Merge pull request #32 from safedep/chore/docker-add-release-container

chore: Add container release workflow

Author: OmkarPh

.github/workflows/ci.yml

@@ -33,3 +33,27 @@ jobs:
         uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
+      
+  build-container-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+    - name: Checkout Source
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+    - name: Setup QEMU
+      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
+
+    - name: Setup Docker Buildx
+      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
+
+    - name: Build Multi-Platform Container Image (verification only)
+      run: |
+        docker buildx build --platform linux/amd64,linux/arm64 \
+        -t build-container-test:latest .
+
+    - name: Build and Load Native Platform Image for Testing
+      run: |
+        docker buildx build --platform linux/amd64 --load \
+        -t build-container-test:latest .
+

.github/workflows/container.yml

@@ -0,0 +1,71 @@
+name: Container Image Releaser
+
+on:
+  push:
+    tags:
+      - "*"
+    branches:
+      - "main"
+
+concurrency: ci-container-release
+
+permissions:
+  contents: read
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    if: "!contains(github.event.commits[0].message, '[noci]')"
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
+      with:
+        submodules: true
+        fetch-depth: 0
+
+    - name: Registry Login
+      uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Setup QEMU
+      uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7
+
+    - name: Setup Docker Buildx
+      uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55
+
+    - name: Build and Push Container Image
+      run: |
+        # Get the tag if this was a tag push event
+        if [[ "${{ github.ref_type }}" == "tag" ]]; then
+          TAG=${{ github.ref_name }}
+          # Validate tag format (must be vX.Y.Z)
+          if [[ $TAG =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            # Build and push with both version tag and latest
+            docker buildx build --push --platform linux/amd64,linux/arm64 \
+              -t $REGISTRY/$IMAGE_NAME:$TAG \
+              -t $REGISTRY/$IMAGE_NAME:latest \
+              .
+          else
+            echo "Invalid tag format. Must be in format vX.Y.Z (e.g. v1.2.3)"
+            exit 1
+          fi
+        else
+          # For non-tag pushes, just use latest tag
+          docker buildx build --push --platform linux/amd64,linux/arm64 \
+            -t $REGISTRY/$IMAGE_NAME:latest \
+            .
+        fi
+
+

Dockerfile

@@ -0,0 +1,43 @@
+FROM --platform=$BUILDPLATFORM golang:1.24.3-bullseye AS build
+
+WORKDIR /build
+
+# Install cross-compilation tools
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc-aarch64-linux-gnu \
+    libc6-dev-arm64-cross \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY go.mod go.sum ./
+
+RUN go mod download
+
+COPY . .
+
+ARG TARGETPLATFORM
+ENV CGO_ENABLED=1
+
+# Set up cross-compilation environment based on target platform
+RUN case "${TARGETPLATFORM}" in \
+    "linux/amd64") \
+        CC=gcc CXX=g++ GOOS=linux GOARCH=amd64 make ;; \
+    "linux/arm64") \
+        CC=aarch64-linux-gnu-gcc CXX=aarch64-linux-gnu-g++ GOOS=linux GOARCH=arm64 make ;; \
+    *) echo "Unsupported platform: ${TARGETPLATFORM}" && exit 1 ;; \
+    esac
+
+FROM debian:11-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+	ca-certificates \
+	&& rm -rf /var/lib/apt/lists/*
+
+ARG TARGETPLATFORM
+
+LABEL org.opencontainers.image.source=https://github.com/safedep/xbom
+LABEL org.opencontainers.image.description="xbom is a tool to generate a Software Bill of Materials (SBOM) enriched with application metadata using static code analysis."
+LABEL org.opencontainers.image.licenses=Apache-2.0
+
+COPY --from=build /build/bin/xbom /usr/local/bin/xbom
+
+ENTRYPOINT ["xbom"]