Mirror Container Image (ghcr.io/astral-sh/uv:0.11.19, attempt #1) #104
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Mirror Container Image | |
| run-name: | | |
| Mirror Container Image (${{ inputs.image-repository-uri }}:${{ inputs.image-index-manifest-tag }}, attempt #${{ github.run_attempt }}) | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| image-repository-uri: | |
| description: | | |
| The image repository URI, like registry.k8s.io/git-sync/git-sync | |
| type: choice | |
| options: | |
| - registry.k8s.io/sig-storage/csi-node-driver-registrar | |
| - registry.k8s.io/sig-storage/csi-provisioner | |
| - registry.k8s.io/git-sync/git-sync | |
| - registry-1.docker.io/library/golang | |
| - registry-1.docker.io/dxflrs/garage | |
| - ghcr.io/astral-sh/uv | |
| image-index-manifest-tag: | |
| description: | | |
| The image index manifest tag, like 1.0.14 or v1.0.14 | |
| type: string | |
| required: true | |
| # TODO (@NickLarsenNZ): Combine this with the source image above | |
| # So that we don't have to remember which project for which mirrored image | |
| # Note that each project has a different credential | |
| destination-project: | |
| description: | | |
| Destination project in Harbor | |
| type: choice | |
| options: | |
| - sdp | |
| - stackable | |
| permissions: {} | |
| jobs: | |
| mirror-image: | |
| # even though we are dealing with multi-arch images, we can do all | |
| # operations from one arch. | |
| name: Mirror image (${{ matrix.arch }}) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| arch: | |
| - amd64 | |
| - arm64 | |
| steps: | |
| - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Pull container image | |
| shell: bash | |
| env: | |
| IMAGE_INDEX_MANIFEST_TAG: ${{ inputs.image-index-manifest-tag }} | |
| IMAGE_REPOSITORY_URI: ${{ inputs.image-repository-uri }} | |
| run: | | |
| docker pull \ | |
| --quiet \ | |
| --platform ${{ matrix.arch }} \ | |
| "$IMAGE_REPOSITORY_URI:$IMAGE_INDEX_MANIFEST_TAG" | |
| - name: Extract Repo Name | |
| env: | |
| IMAGE_REPOSITORY_URI: ${{ inputs.image-repository-uri }} | |
| run: | | |
| echo "IMAGE_REPOSITORY=$(.scripts/get_repo_name.sh)" | tee -a "$GITHUB_ENV" | |
| - name: Publish Container Image on oci.stackable.tech/sdp | |
| if: inputs.destination-project == 'sdp' | |
| uses: stackabletech/actions/publish-image@1b8db26b7406c66a7ab74e344a9e54edb2bc2690 # v0.14.3 | |
| with: | |
| image-registry-uri: oci.stackable.tech | |
| image-registry-username: robot$sdp+github-action-build | |
| image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }} | |
| image-repository: ${{ format('sdp/{0}', env.IMAGE_REPOSITORY) }} | |
| image-manifest-tag: ${{ format('{0}-{1}', inputs.image-index-manifest-tag, matrix.arch) }} | |
| source-image-uri: ${{ format('{0}:{1}', inputs.image-repository-uri, inputs.image-index-manifest-tag) }} | |
| - name: Publish Container Image on oci.stackable.tech/stackable | |
| if: inputs.destination-project == 'stackable' | |
| uses: stackabletech/actions/publish-image@8a8085be0a8cec3d24ad3970e602d65be487da6a # v0.14.1 | |
| with: | |
| image-registry-uri: oci.stackable.tech | |
| image-registry-username: robot$stackable+github-action-build | |
| image-registry-password: ${{ secrets.HARBOR_ROBOT_STACKABLE_GITHUB_ACTION_BUILD_SECRET }} | |
| image-repository: ${{ format('stackable/{0}', env.IMAGE_REPOSITORY) }} | |
| image-manifest-tag: ${{ format('{0}-{1}', inputs.image-index-manifest-tag, matrix.arch) }} | |
| source-image-uri: ${{ format('{0}:{1}', inputs.image-repository-uri, inputs.image-index-manifest-tag) }} | |
| publish_manifests: | |
| name: Build/Publish Image Index Manifest | |
| needs: [mirror-image] | |
| permissions: | |
| id-token: write | |
| contents: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Extract Repo Name | |
| env: | |
| IMAGE_REPOSITORY_URI: ${{ inputs.image-repository-uri }} | |
| run: | | |
| echo "IMAGE_REPOSITORY=$(.scripts/get_repo_name.sh)" | tee -a "$GITHUB_ENV" | |
| - name: Publish and Sign Image Index Manifest to oci.stackable.tech/sdp | |
| if: inputs.destination-project == 'sdp' | |
| uses: stackabletech/actions/publish-image-index-manifest@1b8db26b7406c66a7ab74e344a9e54edb2bc2690 # v0.14.3 | |
| with: | |
| image-registry-uri: oci.stackable.tech | |
| image-registry-username: robot$sdp+github-action-build | |
| image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }} | |
| image-repository: ${{ format('sdp/{0}', env.IMAGE_REPOSITORY) }} | |
| image-index-manifest-tag: ${{ inputs.image-index-manifest-tag }} | |
| - name: Publish and Sign Image Index Manifest to oci.stackable.tech/stackable | |
| if: inputs.destination-project == 'stackable' | |
| uses: stackabletech/actions/publish-image-index-manifest@8a8085be0a8cec3d24ad3970e602d65be487da6a # v0.14.1 | |
| with: | |
| image-registry-uri: oci.stackable.tech | |
| image-registry-username: robot$stackable+github-action-build | |
| image-registry-password: ${{ secrets.HARBOR_ROBOT_STACKABLE_GITHUB_ACTION_BUILD_SECRET }} | |
| image-repository: ${{ format('stackable/{0}', env.IMAGE_REPOSITORY) }} | |
| image-index-manifest-tag: ${{ inputs.image-index-manifest-tag }} | |
| # NOTE (@Techassi) It is currently not possible to use our own action here, because the inputs | |
| # assume it is used to report on image build results, not mirror results. The action needs to be | |
| # adjusted to support other use-cases. | |
| notify: | |
| name: Failure Notification | |
| needs: [mirror-image, publish_manifests] | |
| runs-on: ubuntu-latest | |
| if: failure() | |
| steps: | |
| - uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0 | |
| with: | |
| channel-id: "C07UG6JH44F" # notifications-container-images | |
| payload: | | |
| { | |
| "text": "*${{ github.workflow }}* failed (attempt ${{ github.run_attempt }})", | |
| "attachments": [ | |
| { | |
| "pretext": "See the details below for a summary of which job(s) failed.", | |
| "color": "#aa0000", | |
| "fields": [ | |
| { | |
| "title": "Mirror Image", | |
| "short": true, | |
| "value": "${{ needs.mirror-image.result }}" | |
| }, | |
| { | |
| "title": "Build/Publish Manifests", | |
| "short": true, | |
| "value": "${{ needs.publish_manifests.result }}" | |
| } | |
| ], | |
| "actions": [ | |
| { | |
| "type": "button", | |
| "text": "Go to workflow run", | |
| "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| env: | |
| SLACK_BOT_TOKEN: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }} |