docker.yml

name: Docker Build

permissions: {}

on:
  push:
    branches:
      - main
      - "rc/*"
    tags:
      - "v*.*.*"
  merge_group:
  workflow_dispatch:
    inputs:
      nightly:
        description: "Tag nightly"
        type: boolean
        default: false
  workflow_call:
  # We're building nightly only once a day to let the rollout cook for 24h without interruptions
  schedule:
    - cron: "5 9 * * *"

env:
  REGISTRY: ghcr.io/tempoxyz

jobs:
  build-and-push:
    name: Build and Push Docker Images
    if: ${{ (github.event_name != 'schedule' || github.repository == 'tempoxyz/tempo') && !(github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository != 'tempoxyz/tempo') }}
    runs-on: depot-ubuntu-latest-16
    permissions:
      actions: read
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1

      - name: Determine Docker labels
        id: docker-labels
        shell: bash
        run: |
          if [[ "${{ github.repository }}" != "tempoxyz/tempo" ]]; then
            cat <<'LABELS' >> "$GITHUB_OUTPUT"
          value<<EOF
          org.opencontainers.image.created=
          org.opencontainers.image.description=
          org.opencontainers.image.licenses=
          org.opencontainers.image.revision=
          org.opencontainers.image.source=
          org.opencontainers.image.title=
          org.opencontainers.image.url=
          org.opencontainers.image.version=
          EOF
          LABELS
          fi

      - name: Docker metadata for tempo
        id: meta-tempo
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ${{ env.REGISTRY }}/tempo
            docker.io/tempoxyz/tempo
          bake-target: tempo
          labels: ${{ steps.docker-labels.outputs.value }}
          tags: |
            type=schedule,pattern=nightly
            type=raw,value=nightly,enable=${{ github.event.inputs.nightly == 'true' }}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=stable,enable=${{ github.ref_type == 'tag' }}
            type=raw,value=latest,enable={{is_default_branch}}
            type=edge,branch=main
            type=sha,prefix=sha-
            type=ref,event=pr

      - name: Docker metadata for tempo-localnet
        id: meta-tempo-localnet
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ${{ env.REGISTRY }}/tempo-localnet
            docker.io/tempoxyz/tempo-localnet
          bake-target: tempo-localnet
          labels: ${{ steps.docker-labels.outputs.value }}
          tags: |
            type=schedule,pattern=nightly
            type=raw,value=nightly,enable=${{ github.event.inputs.nightly == 'true' }}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=stable,enable=${{ github.ref_type == 'tag' }}
            type=raw,value=latest,enable={{is_default_branch}}
            type=edge,branch=main
            type=sha,prefix=sha-
            type=ref,event=pr

      - name: Docker metadata for tempo-sidecar
        id: meta-tempo-sidecar
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ${{ env.REGISTRY }}/tempo-sidecar
            docker.io/tempoxyz/tempo-sidecar
          bake-target: tempo-sidecar
          labels: ${{ steps.docker-labels.outputs.value }}
          tags: |
            type=schedule,pattern=nightly
            type=raw,value=nightly,enable=${{ github.event.inputs.nightly == 'true' }}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=stable,enable=${{ github.ref_type == 'tag' }}
            type=raw,value=latest,enable={{is_default_branch}}
            type=edge,branch=main
            type=sha,prefix=sha-
            type=ref,event=pr

      - name: Docker metadata for tempo-xtask
        id: meta-tempo-xtask
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ${{ env.REGISTRY }}/tempo-xtask
            docker.io/tempoxyz/tempo-xtask
          bake-target: tempo-xtask
          labels: ${{ steps.docker-labels.outputs.value }}
          tags: |
            type=schedule,pattern=nightly
            type=raw,value=nightly,enable=${{ github.event.inputs.nightly == 'true' }}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=stable,enable=${{ github.ref_type == 'tag' }}
            type=raw,value=latest,enable={{is_default_branch}}
            type=edge,branch=main
            type=sha,prefix=sha-
            type=ref,event=pr

      - name: Log in to Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ vars.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - id: shortsha
        run: echo "shortsha=$(echo ${{ github.sha }} | cut -c1-7)" >> "$GITHUB_OUTPUT"

      - name: Build and push Docker images
        id: build-and-push
        uses: depot/bake-action@1d58c2668346981089b088b7ef36755b206b20e9 # v1.13.0
        with:
          files: |
            docker-bake.hcl
            ${{ steps.meta-tempo.outputs.bake-file }}
            ${{ steps.meta-tempo-localnet.outputs.bake-file }}
            ${{ steps.meta-tempo-sidecar.outputs.bake-file }}
            ${{ steps.meta-tempo-xtask.outputs.bake-file }}
          targets: ${{ (github.event_name == 'schedule' || github.event.inputs.nightly == 'true') && 'nightly' || 'default' }}
          project: 0c6tg19qsp
          push: true
          no-cache: ${{ startsWith(github.ref, 'refs/tags/v') }}
          pull: ${{ github.event_name != 'merge_group' }}
        env:
          VERGEN_GIT_SHA: ${{ github.sha }}
          VERGEN_GIT_SHA_SHORT: ${{ steps.shortsha.outputs.shortsha }}

      - name: Install cosign
        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1

      - name: Sign Docker images
        id: sign-images
        shell: bash
        env:
          TEMPO_TAGS: ${{ steps.meta-tempo.outputs.tags }}
          TEMPO_LOCALNET_TAGS: ${{ steps.meta-tempo-localnet.outputs.tags }}
          TEMPO_SIDECAR_TAGS: ${{ steps.meta-tempo-sidecar.outputs.tags }}
          TEMPO_XTASK_TAGS: ${{ steps.meta-tempo-xtask.outputs.tags }}
        run: |
          set -euo pipefail
          sign_image() {
            local image="$1"
            local attempt

            for attempt in 1 2 3; do
              if cosign sign --yes --recursive "$image"; then
                return 0
              fi

              if [ "$attempt" -eq 3 ]; then
                echo "Failed to sign $image after $attempt attempts" >&2
                return 1
              fi

              sleep_seconds=$((attempt * 15))
              echo "cosign sign failed for $image; retrying in ${sleep_seconds}s (attempt $((attempt + 1))/3)" >&2
              sleep "$sleep_seconds"
            done
          }

          images=(
            "$TEMPO_TAGS"
            "$TEMPO_LOCALNET_TAGS"
            "$TEMPO_SIDECAR_TAGS"
            "$TEMPO_XTASK_TAGS"
          )
          sign_failures=0
          for tags in "${images[@]}"; do
            while IFS= read -r image; do
              [ -n "$image" ] || continue
              if ! sign_image "$image"; then
                sign_failures=$((sign_failures + 1))
              fi
            done <<< "$tags"
          done

          if [ "$sign_failures" -ne 0 ]; then
            echo "Failed to sign $sign_failures image reference(s)" >&2
            exit 1
          fi

      - name: Publish event (sha tag)
        id: publish-sha-event
        if: ${{ github.repository == 'tempoxyz/tempo' && github.event_name != 'merge_group' }}
        shell: bash
        env:
          EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
          EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
          RUNNER_TEMP: ${{ runner.temp }}
          GH_REPO: ${{ github.repository }}
          SHORT_SHA: ${{ steps.shortsha.outputs.shortsha }}
          COMMIT_SHA: ${{ github.sha }}
          BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
        run: |
          set -euo pipefail

          echo "$EVENTS_KEY" > "${RUNNER_TEMP}/key"
          echo "$EVENTS_CERT" > "${RUNNER_TEMP}/cert"

          # EVENTS_ARGS may contain additional curl arguments, not just a URL.
          curl -sf -o /dev/null -X POST ${{ secrets.EVENTS_ARGS }} \
            --key "${RUNNER_TEMP}/key" \
            --cert "${RUNNER_TEMP}/cert" \
            -H "Content-Type: application/json" \
            -d "{
              \"repository\": \"${GH_REPO}\",
              \"event\": \"registry_package\",
              \"data\": {
                \"tag\": \"sha-${SHORT_SHA}\",
                \"sha\": \"${COMMIT_SHA}\",
                \"branch\": \"${BRANCH_NAME}\"
              }
            }"

      - name: Publish event (nightly tag)
        id: publish-nightly-event
        if: ${{ github.repository == 'tempoxyz/tempo' && (github.event_name == 'schedule' || github.event.inputs.nightly == 'true') }}
        shell: bash
        env:
          EVENTS_KEY: ${{ secrets.EVENTS_KEY }}
          EVENTS_CERT: ${{ secrets.EVENTS_CERT }}
          RUNNER_TEMP: ${{ runner.temp }}
          GH_REPO: ${{ github.repository }}
          COMMIT_SHA: ${{ github.sha }}
          BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
        run: |
          set -euo pipefail

          DAY_OF_WEEK="$(date -u +%u)"
          if [ "$DAY_OF_WEEK" = "5" ]; then
            INVARIANT_TIMEOUT="172800"
          else
            INVARIANT_TIMEOUT="18000"
          fi

          echo "$EVENTS_KEY" > "${RUNNER_TEMP}/key"
          echo "$EVENTS_CERT" > "${RUNNER_TEMP}/cert"

          # EVENTS_ARGS may contain additional curl arguments, not just a URL.
          curl -sf -o /dev/null -X POST ${{ secrets.EVENTS_ARGS }} \
            --key "${RUNNER_TEMP}/key" \
            --cert "${RUNNER_TEMP}/cert" \
            -H "Content-Type: application/json" \
            -d "{
              \"repository\": \"${GH_REPO}\",
              \"event\": \"registry_package\",
              \"data\": {
                \"tag\": \"nightly\",
                \"sha\": \"${COMMIT_SHA}\",
                \"branch\": \"${BRANCH_NAME}\",
                \"invariant_timeout\": \"${INVARIANT_TIMEOUT}\"
              }
            }"

      - name: Summarize Docker build
        if: ${{ always() }}
        shell: bash
        env:
          TEMPO_TAGS: ${{ steps.meta-tempo.outputs.tags }}
          TEMPO_LOCALNET_TAGS: ${{ steps.meta-tempo-localnet.outputs.tags }}
          TEMPO_SIDECAR_TAGS: ${{ steps.meta-tempo-sidecar.outputs.tags }}
          TEMPO_XTASK_TAGS: ${{ steps.meta-tempo-xtask.outputs.tags }}
          SHORT_SHA: ${{ steps.shortsha.outputs.shortsha }}
          BUILD_OUTCOME: ${{ steps.build-and-push.outcome }}
          SIGN_OUTCOME: ${{ steps.sign-images.outcome }}
          SHA_EVENT_OUTCOME: ${{ steps.publish-sha-event.outcome }}
          NIGHTLY_EVENT_OUTCOME: ${{ steps.publish-nightly-event.outcome }}
          BUILD_METADATA: ${{ steps.build-and-push.outputs.metadata }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          job_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          if command -v gh >/dev/null 2>&1; then
            resolved_job_url="$(gh api \
              "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs" \
              --paginate \
              --jq '.jobs[] | select(.name == "Build and Push Docker Images") | .html_url' \
              | head -n 1 || true)"
            if [ -n "$resolved_job_url" ]; then
              job_url="$resolved_job_url"
            fi
          fi

          {
            echo "## Docker build"
            echo
            echo "| Field | Value |"
            echo "| --- | --- |"
            echo "| Commit | [\`${{ github.sha }}\`](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}) |"
            echo "| Ref | \`${{ github.ref_name }}\` |"
            echo "| Workflow run | [run #${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) |"
            echo "| Workflow run ID | [\`${{ github.run_id }}\`](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) |"
            echo "| Job summary | [Build and Push Docker Images](${job_url}) |"
            echo "| Short SHA tag | \`sha-${SHORT_SHA}\` |"
            echo "| Build | \`${BUILD_OUTCOME:-unknown}\` |"
            echo "| Sign | \`${SIGN_OUTCOME:-unknown}\` |"
            echo
            echo "## Images"
            echo
            echo "| Image | Package | Tags | Digest |"
            echo "| --- | --- | --- | --- |"
          } >> "$GITHUB_STEP_SUMMARY"

          summarize_image() {
            local image="$1"
            local package_url="$2"
            local tags="$3"
            local target="$4"
            local formatted=""
            local digest
            local tag

            digest="$(jq -r --arg target "$target" '.[$target]["containerimage.digest"] // empty' <<< "$BUILD_METADATA" 2>/dev/null || true)"

            while IFS= read -r tag; do
              [ -n "$tag" ] || continue
              if [ -n "$formatted" ]; then
                formatted="${formatted}<br>${tag}"
              else
                formatted="$tag"
              fi
            done <<< "$tags"

            echo "| ${image} | [GHCR package](${package_url}) | ${formatted:-None} | \`${digest:-None}\` |" >> "$GITHUB_STEP_SUMMARY"
          }

          summarize_image "tempo" "${{ github.server_url }}/orgs/tempoxyz/packages/container/package/tempo" "$TEMPO_TAGS" "tempo"
          summarize_image "tempo-localnet" "${{ github.server_url }}/orgs/tempoxyz/packages/container/package/tempo-localnet" "$TEMPO_LOCALNET_TAGS" "tempo-localnet"
          summarize_image "tempo-sidecar" "${{ github.server_url }}/orgs/tempoxyz/packages/container/package/tempo-sidecar" "$TEMPO_SIDECAR_TAGS" "tempo-sidecar"
          summarize_image "tempo-xtask" "${{ github.server_url }}/orgs/tempoxyz/packages/container/package/tempo-xtask" "$TEMPO_XTASK_TAGS" "tempo-xtask"

          {
            echo
            echo "## Publish events"
            echo
            echo "| Event | Tag | Outcome |"
            echo "| --- | --- | --- |"
            echo "| registry_package | \`sha-${SHORT_SHA}\` | \`${SHA_EVENT_OUTCOME:-skipped}\` |"
            echo "| registry_package | \`nightly\` | \`${NIGHTLY_EVENT_OUTCOME:-skipped}\` |"
          } >> "$GITHUB_STEP_SUMMARY"