRef) {
if (!Util.isValidRef(versionOrRef)) {
const v = versionOrRef.replace(/^v+|v+$/g, '');
core.info(`Use ${v} version spec cache key for ${versionOrRef}`);
return v;
}
// eslint-disable-next-line prefer-const
let [baseURL, ref] = versionOrRef.split('#');
if (ref.length == 0) {
ref = 'master';
}
let sha;
if (ref.match(/^[0-9a-fA-F]{40}$/)) {
sha = ref;
}
else {
sha = await Git.remoteSha(baseURL, ref, process.env.GIT_AUTH_TOKEN);
}
const [owner, repo] = baseURL.substring('https://github.com/'.length).split('/');
const key = `${owner}/${Util.trimSuffix(repo, '.git')}/${sha}`;
const hash = Util.hash(key);
core.info(`Use ${hash} version spec cache key for ${key}`);
return hash;
}
static async getDownloadVersion(v) {
let [repoKey, version] = v.split(':');
if (!version) {
version = repoKey;
repoKey = 'official';
}
if (repoKey === 'lab') {
repoKey = 'cloud';
}
switch (repoKey) {
case 'official': {
return {
key: repoKey,
version: version,
downloadURL: 'https://github.com/docker/buildx/releases/download/v%s/%s',
contentOpts: {
owner: 'docker',
repo: 'actions-toolkit',
ref: 'main',
path: '.github/buildx-releases.json'
}
};
}
case 'cloud': {
return {
key: repoKey,
version: version,
downloadURL: 'https://github.com/docker/buildx-desktop/releases/download/v%s/%s',
contentOpts: {
owner: 'docker',
repo: 'actions-toolkit',
ref: 'main',
path: '.github/buildx-lab-releases.json'
}
};
}
default: {
throw new Error(`Cannot find buildx version for ${v}`);
}
}
}
static async getRelease(version, githubToken) {
const github = new GitHub({ token: githubToken });
const releases = await github.releases('Buildx', version.contentOpts);
if (!releases[version.version]) {
throw new Error(`Cannot find Buildx release ${version.version} in releases JSON`);
}
return releases[version.version];
}
}
//# sourceMappingURL=install.js.map