Skip to content

Commit e808feb

Browse files
jeremijeremi
committed
feat: add GitHub Actions workflows for Docker builds
- Add docker-build.yml workflow for building and pushing images - Add security-scan.yml workflow for vulnerability scanning - Configure for ACN Nexus registry (docker-push.acn.fr) - Build only for linux/amd64 platform - Add comprehensive documentation in GITHUB_ACTIONS_SETUP.md - Support Ubuntu and Debian slim variants - Include Trivy security scanning and Hadolint checks
1 parent 02b5680 commit e808feb

File tree

3 files changed

+584
-0
lines changed

3 files changed

+584
-0
lines changed

‎.github/workflows/docker-build.yml‎

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
# ABOUTME: GitHub Actions workflow for building and pushing OpenSPP Docker images
2+
# ABOUTME: Builds multi-architecture images and pushes to ACN Nexus registry
3+
4+
name: Docker Build and Push
5+
6+
on:
7+
push:
8+
branches:
9+
- main
10+
- master
11+
- develop
12+
- 'release/**'
13+
tags:
14+
- 'v*'
15+
- '[0-9]+.[0-9]+.[0-9]+'
16+
pull_request:
17+
branches:
18+
- main
19+
- master
20+
- develop
21+
workflow_dispatch:
22+
inputs:
23+
push_images:
24+
description: 'Push images to registry'
25+
required: false
26+
default: 'false'
27+
type: choice
28+
options:
29+
- 'true'
30+
- 'false'
31+
32+
env:
33+
REGISTRY: docker-push.acn.fr
34+
PUBLIC_REGISTRY: docker.acn.fr
35+
IMAGE_NAME: openspp/openspp
36+
37+
jobs:
38+
build-ubuntu:
39+
name: Build Ubuntu Image
40+
runs-on: ubuntu-latest
41+
permissions:
42+
contents: read
43+
packages: write
44+
45+
steps:
46+
- name: Checkout repository
47+
uses: actions/checkout@v4
48+
49+
- name: Set up QEMU
50+
uses: docker/setup-qemu-action@v3
51+
52+
- name: Set up Docker Buildx
53+
uses: docker/setup-buildx-action@v3
54+
55+
- name: Log in to Nexus Registry
56+
if: github.event_name != 'pull_request'
57+
uses: docker/login-action@v3
58+
with:
59+
registry: ${{ env.REGISTRY }}
60+
username: ${{ secrets.NEXUS_USERNAME }}
61+
password: ${{ secrets.NEXUS_PASSWORD }}
62+
63+
- name: Extract metadata
64+
id: meta
65+
uses: docker/metadata-action@v5
66+
with:
67+
images: |
68+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
69+
tags: |
70+
type=ref,event=branch
71+
type=ref,event=pr
72+
type=semver,pattern={{version}}
73+
type=semver,pattern={{major}}.{{minor}}
74+
type=raw,value=latest,enable={{is_default_branch}}
75+
type=raw,value=daily,enable={{is_default_branch}}
76+
type=sha,prefix={{branch}}-
77+
78+
- name: Build and push Ubuntu image
79+
uses: docker/build-push-action@v5
80+
with:
81+
context: .
82+
file: ./Dockerfile
83+
platforms: linux/amd64
84+
push: ${{ github.event_name != 'pull_request' }}
85+
tags: ${{ steps.meta.outputs.tags }}
86+
labels: ${{ steps.meta.outputs.labels }}
87+
cache-from: type=gha
88+
cache-to: type=gha,mode=max
89+
build-args: |
90+
BUILD_DATE=${{ github.event.head_commit.timestamp }}
91+
VCS_REF=${{ github.sha }}
92+
VERSION=${{ steps.meta.outputs.version }}
93+
94+
build-slim:
95+
name: Build Slim Image
96+
runs-on: ubuntu-latest
97+
permissions:
98+
contents: read
99+
packages: write
100+
101+
steps:
102+
- name: Checkout repository
103+
uses: actions/checkout@v4
104+
105+
- name: Set up QEMU
106+
uses: docker/setup-qemu-action@v3
107+
108+
- name: Set up Docker Buildx
109+
uses: docker/setup-buildx-action@v3
110+
111+
- name: Log in to Nexus Registry
112+
if: github.event_name != 'pull_request'
113+
uses: docker/login-action@v3
114+
with:
115+
registry: ${{ env.REGISTRY }}
116+
username: ${{ secrets.NEXUS_USERNAME }}
117+
password: ${{ secrets.NEXUS_PASSWORD }}
118+
119+
- name: Extract metadata
120+
id: meta
121+
uses: docker/metadata-action@v5
122+
with:
123+
images: |
124+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
125+
tags: |
126+
type=ref,event=branch,suffix=-slim
127+
type=ref,event=pr,suffix=-slim
128+
type=semver,pattern={{version}},suffix=-slim
129+
type=semver,pattern={{major}}.{{minor}},suffix=-slim
130+
type=raw,value=latest-slim,enable={{is_default_branch}}
131+
type=raw,value=daily-slim,enable={{is_default_branch}}
132+
type=sha,prefix={{branch}}-,suffix=-slim
133+
134+
- name: Build and push Slim image
135+
uses: docker/build-push-action@v5
136+
with:
137+
context: .
138+
file: ./Dockerfile.slim
139+
platforms: linux/amd64
140+
push: ${{ github.event_name != 'pull_request' }}
141+
tags: ${{ steps.meta.outputs.tags }}
142+
labels: ${{ steps.meta.outputs.labels }}
143+
cache-from: type=gha
144+
cache-to: type=gha,mode=max
145+
build-args: |
146+
BUILD_DATE=${{ github.event.head_commit.timestamp }}
147+
VCS_REF=${{ github.sha }}
148+
VERSION=${{ steps.meta.outputs.version }}
149+
150+
test-images:
151+
name: Test Docker Images
152+
needs: [build-ubuntu, build-slim]
153+
runs-on: ubuntu-latest
154+
if: github.event_name == 'pull_request'
155+
156+
steps:
157+
- name: Checkout repository
158+
uses: actions/checkout@v4
159+
160+
- name: Set up Docker Buildx
161+
uses: docker/setup-buildx-action@v3
162+
163+
- name: Build test image (Ubuntu)
164+
uses: docker/build-push-action@v5
165+
with:
166+
context: .
167+
file: ./Dockerfile
168+
load: true
169+
tags: openspp:test-ubuntu
170+
cache-from: type=gha
171+
172+
- name: Build test image (Slim)
173+
uses: docker/build-push-action@v5
174+
with:
175+
context: .
176+
file: ./Dockerfile.slim
177+
load: true
178+
tags: openspp:test-slim
179+
cache-from: type=gha
180+
181+
- name: Test Ubuntu image
182+
run: |
183+
echo "Testing Ubuntu image..."
184+
docker run --rm openspp:test-ubuntu openspp-server --version
185+
docker run --rm openspp:test-ubuntu openspp-server --help | grep -q "OpenSPP"
186+
187+
- name: Test Slim image
188+
run: |
189+
echo "Testing Slim image..."
190+
docker run --rm openspp:test-slim openspp-server --version
191+
docker run --rm openspp:test-slim openspp-server --help | grep -q "OpenSPP"
192+
193+
- name: Test health endpoint
194+
run: |
195+
echo "Starting container for health check..."
196+
docker run -d --name openspp-test -p 8069:8069 openspp:test-ubuntu
197+
sleep 60
198+
curl -f http://localhost:8069/web/health || (docker logs openspp-test && exit 1)
199+
docker stop openspp-test
200+
docker rm openspp-test
201+
202+
update-manifests:
203+
name: Update Kubernetes Manifests
204+
needs: [build-ubuntu, build-slim]
205+
runs-on: ubuntu-latest
206+
if: startsWith(github.ref, 'refs/tags/')
207+
208+
steps:
209+
- name: Checkout repository
210+
uses: actions/checkout@v4
211+
212+
- name: Update deployment manifests
213+
run: |
214+
TAG=${GITHUB_REF#refs/tags/}
215+
echo "Updating manifests for tag: $TAG"
216+
217+
# Update image tags in deployment files
218+
find deployments -name "*.yaml" -type f -exec \
219+
sed -i "s|image: .*openspp:.*|image: ${{ env.PUBLIC_REGISTRY }}/${{ env.IMAGE_NAME }}:${TAG}|g" {} \;
220+
221+
- name: Commit and push changes
222+
run: |
223+
git config --local user.email "action@github.com"
224+
git config --local user.name "GitHub Action"
225+
git add deployments/
226+
git diff --staged --quiet || git commit -m "Update deployment manifests for ${GITHUB_REF#refs/tags/}"
227+
git push
228+
229+
notify:
230+
name: Send Notifications
231+
needs: [build-ubuntu, build-slim]
232+
runs-on: ubuntu-latest
233+
if: always() && github.event_name != 'pull_request'
234+
235+
steps:
236+
- name: Notify Slack
237+
if: secrets.SLACK_WEBHOOK != ''
238+
uses: 8398a7/action-slack@v3
239+
with:
240+
status: ${{ job.status }}
241+
text: |
242+
OpenSPP Docker Build ${{ job.status }}
243+
Branch: ${{ github.ref }}
244+
Commit: ${{ github.sha }}
245+
Images pushed to: ${{ env.PUBLIC_REGISTRY }}/${{ env.IMAGE_NAME }}
246+
webhook_url: ${{ secrets.SLACK_WEBHOOK }}
247+
env:
248+
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

0 commit comments

Comments
 (0)