lambda-microvm-github-runner/.github/workflows/release.yml at main · neebs12/lambda-microvm-github-runner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "24"
          cache: npm
      - run: npm ci
      - name: Audit Node dependencies
        run: npm audit --audit-level=high
      - run: npm run check
      - name: Verify committed Action bundle
        run: git diff --exit-code -- dist
      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
        with:
          platforms: arm64
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - name: Build runner image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: runner-image
          platforms: linux/arm64
          tags: lambda-microvm-github-runner:release
          load: true
      - name: Scan runner image
        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
        with:
          image: lambda-microvm-github-runner:release
          fail-build: true
          severity-cutoff: critical
          only-fixed: true
          output-format: table
      - run: mkdir -p build
      - name: Generate runner image SBOM
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
        with:
          image: lambda-microvm-github-runner:release
          format: cyclonedx-json
          output-file: build/runner-image-sbom.cdx.json
          upload-artifact: false
          upload-release-assets: false
          dependency-snapshot: false
      - name: Package release artifacts
        run: |
          scripts/package-runner-image.sh
          npm sbom --sbom-format=cyclonedx > build/action-sbom.cdx.json
          sha256sum \
            build/runner-image.zip \
            build/runner-image-sbom.cdx.json \
            build/action-sbom.cdx.json \
            dist/index.js \
            > build/SHA256SUMS
      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "${GITHUB_REF_NAME}" \
            --verify-tag \
            --generate-notes \
            --title "${GITHUB_REF_NAME}" \
            build/runner-image.zip \
            build/runner-image-sbom.cdx.json \
            build/action-sbom.cdx.json \
            build/SHA256SUMS