Skip to content

Commit 0b1a10d

Browse files
JAORMXclaude
JAORMX
and
claude
committed
Add release and image workflows, stop pushing images from CI
Add a release workflow triggered on v* tags that builds bbox binaries (linux/amd64, linux/arm64, darwin/arm64) and creates a GitHub Release with tarballs and SHA-256 checksums. Add a dedicated images workflow for building and pushing guest container images to GHCR on a weekly schedule, manual dispatch, or when images/** changes on main. Remove image push logic from CI — it now only validates that images build successfully. Document all three workflows in CLAUDE.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent de9ad01 commit 0b1a10d

4 files changed

Lines changed: 157 additions & 11 deletions

File tree

‎.github/workflows/ci.yaml‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -109,9 +109,6 @@ jobs:
109109
images:
110110
name: Build Images
111111
runs-on: ubuntu-latest
112-
permissions:
113-
contents: read
114-
packages: write
115112
steps:
116113
- name: Checkout repository
117114
uses: actions/checkout@v6
@@ -122,15 +119,7 @@ jobs:
122119
- name: Set up Docker Buildx
123120
uses: docker/setup-buildx-action@v4
124121

125-
- name: Log in to GHCR
126-
uses: docker/login-action@v4
127-
with:
128-
registry: ghcr.io
129-
username: ${{ github.actor }}
130-
password: ${{ secrets.GITHUB_TOKEN }}
131-
132122
- name: Build images
133123
uses: docker/bake-action@v7
134124
with:
135125
files: docker-bake.hcl
136-
push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}

‎.github/workflows/images.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# SPDX-FileCopyrightText: Copyright 2025 Stacklok, Inc.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Images
5+
6+
on:
7+
schedule:
8+
- cron: "0 6 * * 1" # Every Monday at 06:00 UTC
9+
workflow_dispatch:
10+
push:
11+
branches: [main]
12+
paths:
13+
- "images/**"
14+
15+
permissions:
16+
contents: read
17+
packages: write
18+
19+
jobs:
20+
images:
21+
name: Build and Push Images
22+
runs-on: ubuntu-latest
23+
steps:
24+
- name: Checkout repository
25+
uses: actions/checkout@v6
26+
27+
- name: Set up QEMU
28+
uses: docker/setup-qemu-action@v4
29+
30+
- name: Set up Docker Buildx
31+
uses: docker/setup-buildx-action@v4
32+
33+
- name: Log in to GHCR
34+
uses: docker/login-action@v4
35+
with:
36+
registry: ghcr.io
37+
username: ${{ github.actor }}
38+
password: ${{ secrets.GITHUB_TOKEN }}
39+
40+
- name: Build and push images
41+
uses: docker/bake-action@v7
42+
with:
43+
files: docker-bake.hcl
44+
push: true

‎.github/workflows/release.yaml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# SPDX-FileCopyrightText: Copyright 2025 Stacklok, Inc.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Release
5+
6+
on:
7+
push:
8+
tags:
9+
- "v*"
10+
11+
permissions:
12+
contents: write
13+
packages: write
14+
15+
env:
16+
GOPRIVATE: github.com/stacklok/*
17+
GH_TOKEN: ${{ secrets.GO_MODULE_TOKEN || github.token }}
18+
19+
jobs:
20+
build:
21+
name: Build (${{ matrix.os }}-${{ matrix.arch }})
22+
runs-on: ${{ matrix.runner }}
23+
strategy:
24+
matrix:
25+
include:
26+
- os: linux
27+
arch: amd64
28+
runner: ubuntu-latest
29+
- os: linux
30+
arch: arm64
31+
runner: ubuntu-24.04-arm
32+
- os: darwin
33+
arch: arm64
34+
runner: macos-15
35+
steps:
36+
- name: Checkout repository
37+
uses: actions/checkout@v6
38+
39+
- name: Set up Go
40+
uses: actions/setup-go@v6
41+
with:
42+
go-version-file: go.mod
43+
cache: true
44+
45+
- name: Configure Git for private modules
46+
run: |
47+
git config --global url."https://${{ github.actor }}:${{ secrets.GO_MODULE_TOKEN }}@github.com/".insteadOf "https://github.com/"
48+
49+
- name: Install Task
50+
uses: go-task/setup-task@v1
51+
52+
- name: Build bbox
53+
run: task build
54+
55+
- name: Verify version
56+
run: |
57+
echo "Binary reports: $(./bin/bbox --version)"
58+
echo "Expected tag: ${{ github.ref_name }}"
59+
60+
- name: Package binary
61+
run: |
62+
mkdir -p dist
63+
tar -czf dist/bbox-${{ matrix.os }}-${{ matrix.arch }}.tar.gz -C bin bbox
64+
65+
- name: Upload artifact
66+
uses: actions/upload-artifact@v4
67+
with:
68+
name: bbox-${{ matrix.os }}-${{ matrix.arch }}
69+
path: dist/bbox-${{ matrix.os }}-${{ matrix.arch }}.tar.gz
70+
71+
release:
72+
name: Create Release
73+
runs-on: ubuntu-latest
74+
needs: [build]
75+
steps:
76+
- name: Checkout repository
77+
uses: actions/checkout@v6
78+
79+
- name: Download all artifacts
80+
uses: actions/download-artifact@v4
81+
with:
82+
merge-multiple: true
83+
84+
- name: Generate checksums
85+
run: sha256sum bbox-*.tar.gz > sha256sums.txt
86+
87+
- name: Create GitHub Release
88+
env:
89+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
90+
run: |
91+
if gh release view "${{ github.ref_name }}" >/dev/null 2>&1; then
92+
gh release upload "${{ github.ref_name }}" --clobber \
93+
bbox-*.tar.gz sha256sums.txt
94+
else
95+
gh release create "${{ github.ref_name }}" --generate-notes \
96+
bbox-*.tar.gz sha256sums.txt
97+
fi

‎CLAUDE.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,22 @@ review:
117117
118118
Execution order: create snapshot → start VM → terminal → stop VM → diff → review → flush → cleanup.
119119
120+
## CI/CD
121+
122+
Three GitHub Actions workflows:
123+
124+
- **CI** (`.github/workflows/ci.yaml`) — Runs on pushes to `main` and PRs. Jobs: test, lint, build (matrix: ubuntu + macOS). Also validates image builds (build-only, no push).
125+
- **Images** (`.github/workflows/images.yaml`) — Dedicated image build and push. Triggers: weekly schedule (Monday 06:00 UTC), manual dispatch, and pushes to `main` that touch `images/**`. Pushes all guest images (base, claude-code, codex, opencode) as `:latest` to GHCR.
126+
- **Release** (`.github/workflows/release.yaml`) — Triggered by `v*` tag pushes. Builds `bbox` binaries natively on linux/amd64, linux/arm64, and darwin/arm64 using `task build` (embeds bbox-init + propolis runtime). Packages tarballs, generates SHA-256 checksums, and creates a GitHub Release with auto-generated notes.
127+
128+
To cut a release:
129+
```bash
130+
git tag v0.0.X
131+
git push origin v0.0.X
132+
```
133+
134+
Image tagging is `:latest` only — images are not versioned with release tags. They are rebuilt weekly and on any change to `images/`.
135+
120136
## Things That Will Bite You
121137

122138
- **propolis is a tagged dependency**: `go.mod` depends on `github.com/stacklok/propolis` as a versioned module. `build` downloads pre-built propolis runtime artifacts and embeds them — no local checkout or system libkrun needed. Use `build-dev-system` to build propolis-runner from source (requires `libkrun-devel`).

0 commit comments

Comments
 (0)