Skip to content

Commit 42674da

Browse files
asgrimasgrim
committed
De-duplicate docker image build for nightly and release tags
1 parent 4b20e77 commit 42674da

3 files changed

Lines changed: 139 additions & 69 deletions

File tree

‎.github/workflows/build-and-push-docker-image.yml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Invoking this pipeline requires additional permissions, so must be invoked
2+
# in a way to pass those permissions on, e.g.:
3+
#
4+
# build-phar:
5+
# permissions:
6+
# contents: read
7+
# id-token: write
8+
# attestations: write
9+
# packages: write
10+
# uses: ./.github/workflows/build-and-push-docker-image.yml
11+
12+
name: "Build and push the PIE Docker Image"
13+
14+
on:
15+
workflow_call:
16+
inputs:
17+
tags:
18+
description: Tag definition - see docker/metadata-action
19+
type: string
20+
required: true
21+
22+
permissions:
23+
contents: read
24+
25+
jobs:
26+
docker-binary-only-image:
27+
name: Docker binary-only image
28+
runs-on: ubuntu-latest
29+
30+
permissions:
31+
# attestations:write is required for build provenance attestation.
32+
attestations: write
33+
# id-token:write is required for build provenance attestation.
34+
id-token: write
35+
# packages:write is required to publish Docker images to GitHub's registry.
36+
packages: write
37+
38+
steps:
39+
- name: Checkout repository
40+
uses: actions/checkout@v5
41+
42+
- name: Fetch built PHAR from artifacts
43+
uses: actions/download-artifact@v5
44+
with:
45+
name: pie-${{ github.sha }}.phar
46+
47+
- name: Verify the PHAR
48+
env:
49+
GH_TOKEN: ${{ github.token }}
50+
run: gh attestation verify pie.phar --repo ${{ github.repository }}
51+
52+
- name: Set up QEMU
53+
uses: docker/setup-qemu-action@v3
54+
55+
- name: Set up Docker Buildx
56+
uses: docker/setup-buildx-action@v3
57+
58+
- name: Log in to the Container registry
59+
uses: docker/login-action@v3
60+
with:
61+
registry: ghcr.io
62+
username: ${{ github.actor }}
63+
password: ${{ secrets.GITHUB_TOKEN }}
64+
65+
- name: Extract metadata (tags, labels) for Docker
66+
id: meta
67+
uses: docker/metadata-action@v5
68+
with:
69+
flavor: |
70+
latest=false
71+
images: ghcr.io/${{ github.repository }}
72+
tags: |
73+
${{ inputs.tags }}
74+
75+
- name: Build and push Docker image
76+
id: build-and-push
77+
uses: docker/build-push-action@v6
78+
with:
79+
context: .
80+
platforms: linux/amd64,linux/arm64
81+
file: Dockerfile
82+
target: standalone-binary
83+
push: true
84+
tags: ${{ steps.meta.outputs.tags }}
85+
labels: ${{ steps.meta.outputs.labels }}
86+
87+
- name: Generate artifact attestation
88+
uses: actions/attest-build-provenance@v3
89+
with:
90+
subject-name: ghcr.io/${{ github.repository }}
91+
subject-digest: ${{ steps.build-and-push.outputs.digest }}
92+
push-to-registry: true

‎.github/workflows/docker-nightly-image-push.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: "Nightly Docker Image Build"
2+
3+
on:
4+
# Runs on pushes targeting the default branch
5+
push:
6+
branches: ["docker-main-branch-image"]
7+
8+
# Allows you to run this workflow manually from the Actions tab
9+
workflow_dispatch:
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
build-phar:
16+
# See build-phar.yml for a list of the permissions and why they are needed
17+
permissions:
18+
contents: read
19+
id-token: write
20+
attestations: write
21+
uses: ./.github/workflows/build-phar.yml
22+
23+
build-and-push-docker-image:
24+
needs: build-phar
25+
# See build-and-push-docker-image.yml for a list of the permissions and why they are needed
26+
permissions:
27+
contents: read
28+
id-token: write
29+
attestations: write
30+
packages: write
31+
uses: ./.github/workflows/build-and-push-docker-image.yml
32+
with:
33+
tags: |
34+
type=raw,value=nightly-bin

‎.github/workflows/release.yml‎

Lines changed: 13 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -39,76 +39,20 @@ jobs:
3939
with:
4040
files: pie.phar
4141

42-
docker-binary-only-image:
43-
needs: build-phar
44-
name: Docker binary-only image
45-
runs-on: ubuntu-latest
42+
build-and-push-docker-image:
4643
if: ${{ startsWith(github.ref, 'refs/tags/') }}
47-
44+
needs: build-phar
45+
# See build-and-push-docker-image.yml for a list of the permissions and why they are needed
4846
permissions:
49-
# attestations:write is required for build provenance attestation.
50-
attestations: write
51-
# id-token:write is required for build provenance attestation.
47+
contents: read
5248
id-token: write
53-
# packages:write is required to publish Docker images to GitHub's registry.
49+
attestations: write
5450
packages: write
55-
56-
steps:
57-
- name: Checkout repository
58-
uses: actions/checkout@v5
59-
60-
- name: Fetch built PHAR from artifacts
61-
uses: actions/download-artifact@v5
62-
with:
63-
name: pie-${{ github.sha }}.phar
64-
65-
- name: Verify the PHAR
66-
env:
67-
GH_TOKEN: ${{ github.token }}
68-
run: gh attestation verify pie.phar --repo ${{ github.repository }}
69-
70-
- name: Set up QEMU
71-
uses: docker/setup-qemu-action@v3
72-
73-
- name: Set up Docker Buildx
74-
uses: docker/setup-buildx-action@v3
75-
76-
- name: Log in to the Container registry
77-
uses: docker/login-action@v3
78-
with:
79-
registry: ghcr.io
80-
username: ${{ github.actor }}
81-
password: ${{ secrets.GITHUB_TOKEN }}
82-
83-
- name: Extract metadata (tags, labels) for Docker
84-
id: meta
85-
uses: docker/metadata-action@v5
86-
with:
87-
flavor: |
88-
latest=false
89-
images: ghcr.io/${{ github.repository }}
90-
# @TODO v1.0 Consider introducing more granular tags (major and major.minor)
91-
# @see https://github.com/php/pie/pull/122#pullrequestreview-2477496308
92-
# @see https://github.com/php/pie/pull/122#discussion_r1867331273
93-
tags: |
94-
type=raw,value=bin
95-
type=semver,pattern={{version}}-bin
96-
97-
- name: Build and push Docker image
98-
id: build-and-push
99-
uses: docker/build-push-action@v6
100-
with:
101-
context: .
102-
platforms: linux/amd64,linux/arm64
103-
file: Dockerfile
104-
target: standalone-binary
105-
push: true
106-
tags: ${{ steps.meta.outputs.tags }}
107-
labels: ${{ steps.meta.outputs.labels }}
108-
109-
- name: Generate artifact attestation
110-
uses: actions/attest-build-provenance@v3
111-
with:
112-
subject-name: ghcr.io/${{ github.repository }}
113-
subject-digest: ${{ steps.build-and-push.outputs.digest }}
114-
push-to-registry: true
51+
uses: ./.github/workflows/build-and-push-docker-image.yml
52+
with:
53+
# @TODO v1.0 Consider introducing more granular tags (major and major.minor)
54+
# @see https://github.com/php/pie/pull/122#pullrequestreview-2477496308
55+
# @see https://github.com/php/pie/pull/122#discussion_r1867331273
56+
tags: |
57+
type=raw,value=bin
58+
type=semver,pattern={{version}}-bin

0 commit comments

Comments
 (0)