Module Distribution with GitHub Actions

Timoni can be used in GitHub workflows to vet, push and sign modules to container registries. The workflows below install the Timoni CLI with the Timoni GitHub Action and run timoni mod commands against the module.

Push to GitHub Container Registry

Example workflow for vetting and pushing a module to GitHub Container Registry:

name: Release module
on:
  push:
    tags: ['*'] # semver format

permissions:
  contents: read # needed for checkout
  packages: write # needed for GHCR access

jobs:
  push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/[email protected]
      - name: Setup Timoni
        uses: stefanprodan/timoni/actions/[email protected]
      - name: Vet module
        run: |
          timoni mod vet ./my-module
      - name: Push module
        run: |
          timoni mod push ./my-module \
            oci://ghcr.io/${{ github.repository_owner }}/my-module \
            --version ${{ github.ref_name }} \
            --creds ${{ github.actor }}:${{ secrets.GITHUB_TOKEN }} \
            --latest \
            -a 'org.opencontainers.image.licenses=Apache-2.0' \
            -a 'org.opencontainers.image.source=https://github.com/${{ github.repository }}' \
            -a 'org.opencontainers.image.description=My Timoni module.'

Push and sign with Cosign Keyless

Example workflow for pushing and signing the module using Cosign and GitHub OIDC:

name: Release and sign module
on:
  push:
    tags: ['*'] # semver format

permissions:
  contents: read # needed for checkout
  packages: write # needed for GHCR access
  id-token: write # needed for signing

jobs:
  push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/[email protected]
      - name: Setup Cosign
        uses: sigstore/[email protected]
      - name: Setup Timoni
        uses: stefanprodan/timoni/actions/[email protected]
      - name: Login to GHCR
        uses: docker/[email protected]
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Vet module
        run: |
          timoni mod vet ./my-module
      - name: Push and Sign
        run: |
          timoni mod push ./my-module \
            oci://ghcr.io/${{ github.repository_owner }}/my-module \
            --version ${{ github.ref_name }} \
            --latest \
            -a 'org.opencontainers.image.licenses=Apache-2.0' \
            -a 'org.opencontainers.image.source=https://github.com/${{ github.repository }}' \
            -a 'org.opencontainers.image.description=My Timoni module.' \
            --sign=cosign

Push to Docker Hub

Example workflow for using docker login to authenticate to Docker Hub:

name: Release module
on:
  push:
    tags: ['*'] # semver format

permissions:
  contents: read # needed for checkout

jobs:
  push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/[email protected]
      - name: Setup Timoni
        uses: stefanprodan/timoni/actions/[email protected]
      - name: Login to Docker Hub
        uses: docker/[email protected]
        with:
          registry: docker.io
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Vet module
        run: |
          timoni mod vet ./my-module
      - name: Push
        run: |
          timoni mod push ./my-module \
            oci://docker.io/my-org/my-module \
            --version ${{ github.ref_name }} \
            --latest \
            -a 'org.opencontainers.image.licenses=Apache-2.0' \
            -a 'org.opencontainers.image.source=https://github.com/${{ github.repository }}' \
            -a 'org.opencontainers.image.description=My Timoni module.'
      - name: Pull
        run: |
          mkdir -p /tmp/my-module
          timoni mod pull oci://docker.io/my-org/my-module \
            --version ${{ github.ref_name }} \
            --output /tmp/my-module

Note that docker/login-action can be used to authenticate to any private registry including ACR, ECR, GCR.

CUE Language

Module Development