Skip to content

Commit 422db63

Browse files
bosbaberbosbaber
committed
ci(docker): images should have independent major minor tags
1 parent 294b0f8 commit 422db63

4 files changed

Lines changed: 207 additions & 40 deletions

File tree

‎.github/actions/image-push/action.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: "Version hierarchy image pusher"
2+
description: "Will re-tag the docker image to create images for parent versions. For example, if the image is tagged 1.2.3, it will create a tag for 1.2 and 1.0 as well."
3+
4+
inputs:
5+
app_name:
6+
description: "The name of the application."
7+
required: true
8+
package:
9+
required: true
10+
platform_name:
11+
required: true
12+
gh_token:
13+
description: "GitHub token to use for authentication."
14+
required: true
15+
version:
16+
required: true
17+
description: "Version we are tagging as, for example v1.2.3 or v1.2.3-rc1"
18+
19+
20+
runs:
21+
using: "composite"
22+
steps:
23+
- name: Calculate version hierarchy
24+
id: hierarchy
25+
uses: ./.github/actions/parent-versions
26+
with:
27+
version: ${{ inputs.version }}
28+
generateRelease: true
29+
- name: Fetch docker image from cache
30+
uses: actions/cache/restore@v4
31+
with:
32+
path: /tmp/${{ github.sha }}-${{ inputs.package }}-${{ inputs.platform_name }}-${{ inputs.version }}.tar
33+
key: ${{ github.sha }}-${{ inputs.package }}-${{ inputs.platform_name }}-${{ inputs.version }}
34+
fail-on-cache-miss: true
35+
- name: Set up QEMU
36+
uses: docker/setup-qemu-action@v3
37+
- name: Set up Docker Buildx
38+
uses: docker/setup-buildx-action@v3
39+
- name: Login to GHCR
40+
uses: docker/login-action@v3
41+
with:
42+
registry: ghcr.io
43+
username: ${{ github.repository_owner }}
44+
password: ${{ inputs.gh_token }}
45+
- name: Load image into Docker
46+
shell: bash
47+
run: |
48+
docker load --input /tmp/${{ github.sha }}-${{ inputs.package }}-${{ inputs.platform_name }}-${{ inputs.version }}.tar
49+
- name: List docker images
50+
shell: bash
51+
run: docker images
52+
- name: Push to registry
53+
shell: bash
54+
run: |
55+
echo "Pushing image to registry"
56+
docker push ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-${{ inputs.platform_name }}:${{ inputs.version }}
57+
- name: Tag and push parent versions
58+
shell: bash
59+
if: ${{ steps.hierarchy.outputs.has_hierarchy == 'true' }}
60+
run: |
61+
echo "Tagging parent versions with ${{ inputs.version }}, ${{ steps.hierarchy.outputs.minor_parent }} and ${{ steps.hierarchy.outputs.major_parent }}"
62+
docker tag ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-${{ inputs.platform_name }}:${{ inputs.version }} ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name}}-${{ inputs.package }}-${{ inputs.platform_name }}:${{ steps.hierarchy.outputs.major_parent }}
63+
docker tag ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-${{ inputs.platform_name }}:${{ inputs.version }} ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name}}-${{ inputs.package }}-${{ inputs.platform_name }}:${{ steps.hierarchy.outputs.minor_parent }}
64+
65+
echo "Pushing parent tagged images to registry"
66+
docker push ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-${{ inputs.platform_name }}:${{ steps.hierarchy.outputs.major_parent }}
67+
docker push ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-${{ inputs.platform_name }}:${{ steps.hierarchy.outputs.minor_parent }}

‎.github/actions/manifest-push/action.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: "Push manifest list for arm64 and amd64"
2+
3+
inputs:
4+
app_name:
5+
description: "The name of the application."
6+
required: true
7+
package:
8+
required: true
9+
gh_token:
10+
description: "GitHub token to use for authentication."
11+
required: true
12+
version:
13+
required: true
14+
description: "Version we are tagging as, for example v1.2.3 or v1.2.3-rc1"
15+
16+
runs:
17+
using: "composite"
18+
steps:
19+
- name: Calculate version hierarchy
20+
id: hierarchy
21+
uses: ./.github/actions/parent-versions
22+
with:
23+
version: ${{ inputs.version }}
24+
generateRelease: true
25+
26+
- name: Login to GHCR
27+
uses: docker/login-action@v3
28+
with:
29+
registry: ghcr.io
30+
username: ${{ github.repository_owner }}
31+
password: ${{ inputs.gh_token }}
32+
- name: Create manifest list with parent versions
33+
if: steps.hierarchy.outputs.has_hierarchy == 'true'
34+
shell: bash
35+
run: |
36+
docker manifest create ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}:${{ inputs.version }} \
37+
--amend ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-amd64:${{ inputs.version }} \
38+
--amend ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-arm64:${{ inputs.version }}
39+
40+
docker manifest create ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}:${{ steps.hierarchy.outputs.minor_parent }} \
41+
--amend ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-amd64:${{ steps.hierarchy.outputs.minor_parent }} \
42+
--amend ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-arm64:${{ steps.hierarchy.outputs.minor_parent }}
43+
44+
docker manifest create ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}:${{ steps.hierarchy.outputs.major_parent }} \
45+
--amend ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-amd64:${{ steps.hierarchy.outputs.major_parent }} \
46+
--amend ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-arm64:${{ steps.hierarchy.outputs.major_parent }}
47+
- name: Create manifest list without parent versions
48+
if: steps.hierarchy.outputs.has_hierarchy != 'true'
49+
shell: bash
50+
run: |
51+
docker manifest create ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}:${{ inputs.version }} \
52+
--amend ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-amd64:${{ inputs.version }} \
53+
--amend ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}-arm64:${{ inputs.version }}
54+
- name: Push manifest list
55+
shell: bash
56+
run: |
57+
docker manifest push ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}:${{ inputs.version }}
58+
- name: Push manifests of parent versions
59+
if: steps.hierarchy.outputs.has_hierarchy == 'true'
60+
shell: bash
61+
run: |
62+
docker manifest push ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}:${{ steps.hierarchy.outputs.minor_parent }}
63+
docker manifest push ghcr.io/${{ github.repository_owner }}/${{ inputs.app_name }}-${{ inputs.package }}:${{ steps.hierarchy.outputs.major_parent }}

‎.github/actions/parent-versions/action.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Version hierachy calculator
2+
3+
inputs:
4+
version:
5+
description: "Version we are tagging as, for example v1.2.3 or v1.2.3-rc1, but it can also be 'nightly' in which case no hierarchy will be generated"
6+
required: true
7+
generateRelease:
8+
description: "Set to true if the image has a hierarchy, this will trigger the tagging of the parent versions."
9+
required: true
10+
default: false
11+
12+
outputs:
13+
has_hierarchy:
14+
description: "Whether this version has a parent hierarchy"
15+
value: ${{ steps.calc.outputs.has_hierarchy }}
16+
version:
17+
description: "Same version string as provided as input, here for convenience"
18+
value: ${{ inputs.version }}
19+
major_parent:
20+
description: "The major parent tag (e.g. v1 or v1-rc1), empty string if no hierarchy"
21+
value: ${{ steps.calc.outputs.major_parent }}
22+
minor_parent:
23+
description: "The minor parent tag (e.g. v1.2 or v1.2-rc1), empty string if no hierarchy"
24+
value: ${{ steps.calc.outputs.minor_parent }}
25+
runs:
26+
using: "composite"
27+
steps:
28+
- name: Calculate version hierarchy
29+
id: calc
30+
shell: bash
31+
run: |
32+
# if we aren't generating a release, we don't need to do anything
33+
if [[ "${{ inputs.generateRelease }}" != 'true' ]]; then
34+
echo "has_hierarchy=false" >> $GITHUB_OUTPUT
35+
echo "major_parent=" >> $GITHUB_OUTPUT
36+
echo "minor_parent=" >> $GITHUB_OUTPUT
37+
exit 0
38+
fi
39+
40+
# strip leading 'v'
41+
version="${{ inputs.version }}"
42+
raw="${version#v}"
43+
# extract parts
44+
major_num="${raw%%.*}"
45+
minor_num="$(echo "$raw" | cut -d'.' -f2)"
46+
pre_release="$(echo "$raw" | grep -oP '(?<=-).*' || echo "")"
47+
48+
# build parents
49+
minor_label="v${major_num}.${minor_num}"
50+
major_label="v${major_num}"
51+
if [[ -n "$pre_release" ]]; then
52+
minor_label+="-$pre_release"
53+
major_label+="-$pre_release"
54+
fi
55+
56+
# emit outputs
57+
echo "has_hierarchy=true" >> $GITHUB_OUTPUT
58+
echo "major_parent=$major_label" >> $GITHUB_OUTPUT
59+
echo "minor_parent=$minor_label" >> $GITHUB_OUTPUT

‎.github/workflows/node-build.yml‎

Lines changed: 18 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -466,10 +466,10 @@ jobs:
466466
run: |
467467
docker images
468468
/tmp/trivy image --db-repository ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db --java-db-repository ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db --ignore-unfixed --format table --vuln-type os,library --exit-code 1 --severity HIGH --input /tmp/${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}.tar
469-
469+
470470
push:
471471
name: Push to registry
472-
needs: [version-generator, docker-grype, docker-trivy, version-generator, node-build]
472+
needs: [version-generator, docker-grype, docker-trivy, node-build]
473473
runs-on: ubuntu-latest
474474
if: needs.version-generator.outputs.dockerPush == 'true'
475475
strategy:
@@ -484,34 +484,18 @@ jobs:
484484
- backend
485485
- frontend
486486
steps:
487-
- name: Fetch docker image from cache
488-
uses: actions/cache/restore@v4
489-
with:
490-
path: /tmp/${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}.tar
491-
key: ${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}
492-
fail-on-cache-miss: true
493-
- name: Set up QEMU
494-
uses: docker/setup-qemu-action@v3
495-
- name: Set up Docker Buildx
496-
uses: docker/setup-buildx-action@v3
497-
- name: Login to GHCR
498-
uses: docker/login-action@v3
487+
- uses: actions/checkout@v4
488+
- uses: ./.github/actions/image-push
499489
with:
500-
registry: ghcr.io
501-
username: ${{ github.repository_owner }}
502-
password: ${{ secrets.GITHUB_TOKEN }}
503-
- name: Load image into Docker
504-
run: |
505-
docker load --input /tmp/${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}.tar
506-
- name: List docker images
507-
run: docker images
508-
- name: Push to registry
509-
run: |
510-
docker push ghcr.io/${{ github.repository_owner }}/rafiki-${{ matrix.package }}-${{ matrix.platform.name }}:${{ needs.version-generator.outputs.version }}
490+
app_name: rafiki
491+
package: ${{ matrix.package }}
492+
platform_name: ${{ matrix.platform.name }}
493+
version: ${{ needs.version-generator.outputs.version }}
494+
gh_token: ${{ secrets.GITHUB_TOKEN }}
511495

512496
push-manifest:
513497
name: Push multi-arch manifest list
514-
needs: [version-generator, push]
498+
needs: [version-generator,push]
515499
runs-on: ubuntu-latest
516500
if: needs.version-generator.outputs.dockerPush == 'true'
517501
strategy:
@@ -521,20 +505,14 @@ jobs:
521505
- backend
522506
- frontend
523507
steps:
524-
- name: Login to GHCR
525-
uses: docker/login-action@v3
526-
with:
527-
registry: ghcr.io
528-
username: ${{ github.repository_owner }}
529-
password: ${{ secrets.GITHUB_TOKEN }}
530-
- name: Create manifest list
531-
run: |
532-
docker manifest create ghcr.io/${{ github.repository_owner }}/rafiki-${{ matrix.package }}:${{ needs.version-generator.outputs.version }} \
533-
--amend ghcr.io/${{ github.repository_owner }}/rafiki-${{ matrix.package }}-amd64:${{ needs.version-generator.outputs.version }} \
534-
--amend ghcr.io/${{ github.repository_owner }}/rafiki-${{ matrix.package }}-arm64:${{ needs.version-generator.outputs.version }}
508+
- uses: actions/checkout@v4
535509
- name: Push manifest list
536-
run: |
537-
docker manifest push ghcr.io/${{ github.repository_owner }}/rafiki-${{ matrix.package }}:${{ needs.version-generator.outputs.version }}
510+
uses: ./.github/actions/manifest-push
511+
with:
512+
app_name: rafiki
513+
package: ${{ matrix.package }}
514+
gh_token: ${{ secrets.GITHUB_TOKEN }}
515+
version: ${{ needs.version-generator.outputs.version }}
538516

539517
generate-release:
540518
runs-on: ubuntu-latest
@@ -551,7 +529,7 @@ jobs:
551529
tag: ${{ needs.version-generator.outputs.version }}
552530
includeRefIssues: false
553531
- name: Create Release
554-
uses: ncipollo/release-action@v1.15.0
532+
uses: ncipollo/release-action@v1.16.0
555533
with:
556534
allowUpdates: true
557535
draft: false

0 commit comments

Comments
 (0)