Skip to content

Commit b4d639d

Browse files
neilimeneilime
committed
fix(docker/build-image): prevent random failure on post action because of buildx and cache
Signed-off-by: Emilien Escalle <emilien.escalle@escemi.com>
1 parent 96a88c0 commit b4d639d

File tree

21 files changed

+242
-59
lines changed

21 files changed

+242
-59
lines changed

‎.github/workflows/__greetings.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ permissions: {}
1010

1111
jobs:
1212
greetings:
13-
uses: hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml@4b53189212d5810f710bed89711002626977215b # 0.33.0
13+
uses: hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
1414
permissions:
1515
contents: read
1616
issues: write

‎.github/workflows/__need-fix-to-issue.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ permissions: {}
2121

2222
jobs:
2323
main:
24-
uses: hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml@4b53189212d5810f710bed89711002626977215b # 0.33.0
24+
uses: hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
2525
permissions:
2626
contents: read
2727
issues: write

‎.github/workflows/__semantic-pull-request.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ permissions: {}
1212

1313
jobs:
1414
main:
15-
uses: hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml@4b53189212d5810f710bed89711002626977215b # 0.33.0
15+
uses: hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
1616
permissions:
1717
contents: write
1818
pull-requests: write

‎.github/workflows/__shared-ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ permissions:
1616

1717
jobs:
1818
linter:
19-
uses: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml@4b53189212d5810f710bed89711002626977215b # 0.33.0
19+
uses: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
2020

2121
test-action-docker-build-image:
2222
needs: linter

‎.github/workflows/__stale.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ permissions: {}
99

1010
jobs:
1111
main:
12-
uses: hoverkraft-tech/ci-github-common/.github/workflows/stale.yml@4b53189212d5810f710bed89711002626977215b # 0.33.0
12+
uses: hoverkraft-tech/ci-github-common/.github/workflows/stale.yml@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
1313
permissions:
1414
issues: write
1515
pull-requests: write

‎.github/workflows/docker-build-images.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -372,7 +372,7 @@ jobs:
372372
packages: write
373373
id-token: write # Needed for getting local workflow actions
374374
steps:
375-
- uses: hoverkraft-tech/ci-github-common/actions/checkout@4b53189212d5810f710bed89711002626977215b # 0.33.0
375+
- uses: hoverkraft-tech/ci-github-common/actions/checkout@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
376376
with:
377377
lfs: ${{ inputs.lfs }}
378378

@@ -381,7 +381,7 @@ jobs:
381381
run: git lfs pull
382382

383383
- id: local-workflow-actions
384-
uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
384+
uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
385385
with:
386386
actions-path: actions
387387

@@ -452,12 +452,12 @@ jobs:
452452

453453
# FIXME: Set built images infos in file to be uploaded as artifacts, because github action does not handle job outputs for matrix
454454
# https://github.com/orgs/community/discussions/26639
455-
- uses: hoverkraft-tech/ci-github-common/actions/set-matrix-output@4b53189212d5810f710bed89711002626977215b # 0.33.0
455+
- uses: hoverkraft-tech/ci-github-common/actions/set-matrix-output@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
456456
with:
457457
artifact-name: ${{ needs.prepare-variables.outputs.artifact-name }}
458458
value: ${{ steps.build.outputs.built-image }}
459459

460-
- uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
460+
- uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
461461
if: always() && steps.local-workflow-actions.outputs.repository
462462
with:
463463
actions-path: actions
@@ -476,7 +476,7 @@ jobs:
476476
built-images: ${{ steps.create-images-manifests.outputs.built-images }}
477477
steps:
478478
- id: get-matrix-outputs
479-
uses: hoverkraft-tech/ci-github-common/actions/get-matrix-outputs@4b53189212d5810f710bed89711002626977215b # 0.33.0
479+
uses: hoverkraft-tech/ci-github-common/actions/get-matrix-outputs@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
480480
with:
481481
artifact-name: ${{ needs.prepare-variables.outputs.artifact-name }}
482482

@@ -514,7 +514,7 @@ jobs:
514514
core.setOutput('built-images', JSON.stringify(images));
515515
516516
- id: local-workflow-actions
517-
uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
517+
uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
518518
with:
519519
actions-path: actions
520520

@@ -551,7 +551,7 @@ jobs:
551551
images: ${{ steps.get-images-to-sign.outputs.images-to-sign }}
552552
github-token: ${{ secrets.GITHUB_TOKEN }}
553553

554-
- uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
554+
- uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
555555
if: always() && steps.local-workflow-actions.outputs.repository
556556
with:
557557
actions-path: actions

‎.github/workflows/prune-pull-requests-images-tags.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ jobs:
107107
id-token: write # Needed for getting local workflow actions
108108
steps:
109109
- id: local-workflow-actions
110-
uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
110+
uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
111111
with:
112112
actions-path: actions
113113

@@ -118,7 +118,7 @@ jobs:
118118
pull-request-tag-filter: ${{ inputs.pull-request-tag-filter }}
119119
preserve-tags-filter: ${{ inputs.preserve-tags-filter }}
120120

121-
- uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
121+
- uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
122122
if: always() && steps.local-workflow-actions.outputs.repository
123123
with:
124124
actions-path: actions

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ _Actions that operate on OCI images across their build, metadata, and lifecycle
2424

2525
#### - [Build image](actions/docker/build-image/README.md)
2626

27+
#### - [Cleanup builder](actions/docker/cleanup-builder/README.md)
28+
2729
#### - [Clean images](actions/docker/clean-images/README.md)
2830

2931
#### - [Create images manifests](actions/docker/create-images-manifests/README.md)

‎actions/docker/build-image/action.yml‎

Lines changed: 30 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -149,36 +149,40 @@ outputs:
149149
runs:
150150
using: "composite"
151151
steps:
152-
- shell: bash
153-
# FIXME: workaround until will be merged: https://github.com/actions/runner/pull/1684
154-
run: mkdir -p ./self-actions/ && cp -r $GITHUB_ACTION_PATH/../../* ./self-actions/
152+
- uses: hoverkraft-tech/ci-github-common/actions/local-actions@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
153+
with:
154+
source-path: ${{ github.action_path }}/../..
155155

156156
- id: slugify-platform
157-
uses: hoverkraft-tech/ci-github-common/actions/slugify@4b53189212d5810f710bed89711002626977215b # 0.33.0
157+
uses: hoverkraft-tech/ci-github-common/actions/slugify@a236f015b7dda4712d2ba4d327b8bf27be4c3d3a # 0.34.0
158158
with:
159159
value: ${{ inputs.platform }}
160160

161161
- id: docker-setup
162-
uses: ./self-actions/docker/setup
162+
uses: ./../self-actions/docker/setup
163163
with:
164164
oci-registry: ${{ inputs.oci-registry }}
165165
oci-registry-username: ${{ inputs.oci-registry-username }}
166166
oci-registry-password: ${{ inputs.oci-registry-password }}
167167
buildkitd-config-inline: ${{ inputs.buildkitd-config-inline }}
168+
buildx-cleanup: false
169+
170+
- name: Register Buildx cleanup
171+
# FIXME: Workaround for GitHub Actions post-step ordering behavior with composite actions.
172+
# The built-in Buildx cleanup can run before later post steps that still need the builder.
173+
# See: https://github.com/actions/runner/issues/1657
174+
uses: ./../self-actions/docker/cleanup-builder
175+
with:
176+
builder: ${{ steps.docker-setup.outputs.buildx-name }}
168177

169178
- id: metadata
170-
uses: ./self-actions/docker/get-image-metadata
179+
uses: ./../self-actions/docker/get-image-metadata
171180
with:
172181
oci-registry: ${{ steps.docker-setup.outputs.push-registry }}
173182
repository: ${{ inputs.repository }}
174183
image: ${{ inputs.image }}
175184
tag: ${{ inputs.tag }}
176185

177-
- shell: bash
178-
# FIXME: workaround until will be merged: https://github.com/actions/runner/pull/1684
179-
run: |
180-
rm -fr ./self-actions
181-
182186
- id: get-docker-config
183187
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
184188
env:
@@ -190,8 +194,10 @@ runs:
190194
MULTI_PLATFORM_INPUT: ${{ inputs.multi-platform }}
191195
PLATFORM_INPUT: ${{ inputs.platform }}
192196
SLUGIFIED_PLATFORM: ${{ steps.slugify-platform.outputs.result }}
197+
TARGET_INPUT: ${{ inputs.target }}
193198
with:
194199
script: |
200+
const { createHash } = require('crypto');
195201
const fs = require('fs');
196202
const path = require('path');
197203
@@ -210,6 +216,16 @@ runs:
210216
const resolvedDockerfilePath = fs.realpathSync(dockerfilePath);
211217
core.setOutput('dockerfile-path', resolvedDockerfilePath);
212218
219+
const cacheMountScope = JSON.stringify({
220+
image: process.env.METADATA_IMAGE || '',
221+
platform: process.env.PLATFORM_INPUT || '',
222+
target: process.env.TARGET_INPUT || '',
223+
});
224+
const cacheMountScopeHash = createHash('sha256')
225+
.update(cacheMountScope)
226+
.digest('hex');
227+
core.setOutput('cache-mount-scope', cacheMountScopeHash);
228+
213229
const slugifiedPlatform = process.env.SLUGIFIED_PLATFORM || '';
214230
const tagSuffix = `-${slugifiedPlatform}`;
215231
core.setOutput('cache-flavor', `suffix=${tagSuffix}`);
@@ -299,7 +315,9 @@ runs:
299315
id: cache
300316
with:
301317
path: cache-mount
302-
key: cache-mount-${{ hashFiles(steps.get-docker-config.outputs.dockerfile-path) }}
318+
key: cache-mount-${{ hashFiles(steps.get-docker-config.outputs.dockerfile-path) }}-${{ steps.get-docker-config.outputs.cache-mount-scope }}
319+
restore-keys: |
320+
cache-mount-${{ hashFiles(steps.get-docker-config.outputs.dockerfile-path) }}-
303321
304322
- name: Restore Docker cache mounts
305323
uses: reproducible-containers/buildkit-cache-dance@1b8ab18fbda5ad3646e3fcc9ed9dd41ce2f297b4 # v3.3.2

‎actions/docker/cleanup-builder/README.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
<!-- header:start -->
2+
3+
# ![Icon](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9ImN1cnJlbnRDb2xvciIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIGNsYXNzPSJmZWF0aGVyIGZlYXRoZXItdHJhc2gtMiIgY29sb3I9ImJsdWUiPjxwb2x5bGluZSBwb2ludHM9IjMgNiA1IDIwIDIxIDIwIDIxIDYiPjwvcG9seWxpbmU+PHBhdGggZD0iTTE5IDZWNGExIDEgMCAwIDAtMS0xaC00YTEgMSAwIDAgMC0xIDF2Mk01IDZoMTQiPjwvcGF0aD48cGF0aCBkPSJNMTAgMTF2NiI+PC9wYXRoPjxwYXRoIGQ9Ik0xNCAxMXY2Ij48L3BhdGg+PC9zdmc+) GitHub Action: Docker - Cleanup builder
4+
5+
<div align="center">
6+
<img src="../../../.github/logo.svg" width="60px" align="center" alt="Docker - Cleanup builder" />
7+
</div>
8+
9+
---
10+
11+
<!-- header:end -->
12+
<!-- overview:start -->
13+
14+
## Overview
15+
16+
Registers a post-job step that removes a Docker Buildx builder after later post-job hooks have finished.
17+
This action exists as a workaround for GitHub Actions post-step ordering behavior with composite actions, where the effective cleanup order may not match the visible reverse order of YAML steps.
18+
19+
<!-- overview:end -->
20+
<!-- usage:start -->
21+
22+
## Usage
23+
24+
```yaml
25+
- uses: hoverkraft-tech/ci-github-container/actions/docker/cleanup-builder@main
26+
with:
27+
builder: ${{ steps.docker-setup.outputs.buildx-name }}
28+
enabled: true
29+
```
30+
31+
<!-- usage:end -->
32+
<!-- inputs:start -->
33+
34+
## Inputs
35+
36+
| **Input** | **Description** | **Required** | **Default** |
37+
| ------------- | ------------------------------------------------------------- | ------------ | ----------- |
38+
| **`builder`** | Docker Buildx builder name to remove during post-job cleanup. | **false** | - |
39+
| **`enabled`** | Whether cleanup should run during the post-job phase. | **false** | `true` |
40+
41+
<!-- inputs:end -->
42+
43+
## Notes
44+
45+
Use this action before other actions whose post-job hooks still need the builder. It is intended as a workaround for GitHub Actions runner behavior around post-step ordering in composite actions. See [actions/runner#1657](https://github.com/actions/runner/issues/1657).
46+
47+
In practice, this means the built-in `docker/setup-buildx-action` cleanup can run too early for actions such as `docker/build-push-action` or `reproducible-containers/buildkit-cache-dance` that still access the builder during their own post-job hooks.
48+
49+
This action works by registering its cleanup post hook earlier, so the runner executes it later than the post hooks that still need the builder.
50+
51+
<!-- contributing:start -->
52+
53+
## Contributing
54+
55+
Contributions are welcome! Please see the [contributing guidelines](https://github.com/hoverkraft-tech/ci-github-container/blob/main/CONTRIBUTING.md) for more details.
56+
57+
<!-- contributing:end -->
58+
<!-- license:start -->
59+
60+
## License
61+
62+
This project is licensed under the MIT License.
63+
64+
SPDX-License-Identifier: MIT
65+
66+
Copyright © 2026 hoverkraft
67+
68+
For more details, see the [license](http://choosealicense.com/licenses/mit/).
69+
70+
<!-- license:end -->

0 commit comments

Comments
 (0)