oras-project / setup-oras Goto Github PK

View Code? Open in Web Editor NEW

13.0 3.0 9.0 236 KB

Set up your GitHub Actions workflow with a specific version of ORAS

Home Page: https://oras.land/cli

License: Apache License 2.0

TypeScript 100.00%

cli github-actions oras

setup-oras's Introduction

setup-oras

Setup ORAS CLI on GitHub Actions runners.

Quick Start

Setup the oras CLI of the default version:

steps:
  - uses: oras-project/setup-oras@v1
  - run: oras version

Advanced Usage

Install a specific version of the oras CLI by specifying the input version without the prefix v. Stable versions (not pre-release versions) are supported and can be found at oras releases.

For example, install oras version v1.0.0.

steps:
  - uses: oras-project/setup-oras@v1
    with:
      version: 1.0.0
  - run: oras version

You can also download oras CLI from any preferred trusted source, by specifying link of the source via url and the SHA256 checksum via checksum. This can be used to download a pre-release version or download from a proxy other than github.com.

For example, install oras version v1.2.0-beta.1.

steps:
  - uses: oras-project/setup-oras@v1
    with:
      url: https://github.com/oras-project/oras/releases/download/v1.2.0-beta.1/oras_1.2.0-beta.1_linux_amd64.tar.gz
      checksum: 37d86f848f7c7c471035cf8218f06372fd72a9fbdca1e10f509738e222b3b2be
  - run: oras version

Docs

Documentation for the ORAS CLI is located on the project website.

Code of Conduct

This project has adopted the CNCF Code of Conduct. See CODE_OF_CONDUCT.md for further details.

setup-oras's People

Contributors

Stargazers

Watchers

Forkers

shizhmsft qweeah feynmanzhou terryhowe two-hearts liangyuanpeng bethgriggs t3hmrman

setup-oras's Issues

Checksum support

To enhance security, setup-oras should check the digest of the downloaded blob.

automate build and release process

According to the Github doc, we will be able to automate the publish process via setting up a dedicated action.

Cut the first release and publish it to GH marketplace

According to oras-project/oras#744, the first phase of development is finished and ORAS v1.0.0 is available on Mar 20, now it's ready to cut the first release for this GH actions and publish to the GH marketplace.

can not setup oras 1.2.0

  - uses: oras-project/setup-oras@v1
    with:
      version: 1.2.0

Just got the error Error: official ORAS CLI releases does not contain version 1.2.0

Also try with oras-project/setup-oras@main,and also same with here.

Have test with wget and download successed.

$ wget https://github.com/oras-project/oras/releases/download/v1.2.0/oras_1.2.0_linux_amd64.tar.gz
--2024-06-05 08:36:51--  https://github.com/oras-project/oras/releases/download/v1.2.0/oras_1.2.0_linux_amd64.tar.gz
Resolving github.com (github.com)... 140.82.113.3
Connecting to github.com (github.com)|140.82.113.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/162945532/88aa2d48-cbcc-4a56-914c-79a4a0d3ee69?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240605%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240605T083651Z&X-Amz-Expires=300&X-Amz-Signature=2c1505420d8fae588add825609f71b900ae0e6650327f720b39ca21d30053cd9&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=162945532&response-content-disposition=attachment%3B%20filename%3Doras_1.2.0_linux_amd64.tar.gz&response-content-type=application%2Foctet-stream [following]
--2024-06-05 08:36:51--  https://objects.githubusercontent.com/github-production-release-asset-2e65be/162945532/88aa2d48-cbcc-4a56-914c-79a4a0d3ee69?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240605%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240605T083651Z&X-Amz-Expires=300&X-Amz-Signature=2c1505420d8fae588add825609f71b900ae0e6650327f720b39ca21d30053cd9&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=162945532&response-content-disposition=attachment%3B%20filename%3Doras_1.2.0_linux_amd64.tar.gz&response-content-type=application%2Foctet-stream
Resolving objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.111.133, 185.199.109.133, 185.199.108.133, ...
Connecting to objects.githubusercontent.com (objects.githubusercontent.com)|185.199.111.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4052022 (3.9M) [application/octet-stream]
Saving to: ‘oras_1.2.0_linux_amd64.tar.gz’

oras_1.2.0_linux_amd64.tar.gz                                                    100%[=======================================================================================================================================================================================================>]   3.86M  --.-KB/s    in 0.02s   

2024-06-05 08:36:51 (201 MB/s) - ‘oras_1.2.0_linux_amd64.tar.gz’ saved [4052022/4052022]

`setup-oras` is not required for Ubuntu runners

We should mention in README.md that the latest oras CLI is pre-installed in GitHub-hosted runners used for Actions, as well as for Microsoft-hosted agents. Therefore, setup-oras is not required for those runners to use the oras CLI.

Support downloading ORAS through mirror

In airgapped situations, users will need to download the ORAS binary from a mirrored location.

Enforce branch policies on this repository

To improve the security of the ORAS project we need to enforce the branch policies for this repository. I propose that we enforce the policies as follows:

Use the following rules for main and release/* branches:
- Require PR before merging
  - Require 3 approvals
  - Dismiss stale PR approvals when new commits are pushed
  - Require review from Code Owners
  - Require status checks to pass before merging
  - Require conversation resolution before merging
  - Require signed commits
  - Do not allow bypass the above settings

Please add your comments and proposals for additional changes to this issue.