Use the Docker image built by GitLab CI for GitHub jobs (#47)

At the time of writing, the Docker image used for GitHub CI jobs cannot
be built anymore:

It should be done with `make push-ci-images`.
But this fails because the base image
`public.ecr.aws/b1o7r7e0/nginx_musl_toolchain:latest` is no more
available.

To fix this, let's rather use the Docker image built by the GitLab CI.

This is documented in the different GitHub jobs configuration files and
in the `Makefile`.

Author: xlamorlette-datadog

.github/workflows/dev.yml

@@ -19,7 +19,8 @@ jobs:
     needs: format
     runs-on: ubuntu-22.04
     container:
-      image: datadog/docker-library:httpd-datadog-ci-2.4-cdb3cb2
+      # See in Makefile where this image comes from.
+      image: datadog/docker-library:httpd-datadog-ci-28219c0ef3e00f1e3d5afcab61a73a5e9bd2a9b957d7545556711cce2a6262cd
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
@@ -43,7 +44,8 @@ jobs:
     needs: build
     runs-on: ubuntu-22.04
     container:
-      image: datadog/docker-library:httpd-datadog-ci-2.4-cdb3cb2
+      # See in Makefile where this image comes from.
+      image: datadog/docker-library:httpd-datadog-ci-28219c0ef3e00f1e3d5afcab61a73a5e9bd2a9b957d7545556711cce2a6262cd
     env:
       DD_ENV: ci
       DD_API_KEY: ${{ secrets.DD_API_KEY_CI_APP }}
@@ -66,7 +68,7 @@ jobs:
         run: pytest --ddtrace test/integration-test --module-path dist/lib/mod_datadog.so --bin-path /httpd/httpd-build/bin/apachectl --log-dir $(pwd)/logs -m ci
       - name: Generate code coverage
         run: |
-          llvm-profdata merge -sparse /tmp/*.profraw -o /tmp/default.profdata 
+          llvm-profdata merge -sparse /tmp/*.profraw -o /tmp/default.profdata
           llvm-cov export dist/lib/mod_datadog.so -format=lcov -instr-profile=/tmp/default.profdata -ignore-filename-regex=/httpd/ > coverage.lcov
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
@@ -76,4 +78,3 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: DataDog/httpd-datadog
           fail_ci_if_error: true
-

.github/workflows/release.yml

@@ -5,7 +5,8 @@ jobs:
   build:
     runs-on: ubuntu-22.04
     container:
-      image: datadog/docker-library:httpd-datadog-ci-2.4-cdb3cb2
+      # See in Makefile where this image comes from.
+      image: datadog/docker-library:httpd-datadog-ci-28219c0ef3e00f1e3d5afcab61a73a5e9bd2a9b957d7545556711cce2a6262cd
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:

.github/workflows/system-tests.yml

@@ -19,7 +19,8 @@ jobs:
   build-artifacts:
     runs-on: ubuntu-22.04
     container:
-      image: datadog/docker-library:httpd-datadog-ci-2.4-cdb3cb2
+      # See in Makefile where this image comes from.
+      image: datadog/docker-library:httpd-datadog-ci-28219c0ef3e00f1e3d5afcab61a73a5e9bd2a9b957d7545556711cce2a6262cd
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:

.gitlab-ci.yml

@@ -73,6 +73,7 @@ build-ci-image:
           --push \
           --file .gitlab/Dockerfile \
           .
+        echo "Image $IMAGE_TAG built for $ARCH."
       fi
   artifacts:
     reports:

.gitlab/Dockerfile

@@ -78,9 +78,11 @@ RUN clang --sysroot /sysroot/${ARCH}-none-linux-musl/ -fpie -O2 -fno-omit-frame-
     ar rcs /sysroot/${ARCH}-none-linux-musl/usr/lib/libglibc_compat.a /tmp/glibc_compat.o && \
     rm /tmp/glibc_compat.o
 
-
 # Install dependencies for httpd
-RUN apk add --no-cache expat expat-dev autoconf libtool py-pip gpg gpg-agent pcre-dev pcre2-dev zip
+RUN apk add --no-cache autoconf expat expat-dev gpg gpg-agent libtool pcre-dev pcre2-dev py-pip zip
+
+# Install dependencies for code coverage upload
+RUN apk add --no-cache nodejs npm
 
 # Install Rust toolchain
 RUN apk add --no-cache curl
@@ -90,7 +92,7 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -yq --d
 RUN cargo install --locked cbindgen --version 0.26.0 \
   && ln -s ~/.cargo/bin/cbindgen /usr/local/bin/cbindgen
 
-# Install uv (fast Python package manager)
+# Install uv (Python package manager)
 COPY --from=ghcr.io/astral-sh/uv:0.9.28 /uv /usr/local/bin/uv
 
 # Setup httpd 2.4 source

Dockerfile

@@ -1,13 +1,17 @@
-COMMIT_SHA ?= $(shell git rev-parse --short HEAD)
-DOCKER_REPO ?= datadog/docker-library
+# The CI image used for some GitHub jobs is built by the GitLab build-ci-image job.
+# The hash is computed by this GitLab job from the files used to build the image.
+#
+# Whenever this image needs to be updated, one should:
+#   - Get the hash from a run of the GitLab build-ci-image job.
+#   - Copy this hash here, and in the GitHub workflow files.
+#   - Run: make replicate-ci-image-for-github.
 
-.PHONY: push-ci-images
-push-ci-images:
-	docker build --progress=plain --platform linux/amd64 -t $(DOCKER_REPO):httpd-datadog-ci-2.4-$(COMMIT_SHA)-amd64 .
-	docker push $(DOCKER_REPO):httpd-datadog-ci-2.4-$(COMMIT_SHA)-amd64
-	docker build --progress=plain --platform linux/arm64 -t $(DOCKER_REPO):httpd-datadog-ci-2.4-$(COMMIT_SHA)-arm64 .
-	docker push $(DOCKER_REPO):httpd-datadog-ci-2.4-$(COMMIT_SHA)-arm64
-	docker buildx imagetools create -t $(DOCKER_REPO):httpd-datadog-ci-2.4-$(COMMIT_SHA) \
-			$(DOCKER_REPO):httpd-datadog-ci-2.4-$(COMMIT_SHA)-amd64 \
-			$(DOCKER_REPO):httpd-datadog-ci-2.4-$(COMMIT_SHA)-arm64
-	docker push $(DOCKER_REPO):httpd-datadog-ci-2.4-$(COMMIT_SHA)
+CI_DOCKER_IMAGE_HASH ?= 28219c0ef3e00f1e3d5afcab61a73a5e9bd2a9b957d7545556711cce2a6262cd
+CI_IMAGE_FROM_GITLAB ?= registry.ddbuild.io/ci/httpd-datadog/amd64:$(CI_DOCKER_IMAGE_HASH)
+CI_IMAGE_IN_PUBLIC_REPO_FOR_GITHUB ?= datadog/docker-library:httpd-datadog-ci-$(CI_DOCKER_IMAGE_HASH)
+
+.PHONY: replicate-ci-image-for-github
+replicate-ci-image-for-github:
+	docker pull $(CI_IMAGE_FROM_GITLAB)
+	docker tag $(CI_IMAGE_FROM_GITLAB) $(CI_IMAGE_IN_PUBLIC_REPO_FOR_GITHUB)
+	docker push $(CI_IMAGE_IN_PUBLIC_REPO_FOR_GITHUB)