build: add Docker image build support with RPM-based workflow

.github/workflows/build-docker.yml

@@ -0,0 +1,179 @@
+name: Build Docker Images
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'main'
+    tags:
+      - 'v*.*.*'
+  pull_request:
+    branches:
+      - 'master'
+      - 'main'
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Docker Setup Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker-container
+          driver-opts: image=moby/buildkit:master,network=host
+
+      - name: Docker meta (fde)
+        id: meta-fde
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/openanolis/cryptpilot-fde
+          labels: |
+            org.opencontainers.image.title=cryptpilot-fde
+            org.opencontainers.image.description=Full-disk encryption tooling for system volumes
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,format=long
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Docker meta (crypt)
+        id: meta-crypt
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/openanolis/cryptpilot-crypt
+          labels: |
+            org.opencontainers.image.title=cryptpilot-crypt
+            org.opencontainers.image.description=Data volume encryption tooling
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,format=long
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Docker meta (verity)
+        id: meta-verity
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/openanolis/cryptpilot-verity
+          labels: |
+            org.opencontainers.image.title=cryptpilot-verity
+            org.opencontainers.image.description=Integrity measurement tool for directory trees
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,format=long
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      # Build all three images sequentially to maximize cache reuse
+      # Builder stage is shared and cached across all three builds
+      - name: Build cryptpilot-fde
+        uses: docker/build-push-action@v6.9.0
+        with:
+          context: .
+          file: Dockerfile
+          target: release-fde
+          tags: |
+            cryptpilot-fde:test
+            ${{ steps.meta-fde.outputs.tags }}
+          labels: ${{ steps.meta-fde.outputs.labels }}
+          outputs: type=docker,dest=${{ runner.temp }}/cryptpilot-fde.tar
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build cryptpilot-crypt
+        uses: docker/build-push-action@v6.9.0
+        with:
+          context: .
+          file: Dockerfile
+          target: release-crypt
+          tags: |
+            cryptpilot-crypt:test
+            ${{ steps.meta-crypt.outputs.tags }}
+          labels: ${{ steps.meta-crypt.outputs.labels }}
+          outputs: type=docker,dest=${{ runner.temp }}/cryptpilot-crypt.tar
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build cryptpilot-verity
+        uses: docker/build-push-action@v6.9.0
+        with:
+          context: .
+          file: Dockerfile
+          target: release-verity
+          tags: |
+            cryptpilot-verity:test
+            ${{ steps.meta-verity.outputs.tags }}
+          labels: ${{ steps.meta-verity.outputs.labels }}
+          outputs: type=docker,dest=${{ runner.temp }}/cryptpilot-verity.tar
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # Test all images
+      - name: Load and test cryptpilot-fde
+        run: |
+          docker load --input ${{ runner.temp }}/cryptpilot-fde.tar
+          docker run --rm cryptpilot-fde:test cryptpilot-fde --version
+
+      - name: Load and test cryptpilot-crypt
+        run: |
+          docker load --input ${{ runner.temp }}/cryptpilot-crypt.tar
+          docker run --rm cryptpilot-crypt:test cryptpilot-crypt --version
+
+      - name: Load and test cryptpilot-verity
+        run: |
+          docker load --input ${{ runner.temp }}/cryptpilot-verity.tar
+          docker run --rm cryptpilot-verity:test cryptpilot-verity --version
+
+      # Push images (only on tag or master/main branch)
+      - name: Login to GHCR Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push cryptpilot-fde
+        env:
+          IMAGE_TAGS: ${{ steps.meta-fde.outputs.tags }}
+        run: |
+          set -e
+          set -x
+          for tag in ${IMAGE_TAGS}; do
+              docker tag cryptpilot-fde:test ${tag}
+              docker push ${tag}
+          done
+
+      - name: Push cryptpilot-crypt
+        env:
+          IMAGE_TAGS: ${{ steps.meta-crypt.outputs.tags }}
+        run: |
+          set -e
+          set -x
+          for tag in ${IMAGE_TAGS}; do
+              docker tag cryptpilot-crypt:test ${tag}
+              docker push ${tag}
+          done
+
+      - name: Push cryptpilot-verity
+        env:
+          IMAGE_TAGS: ${{ steps.meta-verity.outputs.tags }}
+        run: |
+          set -e
+          set -x
+          for tag in ${IMAGE_TAGS}; do
+              docker tag cryptpilot-verity:test ${tag}
+              docker push ${tag}
+          done

APPLICATION/cryptpilot-crypt/buildspec.yml

@@ -0,0 +1,37 @@
+name: &NAME
+version: &VERSION
+image_type: &IMAGE_TYPE
+baseos_version: &BASEOS_VERSION
+
+# 定义镜像仓库信息
+repository_info:
+  acr: &ACR_PROD confidential-ai-registry.cn-shanghai.cr.aliyuncs.com/product
+
+# 定义镜像测试信息
+t-one:
+  # 配置测试信息 workspace 和模版
+  workspace: &WORKSPACE container_ci_test
+  project: &PROJECT default_container_ci_test
+  test_suite: &TEST_SUITE image-ci-test
+  # 执行测试 case, 多个用数组表示
+  test_conf: &TEST_CONF group=app_container
+  test_case: &TEST_CASE app_container_default
+  cloud_server_tag: &CLOUD_SERVER_TAG [anolis-container-ci-x86]
+
+# 构建镜像配置
+images:
+  # 分组名称，支持自定义
+  Cryptpilot-Crypt:
+    target: release-crypt
+    build: true
+    test: true
+    region: cn-hongkong
+    platform: [linux/amd64]
+    docker_file:
+      path: Dockerfile
+      scene:
+        args: []
+        tags: [[0.5.0, latest]]
+        registry: [*ACR_PROD]
+      # 测试配置
+      test_config: [*WORKSPACE, *PROJECT, *TEST_SUITE, *TEST_CONF, *TEST_CASE, *CLOUD_SERVER_TAG[0], '']

APPLICATION/cryptpilot-crypt/version.yml

@@ -0,0 +1,13 @@
+# 版本关系依赖表，默认继承 version-base.yml 配置，可重写覆盖
+BaseDependency: ../version-base.yml
+Dependency:
+  name: cryptpilot-crypt
+  image_type: application
+  versions:
+    1.0.1:
+      # 对 AI 框架版本对 python 版本的要求
+      python_version: []
+      # gpu 对 cuda 版本的要求
+      cuda_version: []
+      # 对 baseos 的要求，*AnolisOS8.6 表示 Anolis8.6
+      baseos_version: [*Alinux3.2304]

APPLICATION/cryptpilot-fde/buildspec.yml

@@ -0,0 +1,37 @@
+name: &NAME
+version: &VERSION
+image_type: &IMAGE_TYPE
+baseos_version: &BASEOS_VERSION
+
+# 定义镜像仓库信息
+repository_info:
+  acr: &ACR_PROD confidential-ai-registry.cn-shanghai.cr.aliyuncs.com/product
+
+# 定义镜像测试信息
+t-one:
+  # 配置测试信息 workspace 和模版
+  workspace: &WORKSPACE container_ci_test
+  project: &PROJECT default_container_ci_test
+  test_suite: &TEST_SUITE image-ci-test
+  # 执行测试 case, 多个用数组表示
+  test_conf: &TEST_CONF group=app_container
+  test_case: &TEST_CASE app_container_default
+  cloud_server_tag: &CLOUD_SERVER_TAG [anolis-container-ci-x86]
+
+# 构建镜像配置
+images:
+  # 分组名称，支持自定义
+  Cryptpilot-Fde:
+    target: release-fde
+    build: true
+    test: true
+    region: cn-hongkong
+    platform: [linux/amd64]
+    docker_file:
+      path: Dockerfile
+      scene:
+        args: []
+        tags: [[0.5.0, latest]]
+        registry: [*ACR_PROD]
+      # 测试配置
+      test_config: [*WORKSPACE, *PROJECT, *TEST_SUITE, *TEST_CONF, *TEST_CASE, *CLOUD_SERVER_TAG[0], '']

APPLICATION/cryptpilot-fde/version.yml

@@ -0,0 +1,13 @@
+# 版本关系依赖表，默认继承 version-base.yml 配置，可重写覆盖
+BaseDependency: ../version-base.yml
+Dependency:
+  name: cryptpilot-fde
+  image_type: application
+  versions:
+    1.0.1:
+      # 对 AI 框架版本对 python 版本的要求
+      python_version: []
+      # gpu 对 cuda 版本的要求
+      cuda_version: []
+      # 对 baseos 的要求，*AnolisOS8.6 表示 Anolis8.6
+      baseos_version: [*Alinux3.2304]

APPLICATION/cryptpilot-verity/buildspec.yml

@@ -0,0 +1,37 @@
+name: &NAME
+version: &VERSION
+image_type: &IMAGE_TYPE
+baseos_version: &BASEOS_VERSION
+
+# 定义镜像仓库信息
+repository_info:
+  acr: &ACR_PROD confidential-ai-registry.cn-shanghai.cr.aliyuncs.com/product
+
+# 定义镜像测试信息
+t-one:
+  # 配置测试信息 workspace 和模版
+  workspace: &WORKSPACE container_ci_test
+  project: &PROJECT default_container_ci_test
+  test_suite: &TEST_SUITE image-ci-test
+  # 执行测试 case, 多个用数组表示
+  test_conf: &TEST_CONF group=app_container
+  test_case: &TEST_CASE app_container_default
+  cloud_server_tag: &CLOUD_SERVER_TAG [anolis-container-ci-x86]
+
+# 构建镜像配置
+images:
+  # 分组名称，支持自定义
+  Cryptpilot-Verity:
+    target: release-verity
+    build: true
+    test: true
+    region: cn-hongkong
+    platform: [linux/amd64]
+    docker_file:
+      path: Dockerfile
+      scene:
+        args: []
+        tags: [[0.5.0, latest]]
+        registry: [*ACR_PROD]
+      # 测试配置
+      test_config: [*WORKSPACE, *PROJECT, *TEST_SUITE, *TEST_CONF, *TEST_CASE, *CLOUD_SERVER_TAG[0], '']

APPLICATION/cryptpilot-verity/version.yml

@@ -0,0 +1,13 @@
+# 版本关系依赖表，默认继承 version-base.yml 配置，可重写覆盖
+BaseDependency: ../version-base.yml
+Dependency:
+  name: cryptpilot-verity
+  image_type: application
+  versions:
+    1.0.1:
+      # 对 AI 框架版本对 python 版本的要求
+      python_version: []
+      # gpu 对 cuda 版本的要求
+      cuda_version: []
+      # 对 baseos 的要求，*AnolisOS8.6 表示 Anolis8.6
+      baseos_version: [*Alinux3.2304]