2024-06-23 02:30:56 +02:00
13 changed files with 359 additions and 73 deletions
--- a/.drone.yml
+++ b/.drone.yml
@ -0,0 +1,291 @@
+---
+kind: pipeline
+name: test
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+  - name: deps
+    image: golang:1.20
+    commands:
+      - make deps
+    volumes:
+      - name: godeps
+        path: /go
+
+  - name: lint
+    image: golang:1.20
+    commands:
+      - make lint
+    volumes:
+      - name: godeps
+        path: /go
+
+  - name: test
+    image: golang:1.20
+    commands:
+      - make test
+    volumes:
+      - name: godeps
+        path: /go
+
+volumes:
+  - name: godeps
+    temp: {}
+
+trigger:
+  ref:
+    - refs/heads/main
+    - refs/tags/**
+    - refs/pull/**
+
+---
+kind: pipeline
+name: build-binaries
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+  - name: build
+    image: techknowlogick/xgo:go-1.20.x
+    commands:
+      - ln -s /drone/src /source
+      - make release
+
+  - name: executable
+    image: alpine
+    commands:
+      - $(find dist/ -executable -type f -iname ${DRONE_REPO_NAME}-linux-amd64) --help
+
+  - name: changelog-generate
+    image: thegeeklab/git-chglog
+    commands:
+      - git fetch -tq
+      - git-chglog --no-color --no-emoji -o CHANGELOG.md ${DRONE_TAG:---next-tag unreleased unreleased}
+
+  - name: changelog-format
+    image: thegeeklab/alpine-tools
+    commands:
+      - prettier CHANGELOG.md
+      - prettier -w CHANGELOG.md
+
+  - name: publish
+    image: plugins/github-release
+    settings:
+      api_key:
+        from_secret: github_token
+      files:
+        - dist/*
+      note: CHANGELOG.md
+      overwrite: true
+      title: ${DRONE_TAG}
+    when:
+      ref:
+        - refs/tags/**
+
+trigger:
+  ref:
+    - refs/heads/main
+    - refs/tags/**
+    - refs/pull/**
+
+depends_on:
+  - test
+
+---
+kind: pipeline
+name: build-container
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+  - name: dryrun
+    image: thegeeklab/drone-docker-buildx:23
+    settings:
+      dockerfile: Dockerfile.multiarch
+      dry_run: true
+      platforms:
+        - linux/amd64
+        - linux/arm64
+      provenance: false
+      repo: thegeeklab/${DRONE_REPO_NAME}
+    when:
+      ref:
+        - refs/pull/**
+
+  - name: publish-dockerhub
+    image: thegeeklab/drone-docker-buildx:23
+    settings:
+      auto_tag: true
+      dockerfile: Dockerfile.multiarch
+      password:
+        from_secret: docker_password
+      platforms:
+        - linux/amd64
+        - linux/arm64
+      provenance: false
+      repo: thegeeklab/${DRONE_REPO_NAME}
+      username:
+        from_secret: docker_username
+    when:
+      ref:
+        - refs/heads/main
+        - refs/tags/**
+    depends_on:
+      - dryrun
+
+  - name: publish-quay
+    image: thegeeklab/drone-docker-buildx:23
+    settings:
+      auto_tag: true
+      dockerfile: Dockerfile.multiarch
+      password:
+        from_secret: quay_password
+      platforms:
+        - linux/amd64
+        - linux/arm64
+      provenance: false
+      registry: quay.io
+      repo: quay.io/thegeeklab/${DRONE_REPO_NAME}
+      username:
+        from_secret: quay_username
+    when:
+      ref:
+        - refs/heads/main
+        - refs/tags/**
+    depends_on:
+      - dryrun
+
+trigger:
+  ref:
+    - refs/heads/main
+    - refs/tags/**
+    - refs/pull/**
+
+depends_on:
+  - test
+
+---
+kind: pipeline
+name: docs
+
+platform:
+  os: linux
+  arch: amd64
+
+concurrency:
+  limit: 1
+
+steps:
+  - name: markdownlint
+    image: thegeeklab/markdownlint-cli
+    commands:
+      - markdownlint 'docs/content/**/*.md' 'README.md' 'CONTRIBUTING.md'
+
+  - name: spellcheck
+    image: thegeeklab/alpine-tools
+    commands:
+      - spellchecker --files '_docs/**/*.md' 'README.md' 'CONTRIBUTING.md' -d .dictionary -p spell indefinite-article syntax-urls --no-suggestions
+    environment:
+      FORCE_COLOR: true
+      NPM_CONFIG_LOGLEVEL: error
+
+  - name: publish
+    image: thegeeklab/drone-git-action
+    settings:
+      action:
+        - pages
+      author_email: bot@thegeeklab.de
+      author_name: thegeeklab-bot
+      branch: docs
+      message: auto-update documentation
+      netrc_password:
+        from_secret: github_token
+      pages_directory: _docs/
+    when:
+      ref:
+        - refs/heads/main
+
+trigger:
+  ref:
+    - refs/heads/main
+    - refs/tags/**
+    - refs/pull/**
+
+depends_on:
+  - build-binaries
+  - build-container
+
+---
+kind: pipeline
+name: notifications
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+  - name: pushrm-dockerhub
+    image: chko/docker-pushrm:1
+    environment:
+      DOCKER_PASS:
+        from_secret: docker_password
+      DOCKER_USER:
+        from_secret: docker_username
+      PUSHRM_FILE: README.md
+      PUSHRM_SHORT: Drone plugin to build multiarch Docker images with buildx
+      PUSHRM_TARGET: thegeeklab/${DRONE_REPO_NAME}
+    when:
+      status:
+        - success
+
+  - name: pushrm-quay
+    image: chko/docker-pushrm:1
+    environment:
+      APIKEY__QUAY_IO:
+        from_secret: quay_token
+      PUSHRM_FILE: README.md
+      PUSHRM_TARGET: quay.io/thegeeklab/${DRONE_REPO_NAME}
+    when:
+      status:
+        - success
+
+  - name: matrix
+    image: thegeeklab/drone-matrix
+    settings:
+      homeserver:
+        from_secret: matrix_homeserver
+      password:
+        from_secret: matrix_password
+      roomid:
+        from_secret: matrix_roomid
+      template: "Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}"
+      username:
+        from_secret: matrix_username
+    when:
+      status:
+        - success
+        - failure
+
+trigger:
+  ref:
+    - refs/heads/main
+    - refs/tags/**
+  status:
+    - success
+    - failure
+
+depends_on:
+  - docs
+
+---
+kind: signature
+hmac: a62b604d49c98c24360bfaea313f8dba31166133620d5e7656f884e1f20b9ff6
+
+...
--- a/Dockerfile.multiarch
+++ b/Dockerfile.multiarch
@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1.20@sha256:741d6f9bcab778441efe05c8e4369d4f8ff56c9a635a97d77f55d8b0ec62f907 as build
+FROM --platform=$BUILDPLATFORM golang:1.20@sha256:344193a70dc3588452ea39b4a1e465a8d3c91f788ae053f7ee168cebf18e0a50 as build

 ARG TARGETOS
 ARG TARGETARCH
@ -8,7 +8,7 @@ WORKDIR /src

 RUN make build

-FROM docker:24.0-dind@sha256:020562d22f11c27997e00da910ed6b580d93094bc25841cb87aacab4ced4a882
+FROM docker:24.0-dind@sha256:28c6ddb5d7bfdc019fb39cc2797351a6e3e81458ad621808e5e9dd3e41538c77

 LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
 LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
@ -22,7 +22,7 @@ ARG TARGETARCH
 ARG BUILDX_VERSION

 # renovate: datasource=github-releases depName=docker/buildx
-ENV BUILDX_VERSION="${BUILDX_VERSION:-v0.11.2}"
+ENV BUILDX_VERSION="${BUILDX_VERSION:-v0.11.0}"

 ENV DOCKER_HOST=unix:///var/run/docker.sock

--- a/2
+++ b/2
@ -1,7 +1,7 @@
 # renovate: datasource=github-releases depName=mvdan/gofumpt
 GOFUMPT_PACKAGE_VERSION := v0.5.0
 # renovate: datasource=github-releases depName=golangci/golangci-lint
-GOLANGCI_LINT_PACKAGE_VERSION := v1.54.2
+GOLANGCI_LINT_PACKAGE_VERSION := v1.53.3

 EXECUTABLE := drone-docker-buildx

--- a/README.md
+++ b/README.md
@ -1,6 +1,6 @@
 # drone-docker-buildx

-DISCONTINUED: Drone plugin to build multiarch Docker images with buildx
+Drone plugin to build multiarch Docker images with buildx

 [![Build Status](https://img.shields.io/drone/build/thegeeklab/drone-docker-buildx?logo=drone&server=https%3A%2F%2Fdrone.thegeeklab.de)](https://drone.thegeeklab.de/thegeeklab/drone-docker-buildx)
 [![Docker Hub](https://img.shields.io/badge/dockerhub-latest-blue.svg?logo=docker&logoColor=white)](https://hub.docker.com/r/thegeeklab/drone-docker-buildx)
@ -10,8 +10,6 @@ DISCONTINUED: Drone plugin to build multiarch Docker images with buildx
 [![Source: GitHub](https://img.shields.io/badge/source-github-blue.svg?logo=github&logoColor=white)](https://github.com/thegeeklab/drone-docker-buildx)
 [![License: Apache-2.0](https://img.shields.io/github/license/thegeeklab/drone-docker-buildx)](https://github.com/thegeeklab/drone-docker-buildx/blob/main/LICENSE)

-> **DISCONTINUED:** As I don't use Drone CI anymore, this project is unmaintained. If you are interested in a free and open source CI system check out [Woodpecker CI](https://woodpecker-ci.org/).
-
 Drone plugin to build multiarch Docker images with buildx. This plugin is a fork of [drone-plugins/drone-docker](https://github.com/drone-plugins/drone-docker). You can find the full documentation at [https://drone-plugin-index.geekdocs.de](https://drone-plugin-index.geekdocs.de/plugins/drone-docker-buildx).

 ## Versioning
--- a/_docs/content/_index.md
+++ b/_docs/content/_index.md
@ -27,7 +27,7 @@ The tags follow the major version of Docker, e.g. `20`, and the minor and patch
 Be aware that the this plugin requires [privileged](https://docs.drone.io/pipeline/docker/syntax/steps/#privileged-mode) capabilities, otherwise the integrated Docker daemon is not able to start.
 {{< /hint >}}

-```yaml
+```YAML
 kind: pipeline
 name: default

@ -58,7 +58,7 @@ If the created image is to be pushed to registries other than the default Docker

 **GHCR:**

-```yaml
+```YAML
 kind: pipeline
 name: default

@ -76,7 +76,7 @@ steps:

 **AWS ECR:**

-```yaml
+```YAML
 kind: pipeline
 name: default

@ -95,11 +95,34 @@ steps:
      tags: latest
 ```

+#### Expose secrets to the build
+
+The [secrets](https://docs.docker.com/engine/reference/commandline/buildx_build/#secret) can be used by the build using `RUN --mount=type=secret` mount.
+
+```Yaml
+kind: pipeline
+name: default
+
+steps:
+  - name: docker
+    image: thegeeklab/drone-docker-buildx:23
+    privileged: true
+    environment:
+      SECURE_TOKEN:
+        from_secret: secure_token
+    settings:
+      secrets:
+        - "id=raw_file_secret,src=file.txt"
+        - "id=SECRET_TOKEN"
+```
+
+To use secrets from files a [host volume](https://docs.drone.io/pipeline/docker/syntax/volumes/host/) is required. This should be used with caution and avoided whenever possible.
+
 ## Build

 Build the binary with the following command:

-```shell
+```Shell
 export GOOS=linux
 export GOARCH=amd64
 export CGO_ENABLED=0
@ -110,13 +133,13 @@ make build

 Build the Docker image with the following command:

-```shell
+```Shell
 docker build --file docker/Dockerfile.amd64 --tag thegeeklab/drone-docker-buildx .
 ```

 ## Test

-```shell
+```Shell
 docker run --rm \
  -e PLUGIN_TAG=latest \
  -e PLUGIN_REPO=octocat/hello-world \
--- a/_docs/data/data.yaml
+++ b/_docs/data/data.yaml
@ -75,16 +75,15 @@ properties:
    description: |
      Content of the docker buildkit toml [config](https://github.com/moby/buildkit/blob/master/docs/buildkitd.toml.md). Example:

-      ```yaml
-      steps:
-        - name: Build
-          image: thegeeklab/drone-docker-buildx:23
-          settings:
-            repo: example/repo
-            buildkit_config: |
-            [registry."registry.local:30081"]
-              http = true
-              insecure = true
+      ```TOML
+      - name: Build
+        image: thegeeklab/drone-docker-buildx:23
+        settings:
+          repo: example/repo
+          buildkit_config: |
+          [registry."registry.local:30081"]
+            http = true
+            insecure = true
      ```
    type: string
    defaultValue: false
@ -164,16 +163,15 @@ properties:
      Images to consider as [cache sources](https://docs.docker.com/engine/reference/commandline/buildx_build/#cache-from). To properly work,
      commas used in the cache source entries need to be escaped:

-      ```yaml
-      steps:
-        - name: Build
-          image: thegeeklab/drone-docker-buildx:23
-          settings:
-            repo: example/repo
-            cache_from:
-              # while using quotes, double-escaping is required
-              - "type=registry\\\\,ref=example"
-              - 'type=foo\\,ref=bar'
+      ```Yaml
+      - name: Build
+        image: thegeeklab/drone-docker-buildx:23
+        settings:
+          repo: example/repo
+          cache_from:
+            # using quotes double-escaping is required
+            - "type=registry\\\\,ref=example"
+            - 'type=foo\\,ref=bar'
      ```
    type: list
    required: false
@ -269,27 +267,6 @@ properties:
    required: false

  - name: secrets
-    description: |
-      Exposes [secrets](https://docs.docker.com/engine/reference/commandline/buildx_build/#secret) to the build.
-      The secrets can be used by the build using `RUN --mount=type=secret` mount.
-
-      ```yaml
-      steps:
-        - name: Build
-          image: thegeeklab/drone-docker-buildx:23
-          privileged: true
-          environment:
-            SECURE_TOKEN:
-              from_secret: secure_token
-          settings:
-            secrets:
-              # while using quotes, double-escaping is required
-              - "id=raw_file_secret\\\\,src=file.txt"
-              - 'id=other_raw_file_secret\\,src=other_file.txt'
-              - "id=SECRET_TOKEN"
-      ```
-
-      To use secrets from files a [host volume](https://docs.drone.io/pipeline/docker/syntax/volumes/host/) is required.
-      This should be used with caution and avoided whenever possible.
+    description: Exposes [secrets](https://docs.docker.com/engine/reference/commandline/buildx_build/#secret) to the build.
    type: list
    required: false
--- a/cmd/drone-docker-buildx/config.go
+++ b/cmd/drone-docker-buildx/config.go
@ -321,12 +321,12 @@ func settingsFlags(settings *plugin.Settings, category string) []cli.Flag {
 			Destination: &settings.Build.SBOM,
 			Category:    category,
 		},
-		&cli.GenericFlag{
-			Name:     "secrets",
-			EnvVars:  []string{"PLUGIN_SECRETS"},
-			Usage:    "exposes secrets to the build",
-			Value:    &drone.StringSliceFlag{},
-			Category: category,
+		&cli.StringSliceFlag{
+			Name:        "secrets",
+			EnvVars:     []string{"PLUGIN_SECRETS"},
+			Usage:       "exposes secrets to the build",
+			Destination: &settings.Build.Secrets,
+			Category:    category,
 		},
 	}
 }
--- a/cmd/drone-docker-buildx/main.go
+++ b/cmd/drone-docker-buildx/main.go
@ -57,13 +57,6 @@ func run(settings *plugin.Settings) cli.ActionFunc {

 		settings.Build.CacheFrom = cacheFrom.Get()

-		secrets, ok := ctx.Generic("secrets").(*drone.StringSliceFlag)
-		if !ok {
-			return fmt.Errorf("%w: failed to read secrets input", ErrTypeAssertionFailed)
-		}
-
-		settings.Build.Secrets = secrets.Get()
-
 		plugin := plugin.New(
 			*settings,
 			urfave.PipelineFromContext(ctx),
--- a/go.mod
+++ b/go.mod
@ -8,7 +8,7 @@ require (
 	github.com/sirupsen/logrus v1.9.3
 	github.com/thegeeklab/drone-plugin-lib/v2 v2.3.4
 	github.com/urfave/cli/v2 v2.25.5
-	golang.org/x/sys v0.11.0
+	golang.org/x/sys v0.9.0
 )

 require (
--- a/go.sum
+++ b/go.sum
@ -23,8 +23,8 @@ github.com/urfave/cli/v2 v2.25.5/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6f
 github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
 github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
+golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
--- a/plugin/docker.go
+++ b/plugin/docker.go
@ -160,7 +160,7 @@ func commandBuild(build Build, dryrun bool) *execabs.Cmd {
 		args = append(args, "--sbom", build.SBOM)
 	}

-	for _, secret := range build.Secrets {
+	for _, secret := range build.Secrets.Value() {
 		args = append(args, "--secret", secret)
 	}

--- a/plugin/impl.go
+++ b/plugin/impl.go
@ -65,7 +65,7 @@ type Build struct {
 	Labels       cli.StringSlice // Docker build labels
 	Provenance   string          // Docker build provenance attestation
 	SBOM         string          // Docker build sbom attestation
-	Secrets      []string        // Docker build secrets
+	Secrets      cli.StringSlice // Docker build secrets
 }

 // Settings for the Plugin.
--- a/renovate.json
+++ b/renovate.json
@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>thegeeklab/renovate-presets:golang"]
+}