ci: use docker github builder to build binaries

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

.github/workflows/build.yml

@@ -346,64 +346,73 @@ jobs:
         with:
           sarif_file: ${{ env.DESTDIR }}/govulncheck.out
 
-  prepare-binaries:
-    runs-on: ubuntu-24.04
-    outputs:
-      matrix: ${{ steps.platforms.outputs.matrix }}
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v6
-      -
-        name: Create matrix
-        id: platforms
-        run: |
-          echo "matrix=$(docker buildx bake binaries-cross --print | jq -cr '.target."binaries-cross".platforms')" >>${GITHUB_OUTPUT}
-      -
-        name: Show matrix
-        run: |
-          echo ${{ steps.platforms.outputs.matrix }}
-
   binaries:
+    uses: docker/github-builder-experimental/.github/workflows/bake.yml@8fc70909404a502fd0eca6601b99b32fa7192b03
+    permissions:
+      contents: read # same as global permission
+      id-token: write # for signing attestation(s) with GitHub OIDC Token
+    with:
+      runner: amd64
+      target: release
+      output: local
+      push: ${{ github.event_name != 'pull_request' }}
+      artifact-name: buildx
+      cache: true
+      cache-scope: binaries
+      bake-sbom: true
+
+  binaries-finalize:
     runs-on: ubuntu-24.04
     needs:
-      - prepare-binaries
-    strategy:
-      fail-fast: false
-      matrix:
-        platform: ${{ fromJson(needs.prepare-binaries.outputs.matrix) }}
+      - binaries
     steps:
       -
-        name: Prepare
-        run: |
-          platform=${{ matrix.platform }}
-          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
-      -
-        name: Checkout
-        uses: actions/checkout@v6
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        name: Download artifacts
+        uses: actions/download-artifact@v6
         with:
-          version: ${{ env.SETUP_BUILDX_VERSION }}
-          driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
-          buildkitd-flags: --debug
+          path: /tmp/buildx-output
+          pattern: ${{ needs.binaries.outputs.artifact-name }}*
+          merge-multiple: true
       -
-        name: Build
+        name: Rename provenance and sbom
         run: |
-          make release
-        env:
-          PLATFORMS: ${{ matrix.platform }}
-          CACHE_FROM: type=gha,scope=binaries-${{ env.PLATFORM_PAIR }}
-          CACHE_TO: type=gha,scope=binaries-${{ env.PLATFORM_PAIR }},mode=max
+          for pdir in /tmp/buildx-output/*/; do
+            (
+              cd "$pdir"
+              binname=$(find . -name 'buildx-*')
+              filename=$(basename "${binname%.exe}")
+              mv "provenance.json" "${filename}.provenance.json"
+              mv "sbom-binaries.spdx.json" "${filename}.sbom.json"
+              find . -name 'sbom*.json' -exec rm {} \;
+              if [ -f "provenance.sigstore.json" ]; then
+                mv "provenance.sigstore.json" "${filename}.provenance.sigstore.json"
+              fi
+            )
+          done
+          mkdir -p "${{ env.DESTDIR }}"
+          mv /tmp/buildx-output/**/* "${{ env.DESTDIR }}/"
       -
-        name: Upload artifacts
+        name: Create checksums
+        working-directory: ${{ env.DESTDIR }}
+        run: |
+          sha256sum -b buildx-* > ./checksums.txt
+          sed -i '/darwin/d' ./checksums.txt
+          sha256sum -c --strict checksums.txt
+      -
+        name: List artifacts
+        working-directory: ${{ env.DESTDIR }}
+        run: |
+          tree -nh .
+      -
+        name: Check artifacts
+        working-directory: ${{ env.DESTDIR }}
+        run: |
+          find . -type f -exec file -e ascii -- {} +
+      -
+        name: Upload release binaries
         uses: actions/upload-artifact@v6
         with:
-          name: buildx-${{ env.PLATFORM_PAIR }}
+          name: release
           path: ${{ env.DESTDIR }}/*
           if-no-files-found: error
 
@@ -486,29 +495,14 @@ jobs:
     needs:
       - test-integration
       - test-unit
-      - binaries
+      - binaries-finalize
     steps:
       -
-        name: Checkout
-        uses: actions/checkout@v6
-      -
-        name: Download binaries
+        name: Download release binaries
         uses: actions/download-artifact@v7
         with:
           path: ${{ env.DESTDIR }}
-          pattern: buildx-*
-          merge-multiple: true
-      -
-        name: Create checksums
-        run: ./hack/hash-files
-      -
-        name: List artifacts
-        run: |
-          tree -nh ${{ env.DESTDIR }}
-      -
-        name: Check artifacts
-        run: |
-          find ${{ env.DESTDIR }} -type f -exec file -e ascii -- {} +
+          name: release
       -
         name: GitHub Release
         if: startsWith(github.ref, 'refs/tags/v')

Makefile

@@ -30,10 +30,6 @@ install: binaries
 	mkdir -p ~/.docker/cli-plugins
 	install bin/build/buildx ~/.docker/cli-plugins/docker-buildx
 
-.PHONY: release
-release:
-	./hack/release
-
 .PHONY: validate-all
 validate-all: lint test validate-vendor validate-docs
 

hack/hash-files

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -eu -o pipefail
-
-: "${DESTDIR=./bin/release}"
-
-if [ ! -d "$DESTDIR" ]; then
-  exit 0
-fi
-
-# checksums
-(
-  cd ${DESTDIR}
-  sha256sum -b buildx-* > ./checksums.txt
-  sed -i '/darwin/d' ./checksums.txt
-  sha256sum -c --strict checksums.txt
-)

hack/release

@@ -1,57 +0,0 @@
-#!/usr/bin/env bash
-
-set -eu -o pipefail
-
-: "${GITHUB_ACTIONS=}"
-: "${GITHUB_REPOSITORY=}"
-: "${GITHUB_RUN_ID=}"
-
-: "${BUILDX_CMD=docker buildx}"
-: "${DESTDIR=./bin/release}"
-: "${CACHE_FROM=}"
-: "${CACHE_TO=}"
-: "${PLATFORMS=}"
-
-if [ -n "$CACHE_FROM" ]; then
-  for cfrom in $CACHE_FROM; do
-    setFlags+=(--set "*.cache-from=$cfrom")
-  done
-fi
-if [ -n "$CACHE_TO" ]; then
-  for cto in $CACHE_TO; do
-    setFlags+=(--set "*.cache-to=$cto")
-  done
-fi
-if [ -n "$PLATFORMS" ]; then
-  setFlags+=(--set "*.platform=$PLATFORMS")
-fi
-if ${BUILDX_CMD} build --help 2>&1 | grep -- '--attest' >/dev/null; then
-  prvattrs="mode=max"
-  if [ "$GITHUB_ACTIONS" = "true" ]; then
-    prvattrs="$prvattrs,builder-id=https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-  fi
-  setFlags+=(--set "*.attest=type=sbom")
-  setFlags+=(--set "*.attest=type=provenance,$prvattrs")
-fi
-
-output=$(mktemp -d -t buildx-output.XXXXXXXXXX)
-
-(
-  set -x
-  ${BUILDX_CMD} bake "${setFlags[@]}" --set "*.args.BUILDKIT_MULTI_PLATFORM=true" --set "*.output=$output" release
-)
-
-for pdir in "${output}"/*/; do
-  (
-    cd "$pdir"
-    binname=$(find . -name 'buildx-*')
-    filename=$(basename "${binname%.exe}")
-    mv "provenance.json" "${filename}.provenance.json"
-    mv "sbom-binaries.spdx.json" "${filename}.sbom.json"
-    find . -name 'sbom*.json' -exec rm {} \;
-  )
-done
-
-mkdir -p "$DESTDIR"
-mv "$output"/**/* "$DESTDIR/"
-rm -rf "$output"