Skip to content

Commit 30afb78

Browse files
github-actions[bot]github-actions[bot]
committed
Merge remote-tracking branch 'origin/main' into sync/upstream-2026-06-21-4
# Conflicts: # .github/workflows/build-and-push-bsky-ghcr.yaml # .github/workflows/build-and-push-pds-ghcr.yaml # packages/pds/src/mailer/templates/confirm-email.hbs # packages/pds/src/mailer/templates/delete-account.hbs # packages/pds/src/mailer/templates/plc-operation.hbs # packages/pds/src/mailer/templates/reset-password.hbs # packages/pds/src/mailer/templates/update-email.hbs
2 parents 39f5c01 + f6f923b commit 30afb78

17 files changed

Lines changed: 695 additions & 53 deletions

File tree

‎.github/workflows/build-and-push-bsky-ghcr.yaml‎

Lines changed: 126 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,166 @@
11
name: build-and-push-bsky-ghcr
22
on:
3+
workflow_dispatch:
34
push:
45
branches:
56
- main
7+
<<<<<<< HEAD
68
- msi/ts-7
9+
=======
10+
- flashes-appview
11+
>>>>>>> origin/main
712

813
env:
914
REGISTRY: ghcr.io
1015
USERNAME: ${{ github.actor }}
1116
PASSWORD: ${{ secrets.GITHUB_TOKEN }}
12-
13-
# github.repository as <account>/<repo>
1417
IMAGE_NAME: ${{ github.repository }}
1518

1619
jobs:
17-
bsky-container-ghcr:
18-
if: github.repository == 'bluesky-social/atproto'
19-
runs-on: ubuntu-22.04
20+
build-platforms:
21+
runs-on: ${{ matrix.runner }}
22+
timeout-minutes: 60
2023
permissions:
2124
contents: read
2225
packages: write
26+
attestations: write
2327
id-token: write
24-
28+
strategy:
29+
fail-fast: false
30+
matrix:
31+
include:
32+
- platform: linux/amd64
33+
runner: ubuntu-latest
34+
- platform: linux/arm64
35+
runner: ubuntu-24.04-arm
2536
steps:
2637
- name: Checkout repository
27-
uses: actions/checkout@v3
38+
uses: actions/checkout@v5
2839

2940
- name: Setup Docker buildx
30-
uses: docker/setup-buildx-action@v2
41+
uses: docker/setup-buildx-action@v3
42+
43+
- name: Sanitize platform name
44+
id: platform
45+
run: |
46+
platform=${{ matrix.platform }}
47+
echo "safe=${platform//\//-}" >> $GITHUB_OUTPUT
3148
3249
- name: Log into registry ${{ env.REGISTRY }}
33-
uses: docker/login-action@v2
50+
uses: docker/login-action@v3
3451
with:
3552
registry: ${{ env.REGISTRY }}
3653
username: ${{ env.USERNAME }}
3754
password: ${{ env.PASSWORD }}
3855

3956
- name: Extract Docker metadata
4057
id: meta
41-
uses: docker/metadata-action@v4
58+
uses: docker/metadata-action@v5
4259
with:
4360
images: |
4461
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
4562
tags: |
46-
type=sha,enable=true,priority=100,prefix=bsky:,suffix=,format=long
63+
type=sha,enable=true,priority=100,prefix=bsky-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }},suffix=,format=long
64+
type=raw,value=bsky-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }}{{date 'YYYY-MM-DDTHH-mm-ssZ'}}
65+
type=raw,value=bsky-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }}latest
4766
48-
- name: Build and push Docker image
49-
id: build-and-push
50-
uses: docker/build-push-action@v4
67+
- name: Build and push by digest
68+
id: build
69+
uses: docker/build-push-action@v6
5170
with:
5271
context: .
53-
push: ${{ github.event_name != 'pull_request' }}
72+
platforms: ${{ matrix.platform }}
5473
file: ./services/bsky/Dockerfile
55-
tags: ${{ steps.meta.outputs.tags }}
5674
labels: ${{ steps.meta.outputs.labels }}
57-
cache-from: type=gha
58-
cache-to: type=gha,mode=max
75+
cache-from: type=gha,scope=bsky-${{ steps.platform.outputs.safe }}
76+
cache-to: type=gha,mode=max,scope=bsky-${{ steps.platform.outputs.safe }}
77+
build-args: |
78+
BUILDKIT_INLINE_CACHE=1
79+
outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
80+
81+
- name: Export digest
82+
run: |
83+
mkdir -p /tmp/digests
84+
digest="${{ steps.build.outputs.digest }}"
85+
touch "/tmp/digests/${digest#sha256:}"
86+
87+
- name: Upload digest
88+
uses: actions/upload-artifact@v4
89+
with:
90+
name: digests-${{ steps.platform.outputs.safe }}
91+
path: /tmp/digests/*
92+
if-no-files-found: error
93+
retention-days: 1
94+
95+
merge-manifests:
96+
runs-on: ubuntu-latest
97+
needs: build-platforms
98+
permissions:
99+
contents: write
100+
packages: write
101+
attestations: write
102+
id-token: write
103+
steps:
104+
- name: Download digests
105+
uses: actions/download-artifact@v4
106+
with:
107+
pattern: digests-*
108+
merge-multiple: true
109+
path: /tmp/digests
110+
111+
- name: Setup Docker buildx
112+
uses: docker/setup-buildx-action@v3
113+
with:
114+
driver-opts: |
115+
network=host
116+
117+
- name: Log into registry ${{ env.REGISTRY }}
118+
uses: docker/login-action@v3
119+
with:
120+
registry: ${{ env.REGISTRY }}
121+
username: ${{ env.USERNAME }}
122+
password: ${{ env.PASSWORD }}
123+
124+
- name: Extract Docker metadata
125+
id: meta
126+
uses: docker/metadata-action@v5
127+
with:
128+
images: |
129+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
130+
tags: |
131+
type=sha,enable=true,priority=100,prefix=bsky-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }},suffix=,format=long
132+
type=raw,value=bsky-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }}{{date 'YYYY-MM-DDTHH-mm-ssZ'}}
133+
type=raw,value=bsky-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }}latest
134+
135+
- name: Create manifest list and push
136+
id: merge
137+
working-directory: /tmp/digests
138+
run: |
139+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
140+
$(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
141+
142+
- name: Inspect image and get digest
143+
id: inspect
144+
run: |
145+
digest=$(docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$(echo '${{ steps.meta.outputs.tags }}' | head -1 | cut -d':' -f2) | grep "^Digest:" | awk '{print $2}')
146+
echo "digest=$digest" >> $GITHUB_OUTPUT
147+
148+
- name: Generate artifact attestation
149+
uses: actions/attest-build-provenance@v1
150+
with:
151+
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
152+
subject-digest: ${{ steps.inspect.outputs.digest }}
153+
push-to-registry: true
154+
155+
- name: Checkout repository for tagging
156+
uses: actions/checkout@v5
157+
with:
158+
token: ${{ secrets.GITHUB_TOKEN }}
159+
160+
- name: Tag repository with datetime
161+
run: |
162+
DATETIME_TAG=$(date -u +"%Y-%m-%dT%H-%M-%SZ")
163+
git config user.name "github-actions[bot]"
164+
git config user.email "github-actions[bot]@users.noreply.github.com"
165+
git tag -a "bsky-$DATETIME_TAG" -m "Release bsky-$DATETIME_TAG"
166+
git push origin "bsky-$DATETIME_TAG"

‎.github/workflows/build-and-push-ozone-ghcr.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ env:
1515

1616
jobs:
1717
ozone-container-ghcr:
18-
if: github.repository == 'bluesky-social/atproto'
18+
# if: github.repository == 'bluesky-social/atproto'
1919
runs-on: ubuntu-22.04
2020
permissions:
2121
contents: read

‎.github/workflows/build-and-push-pds-ghcr.yaml‎

Lines changed: 125 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,165 @@
11
name: build-and-push-pds-ghcr
22
on:
3+
workflow_dispatch:
34
push:
45
branches:
56
- main
7+
<<<<<<< HEAD
68
- msi/ts-7
9+
=======
10+
>>>>>>> origin/main
711

812
env:
913
REGISTRY: ghcr.io
1014
USERNAME: ${{ github.actor }}
1115
PASSWORD: ${{ secrets.GITHUB_TOKEN }}
12-
13-
# github.repository as <account>/<repo>
1416
IMAGE_NAME: ${{ github.repository }}
1517

1618
jobs:
17-
pds-container-ghcr:
18-
if: github.repository == 'bluesky-social/atproto'
19-
runs-on: ubuntu-22.04
19+
build-platforms:
20+
runs-on: ${{ matrix.runner }}
21+
timeout-minutes: 60
2022
permissions:
2123
contents: read
2224
packages: write
25+
attestations: write
2326
id-token: write
24-
27+
strategy:
28+
fail-fast: false
29+
matrix:
30+
include:
31+
- platform: linux/amd64
32+
runner: ubuntu-latest
33+
- platform: linux/arm64
34+
runner: ubuntu-24.04-arm
2535
steps:
2636
- name: Checkout repository
27-
uses: actions/checkout@v3
37+
uses: actions/checkout@v5
2838

2939
- name: Setup Docker buildx
30-
uses: docker/setup-buildx-action@v2
40+
uses: docker/setup-buildx-action@v3
41+
42+
- name: Sanitize platform name
43+
id: platform
44+
run: |
45+
platform=${{ matrix.platform }}
46+
echo "safe=${platform//\//-}" >> $GITHUB_OUTPUT
3147
3248
- name: Log into registry ${{ env.REGISTRY }}
33-
uses: docker/login-action@v2
49+
uses: docker/login-action@v3
3450
with:
3551
registry: ${{ env.REGISTRY }}
3652
username: ${{ env.USERNAME }}
3753
password: ${{ env.PASSWORD }}
3854

3955
- name: Extract Docker metadata
4056
id: meta
41-
uses: docker/metadata-action@v4
57+
uses: docker/metadata-action@v5
4258
with:
4359
images: |
4460
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
4561
tags: |
46-
type=sha,enable=true,priority=100,prefix=pds:,suffix=,format=long
62+
type=sha,enable=true,priority=100,prefix=pds-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }},suffix=,format=long
63+
type=raw,value=pds-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }}{{date 'YYYY-MM-DDTHH-mm-ssZ'}}
64+
type=raw,value=pds-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }}latest
4765
48-
- name: Build and push Docker image
49-
id: build-and-push
50-
uses: docker/build-push-action@v4
66+
- name: Build and push by digest
67+
id: build
68+
uses: docker/build-push-action@v6
5169
with:
5270
context: .
53-
push: ${{ github.event_name != 'pull_request' }}
71+
platforms: ${{ matrix.platform }}
5472
file: ./services/pds/Dockerfile
55-
tags: ${{ steps.meta.outputs.tags }}
5673
labels: ${{ steps.meta.outputs.labels }}
57-
cache-from: type=gha
58-
cache-to: type=gha,mode=max
74+
cache-from: type=gha,scope=pds-${{ steps.platform.outputs.safe }}
75+
cache-to: type=gha,mode=max,scope=pds-${{ steps.platform.outputs.safe }}
76+
build-args: |
77+
BUILDKIT_INLINE_CACHE=1
78+
outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
79+
80+
- name: Export digest
81+
run: |
82+
mkdir -p /tmp/digests
83+
digest="${{ steps.build.outputs.digest }}"
84+
touch "/tmp/digests/${digest#sha256:}"
85+
86+
- name: Upload digest
87+
uses: actions/upload-artifact@v4
88+
with:
89+
name: digests-${{ steps.platform.outputs.safe }}
90+
path: /tmp/digests/*
91+
if-no-files-found: error
92+
retention-days: 1
93+
94+
merge-manifests:
95+
runs-on: ubuntu-latest
96+
needs: build-platforms
97+
permissions:
98+
contents: write
99+
packages: write
100+
attestations: write
101+
id-token: write
102+
steps:
103+
- name: Download digests
104+
uses: actions/download-artifact@v4
105+
with:
106+
pattern: digests-*
107+
merge-multiple: true
108+
path: /tmp/digests
109+
110+
- name: Setup Docker buildx
111+
uses: docker/setup-buildx-action@v3
112+
with:
113+
driver-opts: |
114+
network=host
115+
116+
- name: Log into registry ${{ env.REGISTRY }}
117+
uses: docker/login-action@v3
118+
with:
119+
registry: ${{ env.REGISTRY }}
120+
username: ${{ env.USERNAME }}
121+
password: ${{ env.PASSWORD }}
122+
123+
- name: Extract Docker metadata
124+
id: meta
125+
uses: docker/metadata-action@v5
126+
with:
127+
images: |
128+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
129+
tags: |
130+
type=sha,enable=true,priority=100,prefix=pds-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }},suffix=,format=long
131+
type=raw,value=pds-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }}{{date 'YYYY-MM-DDTHH-mm-ssZ'}}
132+
type=raw,value=pds-${{ github.ref_name != 'main' && format('{0}-', github.ref_name) || '' }}latest
133+
134+
- name: Create manifest list and push
135+
id: merge
136+
working-directory: /tmp/digests
137+
run: |
138+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
139+
$(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
140+
141+
- name: Inspect image and get digest
142+
id: inspect
143+
run: |
144+
digest=$(docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$(echo '${{ steps.meta.outputs.tags }}' | head -1 | cut -d':' -f2) | grep "^Digest:" | awk '{print $2}')
145+
echo "digest=$digest" >> $GITHUB_OUTPUT
146+
147+
- name: Generate artifact attestation
148+
uses: actions/attest-build-provenance@v1
149+
with:
150+
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
151+
subject-digest: ${{ steps.inspect.outputs.digest }}
152+
push-to-registry: true
153+
154+
- name: Checkout repository for tagging
155+
uses: actions/checkout@v5
156+
with:
157+
token: ${{ secrets.GITHUB_TOKEN }}
158+
159+
- name: Tag repository with datetime
160+
run: |
161+
DATETIME_TAG=$(date -u +"%Y-%m-%dT%H-%M-%SZ")
162+
git config user.name "github-actions[bot]"
163+
git config user.email "github-actions[bot]@users.noreply.github.com"
164+
git tag -a "pds-$DATETIME_TAG" -m "Release pds-$DATETIME_TAG"
165+
git push origin "pds-$DATETIME_TAG"

0 commit comments

Comments
 (0)