Skip to content

Commit 7e856d0

Browse files
hydazzhydazz
authored
Merge pull request #694 from hydazz/main
chore: remove jenkins
2 parents eee4e96 + 521c9e0 commit 7e856d0

46 files changed

Lines changed: 1691 additions & 3345 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/actions/bake-vars/action.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/github-action.json
3+
name: Bake Vars
4+
description: Reads platforms and version for a given variant from docker-bake.hcl
5+
6+
inputs:
7+
variant:
8+
description: Variant name (main, noml, cuda, openvino)
9+
required: true
10+
11+
outputs:
12+
platforms:
13+
description: Platforms array as JSON string
14+
value: ${{ steps.opts.outputs.platforms }}
15+
version:
16+
description: Upstream immich version (v-stripped)
17+
value: ${{ steps.opts.outputs.version }}
18+
19+
runs:
20+
using: composite
21+
steps:
22+
- id: opts
23+
shell: bash
24+
env:
25+
VARIANT: ${{ inputs.variant }}
26+
run: |-
27+
BAKE=$(docker buildx bake "image-${VARIANT}" --print --progress=quiet)
28+
PLATFORMS=$(jq --raw-output --compact-output ".target.\"image-${VARIANT}\".platforms" <<<"$BAKE")
29+
VERSION=$(jq --raw-output ".target.\"image-${VARIANT}\".args.IMMICH_VERSION" <<<"$BAKE" | sed 's/^v//')
30+
{
31+
echo "platforms=${PLATFORMS}"
32+
echo "version=${VERSION}"
33+
} >>"$GITHUB_OUTPUT"

‎.github/labeler.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
area/image:
3+
- changed-files:
4+
- any-glob-to-any-file:
5+
- Dockerfile
6+
- docker-bake.hcl
7+
- root/**/*
8+
area/github:
9+
- changed-files:
10+
- any-glob-to-any-file:
11+
- .github/**/*
12+
area/mise:
13+
- changed-files:
14+
- any-glob-to-any-file:
15+
- .mise.toml
16+
area/renovate:
17+
- changed-files:
18+
- any-glob-to-any-file:
19+
- .renovate/**/*
20+
- .renovaterc.json5
21+
area/tests:
22+
- changed-files:
23+
- any-glob-to-any-file:
24+
- go.mod
25+
- go.sum
26+
- tests/**/*

‎.github/labels.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
# Areas
3+
- name: area/image
4+
color: 0e8a16
5+
- name: area/github
6+
color: 0e8a16
7+
- name: area/mise
8+
color: 0e8a16
9+
- name: area/renovate
10+
color: 0e8a16
11+
- name: area/tests
12+
color: 0e8a16
13+
# Semantic Types
14+
- name: type/digest
15+
color: ffeC19
16+
- name: type/patch
17+
color: ffeC19
18+
- name: type/minor
19+
color: ff9800
20+
- name: type/major
21+
color: f6412d
22+
# Uncategorized
23+
- name: stale
24+
color: c5def5

‎.github/workflows/build.yaml‎

Lines changed: 256 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,256 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
3+
name: Build
4+
5+
on:
6+
workflow_call:
7+
inputs:
8+
variant:
9+
type: string
10+
description: Variant name (main, noml, cuda, openvino)
11+
required: true
12+
release:
13+
type: boolean
14+
description: Release
15+
required: true
16+
17+
jobs:
18+
plan:
19+
name: Plan
20+
runs-on: ubuntu-latest
21+
outputs:
22+
platforms: ${{ steps.opts.outputs.platforms }}
23+
version: ${{ steps.opts.outputs.version }}
24+
steps:
25+
- name: Checkout
26+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
with:
28+
persist-credentials: false
29+
30+
- name: Get Bake Vars
31+
uses: ./.github/actions/bake-vars
32+
id: opts
33+
with:
34+
variant: ${{ inputs.variant }}
35+
36+
- name: Build Variant Metadata
37+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
38+
id: meta
39+
env:
40+
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
41+
with:
42+
images: ghcr.io/${{ github.repository_owner }}/immich
43+
flavor: latest=false
44+
tags: |
45+
${{ inputs.variant == 'main' && format(
46+
'type=raw,value=latest,enable={0}
47+
type=semver,pattern={{{{version}}}},value={1},enable={0}
48+
type=semver,pattern={{{{major}}}}.{{{{minor}}}},value={1},enable={0}
49+
type=semver,pattern={{{{major}}}},value={1},enable={0}',
50+
inputs.release, steps.opts.outputs.version
51+
) || format(
52+
'type=raw,value={0},enable={1}
53+
type=semver,pattern={{{{version}}}}-{0},value={2},enable={1}
54+
type=semver,pattern={{{{major}}}}.{{{{minor}}}}-{0},value={2},enable={1}
55+
type=semver,pattern={{{{major}}}}-{0},value={2},enable={1}',
56+
inputs.variant, inputs.release, steps.opts.outputs.version
57+
) }}
58+
type=raw,value=sandbox-${{ inputs.variant }},enable=${{ ! inputs.release }}
59+
60+
- name: Upload Bake Metadata
61+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
62+
with:
63+
name: ${{ inputs.variant }}-bake-metadata
64+
path: ${{ steps.meta.outputs.bake-file }}
65+
if-no-files-found: error
66+
retention-days: 1
67+
68+
build:
69+
name: Build (${{ matrix.platform }})
70+
needs:
71+
- plan
72+
strategy:
73+
fail-fast: false
74+
matrix:
75+
platform: ${{ fromJson(needs.plan.outputs.platforms) }}
76+
runs-on: ${{ startsWith(matrix.platform, 'linux/arm') && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
77+
steps:
78+
- name: Checkout
79+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
80+
with:
81+
persist-credentials: false
82+
83+
- name: Get Target Architecture
84+
uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0
85+
id: target
86+
with:
87+
script: |-
88+
core.setOutput('arch', '${{ matrix.platform }}'.split('/').pop());
89+
90+
- name: Login to GitHub Container Registry
91+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
92+
with:
93+
registry: ghcr.io
94+
username: ${{ github.actor }}
95+
password: ${{ github.token }}
96+
97+
- name: Download Bake Metadata
98+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
99+
with:
100+
name: ${{ inputs.variant }}-bake-metadata
101+
path: ${{ runner.temp }}
102+
103+
- name: Setup Docker Buildx
104+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
105+
106+
- name: Build Variant
107+
uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
108+
id: bake
109+
with:
110+
files: |
111+
./docker-bake.hcl
112+
cwd://${{ runner.temp }}/docker-metadata-action-bake.json
113+
targets: image-${{ inputs.variant }}
114+
set: |
115+
*.platform=${{ matrix.platform }}
116+
*.cache-from=${{ format('type=registry,ref=ghcr.io/{0}/immich-cache:{1}-{2}', github.repository_owner, inputs.variant, steps.target.outputs.arch) }}
117+
*.cache-to=${{ inputs.release && format('type=registry,ref=ghcr.io/{0}/immich-cache:{1}-{2},mode=max,compression=zstd,force-compression=true', github.repository_owner, inputs.variant, steps.target.outputs.arch) || '' }}
118+
*.labels.org.opencontainers.image.title=immich-${{ inputs.variant }}
119+
*.labels.org.opencontainers.image.version=${{ needs.plan.outputs.version }}
120+
*.labels.org.opencontainers.image.revision=${{ github.sha }}
121+
*.labels.org.opencontainers.image.vendor=${{ github.repository_owner }}
122+
*.output=type=image,name=ghcr.io/${{ github.repository_owner }}/immich,push-by-digest=true,name-canonical=true,push=true,compression=zstd,force-compression=true
123+
*.tags=
124+
125+
- name: Export Digest
126+
env:
127+
METADATA: ${{ steps.bake.outputs.metadata }}
128+
TARGET: image-${{ inputs.variant }}
129+
run: |-
130+
mkdir -p ${{ runner.temp }}/digests
131+
DIGEST=$(jq -r --arg t "$TARGET" '.[$t]["containerimage.digest"]' <<<"$METADATA")
132+
test -n "$DIGEST" || { echo "::error::bake metadata had no digest for target $TARGET"; jq . <<<"$METADATA"; exit 1; }
133+
touch "${{ runner.temp }}/digests/${DIGEST#sha256:}"
134+
135+
- name: Upload Digest
136+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
137+
with:
138+
name: ${{ inputs.variant }}-digests-${{ steps.target.outputs.arch }}
139+
path: ${{ runner.temp }}/digests/*
140+
if-no-files-found: error
141+
retention-days: 1
142+
143+
merge:
144+
name: Merge
145+
runs-on: ubuntu-latest
146+
needs:
147+
- build
148+
outputs:
149+
digest: ${{ steps.digest.outputs.digest }}
150+
steps:
151+
- name: Download Bake Metadata
152+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
153+
with:
154+
name: ${{ inputs.variant }}-bake-metadata
155+
path: ${{ runner.temp }}
156+
157+
- name: Download Digests
158+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
159+
with:
160+
path: ${{ runner.temp }}/digests
161+
pattern: ${{ inputs.variant }}-digests-*
162+
merge-multiple: true
163+
164+
- name: Login to GitHub Container Registry
165+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
166+
with:
167+
registry: ghcr.io
168+
username: ${{ github.actor }}
169+
password: ${{ github.token }}
170+
171+
- name: Create Manifest List and Push
172+
working-directory: ${{ runner.temp }}/digests
173+
env:
174+
OWNER: ${{ github.repository_owner }}
175+
META: ${{ runner.temp }}/docker-metadata-action-bake.json
176+
run: |-
177+
docker buildx imagetools create \
178+
$(jq --raw-output --compact-output ".target.\"docker-metadata-action\".tags | map(select(startswith(\"ghcr.io/$OWNER/immich\")) | \"-t \" + .) | join(\" \")" "$META") \
179+
$(printf "ghcr.io/$OWNER/immich@sha256:%s " *)
180+
181+
- name: Inspect Image
182+
env:
183+
OWNER: ${{ github.repository_owner }}
184+
META: ${{ runner.temp }}/docker-metadata-action-bake.json
185+
run: |-
186+
TAG=$(jq --raw-output '.target."docker-metadata-action".args.DOCKER_META_VERSION' "$META")
187+
docker buildx imagetools inspect "ghcr.io/$OWNER/immich:$TAG"
188+
189+
- name: Export Digest
190+
id: digest
191+
env:
192+
OWNER: ${{ github.repository_owner }}
193+
META: ${{ runner.temp }}/docker-metadata-action-bake.json
194+
run: |-
195+
TAG=$(jq --raw-output '.target."docker-metadata-action".args.DOCKER_META_VERSION' "$META")
196+
DIGEST=$(docker buildx imagetools inspect "ghcr.io/$OWNER/immich:$TAG" --format '{{ json . }}' | jq --raw-output '.manifest.digest')
197+
echo "digest=$DIGEST" >>"$GITHUB_OUTPUT"
198+
199+
attest:
200+
name: Attest
201+
needs:
202+
- merge
203+
runs-on: ubuntu-latest
204+
steps:
205+
- name: Login to GitHub Container Registry
206+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
207+
with:
208+
registry: ghcr.io
209+
username: ${{ github.actor }}
210+
password: ${{ github.token }}
211+
212+
- name: Upload Dependency Snapshot
213+
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
214+
with:
215+
dependency-snapshot: true
216+
image: ghcr.io/${{ github.repository_owner }}/immich@${{ needs.merge.outputs.digest }}
217+
218+
- name: Attestation
219+
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
220+
with:
221+
push-to-registry: true
222+
subject-name: ghcr.io/${{ github.repository_owner }}/immich
223+
subject-digest: ${{ needs.merge.outputs.digest }}
224+
225+
- name: Verify Attestation
226+
env:
227+
GITHUB_TOKEN: ${{ github.token }}
228+
run: |-
229+
gh attestation verify \
230+
--repo ${{ github.repository }} \
231+
oci://ghcr.io/${{ github.repository_owner }}/immich@${{ needs.merge.outputs.digest }}
232+
233+
test:
234+
if: ${{ ! inputs.release }}
235+
name: Test
236+
needs:
237+
- merge
238+
- attest
239+
runs-on: ubuntu-latest
240+
steps:
241+
- name: Checkout
242+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
243+
with:
244+
persist-credentials: false
245+
246+
- name: Setup Go
247+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
248+
with:
249+
go-version-file: go.mod
250+
251+
- name: Run Tests
252+
env:
253+
TEST_IMAGE: ghcr.io/${{ github.repository_owner }}/immich@${{ needs.merge.outputs.digest }}
254+
VARIANT: ${{ inputs.variant }}
255+
run: |-
256+
go test -v -timeout 15m ./tests/...

‎.github/workflows/codeql.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
3+
name: CodeQL
4+
5+
on:
6+
schedule:
7+
- cron: 30 1 * * *
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
analyze:
15+
name: Analyze (${{ matrix.language }})
16+
runs-on: ubuntu-latest
17+
permissions:
18+
security-events: write
19+
packages: read
20+
actions: read
21+
contents: read
22+
strategy:
23+
fail-fast: false
24+
matrix:
25+
include:
26+
- language: actions
27+
build-mode: none
28+
source-root: .
29+
steps:
30+
- name: Checkout
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
32+
with:
33+
persist-credentials: false
34+
35+
- name: Initialize CodeQL
36+
uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
37+
with:
38+
languages: ${{ matrix.language }}
39+
build-mode: ${{ matrix.build-mode }}
40+
source-root: ${{ matrix.source-root }}
41+
42+
- name: Perform CodeQL Analysis
43+
uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
44+
with:
45+
category: language:${{ matrix.language }}

0 commit comments

Comments
 (0)