Skip to content

Commit 736d9f9

Browse files
brendan-kellambrendan-kellam
committed
wip
1 parent fe956b3 commit 736d9f9

4 files changed

Lines changed: 153 additions & 192 deletions

File tree

.github/workflows/publish-main-to-ghcr.yml renamed to .github/workflows/_build.yml

Lines changed: 46 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,40 @@
1-
name: Publish to ghcr
1+
# Internal reusable workflow for building multi-platform Docker images.
2+
#
3+
# This workflow builds Docker images for linux/amd64 and linux/arm64 platforms,
4+
# pushes them by digest to GHCR, signs them with cosign/Sigstore for supply chain
5+
# security, and uploads build artifacts for subsequent manifest creation.
6+
#
7+
# Used by:
8+
# - publish-main-to-ghcr.yml (for main branch builds)
9+
# - release-sourcebot.yml (for versioned releases)
210

3-
# This workflow is a modification of a example.
4-
# @ see: https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
11+
name: Build Multi-Platform Images
512

613
on:
7-
push:
8-
branches: ["main"]
14+
workflow_call:
15+
inputs:
16+
git_ref:
17+
description: "Git ref to checkout"
18+
required: true
19+
type: string
20+
docker_tags:
21+
description: "Docker tags configuration (JSON array or raw tags)"
22+
required: true
23+
type: string
24+
use_app_token:
25+
description: "Whether to use GitHub App token for checkout"
26+
required: false
27+
type: boolean
28+
default: false
29+
secrets:
30+
release_app_id:
31+
description: "GitHub App ID (required if use_app_token is true)"
32+
required: false
33+
release_app_private_key:
34+
description: "GitHub App private key (required if use_app_token is true)"
35+
required: false
936

1037
env:
11-
# Use docker.io for Docker Hub if empty
1238
REGISTRY_IMAGE: ghcr.io/sourcebot-dev/sourcebot
1339

1440
jobs:
@@ -18,8 +44,8 @@ jobs:
1844
permissions:
1945
contents: read
2046
packages: write
21-
# This is used to complete the identity challenge
22-
# with sigstore/fulcio when running outside of PRs.
47+
# Required for keyless signing with cosign/Sigstore.
48+
# Allows workflow to obtain OIDC token for ephemeral certificate from Fulcio.
2349
id-token: write
2450
strategy:
2551
matrix:
@@ -31,6 +57,14 @@ jobs:
3157
runs-on: ubuntu-24.04-arm
3258

3359
steps:
60+
- name: Generate GitHub App token
61+
if: inputs.use_app_token
62+
id: generate_token
63+
uses: actions/create-github-app-token@v1
64+
with:
65+
app-id: ${{ secrets.release_app_id }}
66+
private-key: ${{ secrets.release_app_private_key }}
67+
3468
- name: Prepare
3569
run: |
3670
platform=${{ matrix.platform }}
@@ -39,8 +73,10 @@ jobs:
3973
- name: Checkout repository
4074
uses: actions/checkout@v4
4175
with:
42-
ref: ${{ github.ref_name }}
76+
ref: ${{ inputs.git_ref }}
4377
submodules: "true"
78+
fetch-depth: 0
79+
token: ${{ inputs.use_app_token && steps.generate_token.outputs.token || github.token }}
4480

4581
# Extract metadata (tags, labels) for Docker
4682
# https://github.com/docker/metadata-action
@@ -49,6 +85,7 @@ jobs:
4985
uses: docker/metadata-action@v5
5086
with:
5187
images: ${{ env.REGISTRY_IMAGE }}
88+
tags: ${{ inputs.docker_tags }}
5289

5390
# Install the cosign tool except on PR
5491
# https://github.com/sigstore/cosign-installer
@@ -105,43 +142,4 @@ jobs:
105142
# This step uses the identity token to provision an ephemeral certificate
106143
# against the sigstore community Fulcio instance.
107144
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
108-
109-
merge:
110-
runs-on: ubuntu-latest
111-
permissions:
112-
packages: write
113-
needs:
114-
- build
115-
steps:
116-
- name: Download digests
117-
uses: actions/download-artifact@v4
118-
with:
119-
path: /tmp/digests
120-
pattern: digests-*
121-
merge-multiple: true
122-
123-
- name: Set up Docker Buildx
124-
uses: docker/setup-buildx-action@v3
125-
126-
- name: Extract Docker metadata
127-
id: meta
128-
uses: docker/metadata-action@v5
129-
with:
130-
images: ${{ env.REGISTRY_IMAGE }}
131145

132-
- name: Login to GitHub Packages Docker Registry
133-
uses: docker/login-action@v3
134-
with:
135-
registry: ghcr.io
136-
username: ${{ github.actor }}
137-
password: ${{ secrets.GITHUB_TOKEN }}
138-
139-
- name: Create manifest list and push
140-
working-directory: /tmp/digests
141-
run: |
142-
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
143-
$(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
144-
145-
- name: Inspect image
146-
run: |
147-
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}

‎.github/workflows/_merge.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Internal reusable workflow for merging platform-specific image digests into a
2+
# single multi-platform manifest and pushing to GHCR.
3+
#
4+
# This workflow takes the individual platform image digests created by _build.yml,
5+
# combines them into a multi-platform manifest, and pushes the final tagged images.
6+
#
7+
# Used by:
8+
# - publish-main-to-ghcr.yml (for main branch builds)
9+
# - release-sourcebot.yml (for versioned releases)
10+
11+
name: Merge Multi-Platform Manifest
12+
13+
on:
14+
workflow_call:
15+
inputs:
16+
docker_tags:
17+
description: "Docker tags configuration (JSON array or raw tags)"
18+
required: true
19+
type: string
20+
21+
env:
22+
REGISTRY_IMAGE: ghcr.io/sourcebot-dev/sourcebot
23+
24+
jobs:
25+
merge:
26+
runs-on: ubuntu-latest
27+
permissions:
28+
packages: write
29+
steps:
30+
- name: Download digests
31+
uses: actions/download-artifact@v4
32+
with:
33+
path: /tmp/digests
34+
pattern: digests-*
35+
merge-multiple: true
36+
37+
- name: Set up Docker Buildx
38+
uses: docker/setup-buildx-action@v3
39+
40+
- name: Extract Docker metadata
41+
id: meta
42+
uses: docker/metadata-action@v5
43+
with:
44+
images: ${{ env.REGISTRY_IMAGE }}
45+
tags: ${{ inputs.docker_tags }}
46+
47+
- name: Login to GitHub Packages Docker Registry
48+
uses: docker/login-action@v3
49+
with:
50+
registry: ghcr.io
51+
username: ${{ github.actor }}
52+
password: ${{ secrets.GITHUB_TOKEN }}
53+
54+
- name: Create manifest list and push
55+
working-directory: /tmp/digests
56+
run: |
57+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
58+
$(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
59+
60+
- name: Inspect image
61+
run: |
62+
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
63+

‎.github/workflows/release-dev.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Release Sourcebot (Development)
2+
3+
# This workflow is a modification of a example.
4+
# @ see: https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
5+
6+
on:
7+
push:
8+
branches: ["main"]
9+
10+
jobs:
11+
build:
12+
uses: ./.github/workflows/_build.yml
13+
with:
14+
git_ref: ${{ github.ref_name }}
15+
docker_tags: type=raw,value=main
16+
use_app_token: false
17+
secrets: inherit
18+
19+
publish-to-registry:
20+
needs: build
21+
uses: ./.github/workflows/_merge.yml
22+
with:
23+
docker_tags: type=raw,value=main

0 commit comments

Comments
 (0)