From 0accc529856e2dc561e37202d7042e3eef2a79dd Mon Sep 17 00:00:00 2001 From: adamPetho Date: Thu, 23 Jul 2026 19:00:44 +0200 Subject: [PATCH 1/4] add build-core.yml to create and push new docker images on new tags --- .github/workflows/build-core.yml | 75 ++++++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100644 .github/workflows/build-core.yml diff --git a/.github/workflows/build-core.yml b/.github/workflows/build-core.yml new file mode 100644 index 0000000..47aecd3 --- /dev/null +++ b/.github/workflows/build-core.yml @@ -0,0 +1,75 @@ +name: Build, Scan, Publish and Sign Lookup-Core Scanner + +on: + push: + tags: ['core-v*'] + +permissions: + contents: read + packages: write + id-token: write + attestations: write + +env: + IMAGE_NAME: ghcr.io/adampetho/lookup-core + DOCKERFILE_PATH: ./Dockerfile.core + +jobs: + scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: docker/setup-buildx-action@v3 + + - name: Build candidate + uses: docker/build-push-action@v6 + with: + context: . + file: ${{ env.DOCKERFILE_PATH }} + platforms: linux/amd64 + load: true + tags: lookup-core:scan-candidate + + - name: Scan candidate with Trivy # Check for vulnerabilities with Trivy before pushing to GHCR + uses: aquasecurity/trivy-action@0.72.0 # Pin to version, instead of relying on master + with: + image-ref: lookup-core:scan-candidate + severity: CRITICAL,HIGH + exit-code: 1 + + build-and-push: + needs: scan + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Extract version from tag + id: version + run: echo "version=${GITHUB_REF_NAME#core-}" >> "$GITHUB_OUTPUT" + + - uses: docker/setup-qemu-action@v3 + - uses: docker/setup-buildx-action@v3 + - uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Build and push + id: build + uses: docker/build-push-action@v6 + with: + context: . + file: ${{ env.DOCKERFILE_PATH }} + platforms: linux/amd64,linux/arm64 + push: true + provenance: true + sbom: true + tags: | + ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }} + ${{ env.IMAGE_NAME }}:latest + + - name: Install Cosign + uses: sigstore/cosign-installer@v3 + - name: Keyless Sign + run: cosign sign --yes ${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }} \ No newline at end of file From ae0f460feeea9a94d46812e60e25fa291c683388 Mon Sep 17 00:00:00 2001 From: adamPetho Date: Thu, 23 Jul 2026 19:01:04 +0200 Subject: [PATCH 2/4] add build-website.yml to create and push new docker image on new tags --- .github/workflows/build-website.yml | 75 +++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100644 .github/workflows/build-website.yml diff --git a/.github/workflows/build-website.yml b/.github/workflows/build-website.yml new file mode 100644 index 0000000..9705b10 --- /dev/null +++ b/.github/workflows/build-website.yml @@ -0,0 +1,75 @@ +name: Build, Scan, Publish and Sign Lookup-Core Website + +on: + push: + tags: ['website-v*'] + +permissions: + contents: read + packages: write + id-token: write + attestations: write + +env: + IMAGE_NAME: ghcr.io/adampetho/lookup-website + DOCKERFILE_PATH: ./Dockerfile.blazor + +jobs: + scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: docker/setup-buildx-action@v3 + + - name: Build candidate + uses: docker/build-push-action@v6 + with: + context: . + file: ${{ env.DOCKERFILE_PATH }} + platforms: linux/amd64 + load: true + tags: lookup-website:scan-candidate + + - name: Scan candidate with Trivy # Check for vulnerabilities with Trivy before pushing to GHCR + uses: aquasecurity/trivy-action@0.72.0 # Pin to version, instead of relying on master + with: + image-ref: lookup-website:scan-candidate + severity: CRITICAL,HIGH + exit-code: 1 + + build-and-push: + needs: scan + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Extract version from tag + id: version + run: echo "version=${GITHUB_REF_NAME#website-}" >> "$GITHUB_OUTPUT" + + - uses: docker/setup-qemu-action@v3 + - uses: docker/setup-buildx-action@v3 + - uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Build and push + id: build + uses: docker/build-push-action@v6 + with: + context: . + file: ${{ env.DOCKERFILE_PATH }} + platforms: linux/amd64,linux/arm64 + push: true + provenance: true + sbom: true + tags: | + ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }} + ${{ env.IMAGE_NAME }}:latest + + - name: Install Cosign + uses: sigstore/cosign-installer@v3 + - name: Keyless Sign + run: cosign sign --yes ${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }} \ No newline at end of file From 1683a014fb04a1a0923fac80aa2112c09a36660d Mon Sep 17 00:00:00 2001 From: adamPetho Date: Thu, 23 Jul 2026 19:17:15 +0200 Subject: [PATCH 3/4] add labels for metadata --- .github/workflows/build-core.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/build-core.yml b/.github/workflows/build-core.yml index 47aecd3..f31bd93 100644 --- a/.github/workflows/build-core.yml +++ b/.github/workflows/build-core.yml @@ -65,6 +65,13 @@ jobs: push: true provenance: true sbom: true + labels: | + org.opencontainers.image.title=LookUp Scanner + org.opencontainers.image.description=Scans the Bitcoin blockchain for OP_RETURN human-readable messages. + org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} + org.opencontainers.image.version=${{ steps.version.outputs.version }} + org.opencontainers.image.revision=${{ github.sha }} + org.opencontainers.image.licenses=MIT tags: | ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }} ${{ env.IMAGE_NAME }}:latest From 36a27a4117dd67fb9d8ceb732e8c3fb12e67ae4a Mon Sep 17 00:00:00 2001 From: adamPetho Date: Thu, 23 Jul 2026 19:17:28 +0200 Subject: [PATCH 4/4] add labels for website metadata --- .github/workflows/build-website.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/build-website.yml b/.github/workflows/build-website.yml index 9705b10..43d3cb4 100644 --- a/.github/workflows/build-website.yml +++ b/.github/workflows/build-website.yml @@ -65,6 +65,13 @@ jobs: push: true provenance: true sbom: true + labels: | + org.opencontainers.image.title=LookUp Website + org.opencontainers.image.description=Browse messages on the Bitcoin blockchain. + org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} + org.opencontainers.image.version=${{ steps.version.outputs.version }} + org.opencontainers.image.revision=${{ github.sha }} + org.opencontainers.image.licenses=MIT tags: | ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }} ${{ env.IMAGE_NAME }}:latest