ci: pass internal registry into centos/alpine builds; generate Windows jobs

- centos/alpine compose now pass CI_REGISTRY_IMAGE as a build arg (anchor on
  base, merged into php services) so PHP images build FROM the freshly-built
  internal base instead of the Docker Hub fallback (matches bookworm BUILD_BASE).
- Windows build + publish jobs are generated from docker-compose.yml; the
  build matrix now includes the windows-base-* services so they exist in the
  internal registry before publish. Linux + Windows publish share .image_publish.

Author: realFlowControl

.gitlab/generate-ci-images.php

@@ -9,11 +9,11 @@
  *
  * The compose service name is the `docker buildx bake` target and the build
  * matrix value; the `image:` tag (with env vars resolved) is the published tag.
- * This script prints a literal preamble (stages, job templates, and the
- * single-arch Windows jobs), then loops over the parsed compose services to
- * emit, per Linux OS, one build matrix job over PHP versions (bake builds and
- * pushes the multi-arch image) plus a manual publish matrix job that mirrors
- * the tags to Docker Hub.
+ * This script prints a literal preamble (stages, job templates), then loops
+ * over the parsed compose services to emit, per Linux OS, one build matrix job
+ * over PHP versions (bake builds and pushes the multi-arch image) plus a manual
+ * publish matrix job that mirrors the tags to Docker Hub. Windows is emitted the
+ * same way but single-arch (no manifest) with its own build runner/script.
  */
 
 $root = dirname(__DIR__);
@@ -84,11 +84,19 @@ function parse_compose(string $path, array $env): array
     }
     $osList[] = ["name" => $os, "dir" => $dir, "services" => $services];
 }
+
+// Windows is single-arch (no multi-arch manifest) and uses a different build
+// runner/script, so it is emitted separately from the Linux loop below. It has
+// no .env, so tags resolve with an empty env map.
+$winServices = parse_compose("$root/dockerfiles/ci/windows/docker-compose.yml", []);
+if (!$winServices) {
+    fwrite(STDERR, "WARNING: no services parsed for Windows\n");
+}
 ?>
 # CI image build + publish child pipeline, generated by
 # .gitlab/generate-ci-images.php from the docker-compose.yml + .env files.
-# Edit the generator, never this generated file. The Windows jobs are
-# hand-written in the generator (single-arch, no multi-arch manifest).
+# Edit the generator, never this generated file. Windows is generated too
+# (single-arch, no multi-arch manifest, different build runner/script).
 
 stages:
   - ci-build
@@ -111,7 +119,7 @@ function parse_compose(string $path, array $env): array
     # pod uses cluster defaults. MAKE_JOBS sets the builder's compile parallelism.
     MAKE_JOBS: "8"
 
-.linux_publish:
+.image_publish:
   stage: ci-publish
   rules:
     - when: manual
@@ -206,64 +214,28 @@ function parse_compose(string $path, array $env): array
       if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
     }
 
-"Windows 1: Tool Images":
-  extends: .windows_image_build
-  parallel:
-    matrix:
-      - WINDOWS_IMAGE_TARGETS:
-        - "vc15"
-        - "vs16"
-        - "vs17"
-
-"Windows 2: PHP Images":
+<?php /*
+  Windows: single matrix over every compose service (base tools + tools + php).
+  No needs/deps - like the Linux base/php builds, you manually run the base
+  matrix entries before the dependent ones.
+*/ ?>
+Windows build:
   extends: .windows_image_build
   parallel:
     matrix:
       - WINDOWS_IMAGE_TARGETS:
-        - "php-8.5"
-        - "php-8.4"
-        - "php-8.3"
-        - "php-8.2"
-        - "php-8.1"
-        - "php-8.0"
-        - "php-7.4"
-        - "php-7.3"
-        - "php-7.2"
+<?php foreach (array_keys($winServices) as $svc): ?>
+        - "<?= $svc ?>"
+<?php endforeach; ?>
 
-Publish Windows:
-  stage: ci-publish
-  rules:
-    - when: manual
-      allow_failure: true
-  needs:
-    - job: "Windows 1: Tool Images"
-    - job: "Windows 2: PHP Images"
-  trigger:
-    project: DataDog/public-images
-    branch: main
+Windows publish:
+  extends: .image_publish
   parallel:
     matrix:
-      - TAG_NAME:
-        - "windows-base-vc15"
-        - "windows-base-vs16"
-        - "windows-base-vs17"
-        - "windows-vc15"
-        - "windows-vs16"
-        - "windows-vs17"
-        - "php-8.5_windows"
-        - "php-8.4_windows"
-        - "php-8.3_windows"
-        - "php-8.2_windows"
-        - "php-8.1_windows"
-        - "php-8.0_windows"
-        - "php-7.4_windows"
-        - "php-7.3_windows"
-        - "php-7.2_windows"
-  variables:
-    IMG_SOURCES: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:${TAG_NAME}"
-    IMG_DESTINATIONS: "dd-trace-ci:${TAG_NAME}"
-    IMG_REGISTRIES: "dockerhub"
-    IMG_SIGNING: false
+      - TAG:
+<?php foreach ($winServices as $tag): ?>
+        - "<?= $tag ?>"
+<?php endforeach; ?>
 <?php foreach ($osList as ['name' => $os, 'dir' => $dir, 'services' => $services]): ?>
 <?php /*
   One build job per PHP version. buildx bake reads the x-bake platforms from
@@ -285,11 +257,11 @@ function parse_compose(string $path, array $env): array
     - docker buildx bake --no-cache --pull --push "${PHP_VERSION}"
 <?php /*
   Mirror to Docker Hub: one matrix job per OS, independent (needs: [] via
-  .linux_publish) so it can sync existing images without rebuilding.
+  .image_publish) so it can sync existing images without rebuilding.
 */ ?>
 
 <?= $os ?> publish:
-  extends: .linux_publish
+  extends: .image_publish
   parallel:
     matrix:
       - TAG:

dockerfiles/ci/alpine_compile_extension/docker-compose.yml

@@ -11,6 +11,10 @@ services:
         platforms:
           - linux/arm64
           - linux/amd64
+      args: &build-base
+        # Build php images FROM the (possibly freshly built) internal base,
+        # not the Docker Hub fallback baked into the Dockerfile ARG default.
+        CI_REGISTRY_IMAGE: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}
     volumes:
         - ../../:/app
 
@@ -20,6 +24,7 @@ services:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 7.0.33
         phpSha256Hash: d71a6ecb6b13dc53fed7532a7f8f949c4044806f067502f8fb6f9facbb40452a
         phpApi: 20151012
@@ -32,6 +37,7 @@ services:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 7.1.33
         phpSha256Hash: 0055f368ffefe51d5a4483755bd17475e88e74302c08b727952831c5b2682ea2
         phpApi: 20160303
@@ -44,6 +50,7 @@ services:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 7.2.34
         phpSha256Hash: 8b2777c741e83f188d3ca6d8e98ece7264acafee86787298fae57e05d0dddc78
         phpApi: 20170718
@@ -56,6 +63,7 @@ services:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 7.3.33
         phpSha256Hash: 9a369c32c6f52036b0a890f290327f148a1904ee66aa56e2c9a7546da6525ec8
         phpApi: 20180731
@@ -68,6 +76,7 @@ services:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 7.4.33
         phpSha256Hash: 5a2337996f07c8a097e03d46263b5c98d2c8e355227756351421003bea8f463e
         phpApi: 20190902
@@ -80,6 +89,7 @@ services:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.0.30
         phpSha256Hash: 449d2048fcb20a314d8c218097c6d1047a9f1c5bb72aa54d5d3eba0a27a4c80c
         phpApi: 20200930
@@ -92,6 +102,7 @@ services:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.1.31
         phpSha256Hash: 618923b407c4575bfee085f00c4aaa16a5cc86d4b1eb893c0f352d61541bbfb1
         phpApi: 20210902
@@ -104,6 +115,7 @@ services:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.2.31
         phpSha256Hash: 083c2f61cc5f527eb293c4c468a91af46a9678785957e023b2796a9db290d870
         phpApi: 20220829
@@ -116,6 +128,7 @@ services:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.3.31
         phpSha256Hash: 4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f
         phpApi: 20230831
@@ -128,6 +141,7 @@ services:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.4.22
         phpSha256Hash: a012c2c9724baf214a70b41b40a7e130906b8855e54268afa5bc4ae17bc9d823
         phpApi: 20240924
@@ -140,6 +154,7 @@ services:
       context: .
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: 8.5.7
         phpSha256Hash: "e5eba93fd6dd3241d0e61e932eb99a3783b40568553fb0e511b660ecd863a049"
         phpApi: 20250925

dockerfiles/ci/centos/7/docker-compose.yml

@@ -10,13 +10,18 @@ services:
         platforms:
           - linux/arm64
           - linux/amd64
+      args: &build-base
+        # Build php images FROM the (possibly freshly built) internal base,
+        # not the Docker Hub fallback baked into the Dockerfile ARG default.
+        CI_REGISTRY_IMAGE: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}
 
   php-7.0:
     build:
       context: .
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "7.0"
         phpTarGzUrl: https://www.php.net/distributions/php-7.0.33.tar.gz
         phpSha256Hash: d71a6ecb6b13dc53fed7532a7f8f949c4044806f067502f8fb6f9facbb40452a
@@ -28,6 +33,7 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "7.1"
         phpTarGzUrl: https://www.php.net/distributions/php-7.1.33.tar.gz
         phpSha256Hash: 0055f368ffefe51d5a4483755bd17475e88e74302c08b727952831c5b2682ea2
@@ -39,6 +45,7 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "7.2"
         phpTarGzUrl: https://www.php.net/distributions/php-7.2.34.tar.gz
         phpSha256Hash: 8b2777c741e83f188d3ca6d8e98ece7264acafee86787298fae57e05d0dddc78
@@ -50,6 +57,7 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "7.3"
         phpTarGzUrl: https://www.php.net/distributions/php-7.3.33.tar.gz
         phpSha256Hash: 9a369c32c6f52036b0a890f290327f148a1904ee66aa56e2c9a7546da6525ec8
@@ -61,6 +69,7 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "7.4"
         phpTarGzUrl: https://www.php.net/distributions/php-7.4.33.tar.gz
         phpSha256Hash: 5a2337996f07c8a097e03d46263b5c98d2c8e355227756351421003bea8f463e
@@ -72,6 +81,7 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.0"
         phpTarGzUrl: https://www.php.net/distributions/php-8.0.30.tar.gz
         phpSha256Hash: 449d2048fcb20a314d8c218097c6d1047a9f1c5bb72aa54d5d3eba0a27a4c80c
@@ -83,6 +93,7 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.1"
         phpTarGzUrl: https://www.php.net/distributions/php-8.1.32.tar.gz
         phpSha256Hash: "4846836d1de27dbd28e89180f073531087029a77e98e8e019b7b2eddbdb1baff"
@@ -94,6 +105,7 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.2"
         phpTarGzUrl: https://www.php.net/distributions/php-8.2.31.tar.gz
         phpSha256Hash: "083c2f61cc5f527eb293c4c468a91af46a9678785957e023b2796a9db290d870"
@@ -105,6 +117,7 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.3"
         phpTarGzUrl: https://www.php.net/distributions/php-8.3.31.tar.gz
         phpSha256Hash: "4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f"
@@ -116,6 +129,7 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.4"
         phpTarGzUrl: https://www.php.net/distributions/php-8.4.22.tar.gz
         phpSha256Hash: "a012c2c9724baf214a70b41b40a7e130906b8855e54268afa5bc4ae17bc9d823"
@@ -127,6 +141,7 @@ services:
       dockerfile: php.Dockerfile
       x-bake: *bake
       args:
+        <<: *build-base
         phpVersion: "8.5"
         phpTarGzUrl: https://www.php.net/distributions/php-8.5.7.tar.gz
         phpSha256Hash: "e5eba93fd6dd3241d0e61e932eb99a3783b40568553fb0e511b660ecd863a049"