Skip to content

Commit a609dac

Browse files
NeunerleiNeunerlei
committed
Merge branch 'development' into release/2.5.1
2 parents ba4b5e5 + ed07365 commit a609dac

7 files changed

Lines changed: 88 additions & 36 deletions

‎.github/workflows/create-release-branch.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
name: Create release/v${{ inputs.version }}
1717
runs-on: ubuntu-latest
1818
steps:
19-
- uses: actions/checkout@v6
19+
- uses: actions/checkout@v7
2020
with:
2121
fetch-depth: 0
2222
token: ${{ secrets.WORKFLOW_TOKEN }}

‎.github/workflows/deploy-hawk-prod.yml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616

1717
steps:
1818
- name: Check out the repo
19-
uses: actions/checkout@v6
19+
uses: actions/checkout@v7
2020

2121
- name: Log in to the Container registry
2222
uses: docker/login-action@v4
@@ -59,15 +59,14 @@ jobs:
5959

6060
remove-old-images:
6161
permissions:
62-
contents: write
6362
packages: write
6463
runs-on: ubuntu-latest
6564
steps:
66-
- uses: snok/container-retention-policy@v3.0.0
65+
- uses: snok/container-retention-policy@v3.1.0
6766
with:
68-
account: user
67+
account: ${{github.repository_owner}}
6968
token: ${{secrets.GITHUB_TOKEN}}
70-
image-names: "${{github.event.repository.name}}"
69+
image-names: "hawki"
7170
image-tags: "prod-* !prod-latest"
7271
keep-n-most-recent: 5
7372
cut-off: 1h

‎.github/workflows/deploy-hawk-testing.yml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616

1717
steps:
1818
- name: Check out the repo
19-
uses: actions/checkout@v6
19+
uses: actions/checkout@v7
2020

2121
- name: Log in to the Container registry
2222
uses: docker/login-action@v4
@@ -59,15 +59,14 @@ jobs:
5959

6060
remove-old-images:
6161
permissions:
62-
contents: write
6362
packages: write
6463
runs-on: ubuntu-latest
6564
steps:
66-
- uses: snok/container-retention-policy@v3.0.0
65+
- uses: snok/container-retention-policy@v3.1.0
6766
with:
68-
account: user
67+
account: ${{github.repository_owner}}
6968
token: ${{secrets.GITHUB_TOKEN}}
70-
image-names: "${{github.event.repository.name}}"
69+
image-names: "hawki"
7170
image-tags: "testing-* !testing-latest"
7271
keep-n-most-recent: 5
7372
cut-off: 1h

‎.github/workflows/publish-documentation.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@ jobs:
2626
run:
2727
working-directory: ./_documentation.build
2828
steps:
29-
- uses: actions/checkout@v6
29+
- uses: actions/checkout@v7
3030
with:
3131
fetch-depth: 0
32-
- uses: actions/setup-node@v6
32+
- uses: actions/setup-node@v7
3333
with:
3434
node-version: 24
3535
cache: npm

‎.github/workflows/publish-version.yml‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
version: ${{ steps.version.outputs.version }}
2222
steps:
2323
- name: Checkout repository at release tag
24-
uses: actions/checkout@v6
24+
uses: actions/checkout@v7
2525

2626
- name: Read version from config
2727
id: version
@@ -42,6 +42,14 @@ jobs:
4242
username: ${{ secrets.DOCKER_USERNAME }}
4343
password: ${{ secrets.DOCKER_PASSWORD }}
4444

45+
# Required for the registry-backed build cache below
46+
- name: Log in to the GitHub Container registry
47+
uses: docker/login-action@v4
48+
with:
49+
registry: ghcr.io
50+
username: ${{ github.actor }}
51+
password: ${{ secrets.GITHUB_TOKEN }}
52+
4553
- name: Build and push Docker image
4654
id: push
4755
uses: docker/build-push-action@v7
@@ -54,11 +62,15 @@ jobs:
5462
tags: |
5563
digitalenvironments/hawki:latest
5664
digitalenvironments/hawki:${{ steps.version.outputs.version }}
57-
cache-from: type=gha,scope=${{ steps.version.outputs.version }}
58-
cache-to: type=gha,mode=max,scope=${{ steps.version.outputs.version }}
65+
cache-from: |
66+
type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-amd64
67+
type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-arm64
68+
# No cache-to on purpose: exporting a combined multi-arch cache here
69+
# is what triggered the 504s, and nothing reads such a ref anyway -
70+
# the test matrix keeps both per-arch refs up to date.
5971

6072
- name: Generate artifact attestation
61-
uses: actions/attest-build-provenance@v4
73+
uses: actions/attest@v4
6274
with:
6375
subject-name: index.docker.io/digitalenvironments/hawki
6476
subject-digest: ${{ steps.push.outputs.digest }}
@@ -75,7 +87,7 @@ jobs:
7587
release-body: ${{ steps.release.outputs.release-body }}
7688
release-url: ${{ steps.release.outputs.release-url }}
7789
steps:
78-
- uses: actions/checkout@v6
90+
- uses: actions/checkout@v7
7991

8092
- id: release
8193
uses: hawk-digital-environments/hawk-pipeline-actions/create-github-release@v1
@@ -90,7 +102,7 @@ jobs:
90102
needs: [ build-and-publish, github-release ]
91103
if: success()
92104
steps:
93-
- uses: actions/checkout@v6
105+
- uses: actions/checkout@v7
94106

95107
- uses: hawk-digital-environments/hawk-pipeline-actions/send-discord-notification@v1
96108
with:

‎.github/workflows/rebuild-latest-image.yml‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
runs-on: ubuntu-latest
2121
steps:
2222
- name: Checkout repository
23-
uses: actions/checkout@v6
23+
uses: actions/checkout@v7
2424
with:
2525
ref: main
2626

@@ -49,9 +49,17 @@ jobs:
4949
username: ${{ secrets.DOCKER_USERNAME }}
5050
password: ${{ secrets.DOCKER_PASSWORD }}
5151

52+
# Required to read the registry-backed build cache below
53+
- name: Log in to the GitHub Container registry
54+
uses: docker/login-action@v4
55+
with:
56+
registry: ghcr.io
57+
username: ${{ github.actor }}
58+
password: ${{ secrets.GITHUB_TOKEN }}
59+
5260
- name: Build and push Docker image
5361
id: push
54-
uses: docker/build-push-action@v5
62+
uses: docker/build-push-action@v7
5563
with:
5664
context: .
5765
file: ./Dockerfile
@@ -61,11 +69,17 @@ jobs:
6169
tags: |
6270
digitalenvironments/hawki:latest
6371
digitalenvironments/hawki:${{ steps.get_version.outputs.version }}
64-
cache-from: type=gha,scope=${{ steps.get_version.outputs.version }}
65-
cache-to: type=gha,mode=max,scope=${{ steps.get_version.outputs.version }}
72+
# Imports the per-arch caches written by the release gate in
73+
# trigger-release.yml. A hotfix rebuild of main may only hit these
74+
# partially, which just means a slower build - never a failure.
75+
cache-from: |
76+
type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-amd64
77+
type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-arm64
78+
# No cache-to on purpose: exporting a combined multi-arch cache is
79+
# what triggered the 504s, and nothing reads such a ref anyway.
6680

6781
- name: Generate artifact attestation
68-
uses: actions/attest-build-provenance@v1
82+
uses: actions/attest@v4
6983
with:
7084
subject-name: index.docker.io/digitalenvironments/hawki
7185
subject-digest: ${{ steps.push.outputs.digest }}

‎.github/workflows/trigger-release.yml‎

Lines changed: 40 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
outputs:
1414
version: ${{ steps.validate.outputs.version }}
1515
steps:
16-
- uses: actions/checkout@v5
16+
- uses: actions/checkout@v7
1717
with:
1818
fetch-depth: 0
1919
token: ${{ secrets.WORKFLOW_TOKEN }}
@@ -22,37 +22,65 @@ jobs:
2222
uses: hawk-digital-environments/hawk-pipeline-actions/validate-release-branch@v1
2323

2424
test-docker-build:
25-
name: Test Docker Build
26-
runs-on: ubuntu-latest
25+
name: Test Docker Build (${{ matrix.arch }})
26+
runs-on: ${{ matrix.runner }}
2727
needs: validate
28+
permissions:
29+
contents: read
30+
packages: write
31+
strategy:
32+
# Always test both architectures, so an arch-specific breakage is
33+
# visible instead of being masked by the other job failing first.
34+
fail-fast: false
35+
matrix:
36+
include:
37+
- platform: linux/amd64
38+
arch: amd64
39+
runner: ubuntu-latest
40+
- platform: linux/arm64
41+
arch: arm64
42+
runner: ubuntu-latest
2843
steps:
2944
- name: Checkout release branch
30-
uses: actions/checkout@v5
45+
uses: actions/checkout@v7
3146

3247
- name: Set up QEMU
33-
uses: docker/setup-qemu-action@v3
48+
uses: docker/setup-qemu-action@v4
3449

3550
- name: Set up Docker Buildx
36-
uses: docker/setup-buildx-action@v3
51+
uses: docker/setup-buildx-action@v4
52+
53+
# Required for the registry-backed build cache below
54+
- name: Log in to the GitHub Container registry
55+
uses: docker/login-action@v4
56+
with:
57+
registry: ghcr.io
58+
username: ${{ github.actor }}
59+
password: ${{ secrets.GITHUB_TOKEN }}
3760

3861
- name: Test Docker build
39-
uses: docker/build-push-action@v5
62+
uses: docker/build-push-action@v7
4063
with:
4164
context: .
4265
file: ./Dockerfile
4366
push: false
67+
# Runs the full build, then discards the image. Keeps this a real
68+
# build test while populating the cache for the publish pipeline.
69+
outputs: type=cacheonly
4470
target: app_prod
45-
platforms: linux/amd64,linux/arm64
46-
tags: digitalenvironments/hawki:release-test
47-
cache-from: type=gha,scope=${{ needs.validate.outputs.version }}
48-
cache-to: type=gha,mode=max,scope=${{ needs.validate.outputs.version }}
71+
platforms: ${{ matrix.platform }}
72+
# One cache ref per architecture: keeps each export small enough to
73+
# avoid the 504s seen when exporting one combined multi-arch cache.
74+
cache-from: type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-${{ matrix.arch }}
75+
# ignore-error: a flaky cache export must not fail the release gate
76+
cache-to: type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-${{ matrix.arch }},mode=max,ignore-error=true
4977

5078
release:
5179
name: Merge and Tag Release
5280
runs-on: ubuntu-latest
5381
needs: [ validate, test-docker-build ]
5482
steps:
55-
- uses: actions/checkout@v5
83+
- uses: actions/checkout@v7
5684
with:
5785
fetch-depth: 0
5886
token: ${{ secrets.WORKFLOW_TOKEN }}

0 commit comments

Comments
 (0)