Fix dind: normalize os-release before features + in published image (… #108
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push | |
| on: | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "VERSION" | |
| - "Dockerfile" | |
| - "docker/**" | |
| - "requirements.txt" | |
| - ".devcontainer/**" | |
| - ".github/workflows/build-push.yaml" | |
| push: | |
| branches: [main] | |
| paths: | |
| - "VERSION" | |
| - "Dockerfile" | |
| - "docker/**" | |
| - "requirements.txt" | |
| - ".devcontainer/**" | |
| - ".github/workflows/build-push.yaml" | |
| workflow_dispatch: | |
| inputs: | |
| build_amd64: | |
| description: "Release: push linux/amd64 (uncheck to skip). PRs always test both arches in parallel." | |
| type: boolean | |
| default: true | |
| build_arm64: | |
| description: "Release: push linux/arm64 (uncheck to skip). PRs always test both arches in parallel." | |
| type: boolean | |
| default: true | |
| permissions: | |
| contents: "read" | |
| id-token: "write" | |
| security-events: "write" | |
| actions: "read" | |
| packages: "write" | |
| env: | |
| IMAGE: codecollection-devtools | |
| DEFAULT_BRANCH: "origin/${{ github.event.repository.default_branch }}" | |
| SHARED_ARTIFACT_REPOSITORY_PATH: "us-docker.pkg.dev/runwhen-nonprod-shared/public-images" | |
| GHCR_ORG: "runwhen-contrib" | |
| jobs: | |
| # ------------------------------------------------------------------------------ | |
| # PR: parallel build tests (native amd64; arm64 via QEMU) | |
| # ------------------------------------------------------------------------------ | |
| build-test-amd64: | |
| if: ${{ github.event_name == 'pull_request' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Build test (linux/amd64) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| platforms: linux/amd64 | |
| push: false | |
| load: true | |
| tags: codecollection-devtools:pr-test-amd64 | |
| build-test-arm64: | |
| if: ${{ github.event_name == 'pull_request' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-qemu-action@v3 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Build test (linux/arm64) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| platforms: linux/arm64 | |
| push: false | |
| tags: codecollection-devtools:pr-test-arm64 | |
| # ------------------------------------------------------------------------------ | |
| # Release: shared VERSION for per-arch pushes + manifest merge | |
| # ------------------------------------------------------------------------------ | |
| prepare-release: | |
| if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }} | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.version.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - id: version | |
| run: | | |
| if [[ -s VERSION ]]; then | |
| VERSION=$(cat VERSION | tr -d '[:space:]') | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| echo "VERSION=$VERSION" >> "$GITHUB_ENV" | |
| echo "VERSION extracted: $VERSION" | |
| else | |
| echo "VERSION file is missing or empty" >&2 | |
| exit 1 | |
| fi | |
| build-push-amd64: | |
| needs: [prepare-release] | |
| if: | | |
| (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && | |
| (github.event_name == 'push' || github.event.inputs.build_amd64 == 'true') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - id: auth-runwhen | |
| name: Authenticate to Google Cloud | |
| uses: google-github-actions/auth@v0.4.0 | |
| with: | |
| workload_identity_provider: ${{ secrets.RUNWHEN_NONPROD_SHARED_WI_PROVIDER }} | |
| service_account: ${{ secrets.RUNWHEN_NONPROD_SHARED_WI_SA }} | |
| - name: Configure docker for GCP | |
| run: gcloud --quiet auth configure-docker us-docker.pkg.dev | |
| - name: Login to GHCR | |
| run: | | |
| echo "${{ secrets.GITHUB_TOKEN }}" | \ | |
| docker login --username ${{ github.actor }} --password-stdin ghcr.io | |
| - name: Build & push (linux/amd64) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| tags: | | |
| ${{ env.SHARED_ARTIFACT_REPOSITORY_PATH }}/${{ env.IMAGE }}:${{ needs.prepare-release.outputs.version }}-amd64 | |
| ghcr.io/${{ env.GHCR_ORG }}/${{ env.IMAGE }}:${{ needs.prepare-release.outputs.version }}-amd64 | |
| build-args: | | |
| GITHUB_SHA=${{ github.sha }} | |
| GITHUB_REF=${{ github.ref }} | |
| build-push-arm64: | |
| needs: [prepare-release] | |
| if: | | |
| (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && | |
| (github.event_name == 'push' || github.event.inputs.build_arm64 == 'true') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-qemu-action@v3 | |
| - uses: docker/setup-buildx-action@v3 | |
| - id: auth-runwhen | |
| name: Authenticate to Google Cloud | |
| uses: google-github-actions/auth@v0.4.0 | |
| with: | |
| workload_identity_provider: ${{ secrets.RUNWHEN_NONPROD_SHARED_WI_PROVIDER }} | |
| service_account: ${{ secrets.RUNWHEN_NONPROD_SHARED_WI_SA }} | |
| - name: Configure docker for GCP | |
| run: gcloud --quiet auth configure-docker us-docker.pkg.dev | |
| - name: Login to GHCR | |
| run: | | |
| echo "${{ secrets.GITHUB_TOKEN }}" | \ | |
| docker login --username ${{ github.actor }} --password-stdin ghcr.io | |
| - name: Build & push (linux/arm64) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| platforms: linux/arm64 | |
| push: true | |
| tags: | | |
| ${{ env.SHARED_ARTIFACT_REPOSITORY_PATH }}/${{ env.IMAGE }}:${{ needs.prepare-release.outputs.version }}-arm64 | |
| ghcr.io/${{ env.GHCR_ORG }}/${{ env.IMAGE }}:${{ needs.prepare-release.outputs.version }}-arm64 | |
| build-args: | | |
| GITHUB_SHA=${{ github.sha }} | |
| GITHUB_REF=${{ github.ref }} | |
| merge-manifests: | |
| needs: [prepare-release, build-push-amd64, build-push-arm64] | |
| if: | | |
| always() && !cancelled() && | |
| needs.prepare-release.result == 'success' && | |
| ( | |
| (github.event_name == 'push' && | |
| needs.build-push-amd64.result == 'success' && | |
| needs.build-push-arm64.result == 'success') || | |
| (github.event_name == 'workflow_dispatch' && | |
| (needs.build-push-amd64.result == 'success' || needs.build-push-arm64.result == 'success')) | |
| ) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - id: auth-runwhen | |
| name: Authenticate to Google Cloud | |
| uses: google-github-actions/auth@v0.4.0 | |
| with: | |
| workload_identity_provider: ${{ secrets.RUNWHEN_NONPROD_SHARED_WI_PROVIDER }} | |
| service_account: ${{ secrets.RUNWHEN_NONPROD_SHARED_WI_SA }} | |
| - name: Configure docker for GCP | |
| run: gcloud --quiet auth configure-docker us-docker.pkg.dev | |
| - name: Login to GHCR | |
| run: | | |
| echo "${{ secrets.GITHUB_TOKEN }}" | \ | |
| docker login --username ${{ github.actor }} --password-stdin ghcr.io | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Merge multi-arch manifests (GCP + GHCR) | |
| env: | |
| V: ${{ needs.prepare-release.outputs.version }} | |
| GCP_BASE: ${{ env.SHARED_ARTIFACT_REPOSITORY_PATH }}/${{ env.IMAGE }} | |
| GHCR_BASE: ghcr.io/${{ env.GHCR_ORG }}/${{ env.IMAGE }} | |
| AMD64_OK: ${{ needs.build-push-amd64.result }} | |
| ARM64_OK: ${{ needs.build-push-arm64.result }} | |
| run: | | |
| set -euo pipefail | |
| GCP_REF=() | |
| GHCR_REF=() | |
| if [[ "$AMD64_OK" == "success" ]]; then | |
| GCP_REF+=("${GCP_BASE}:${V}-amd64") | |
| GHCR_REF+=("${GHCR_BASE}:${V}-amd64") | |
| fi | |
| if [[ "$ARM64_OK" == "success" ]]; then | |
| GCP_REF+=("${GCP_BASE}:${V}-arm64") | |
| GHCR_REF+=("${GHCR_BASE}:${V}-arm64") | |
| fi | |
| docker buildx imagetools create \ | |
| -t "${GCP_BASE}:${V}" -t "${GCP_BASE}:latest" \ | |
| "${GCP_REF[@]}" | |
| docker buildx imagetools create \ | |
| -t "${GHCR_BASE}:${V}" -t "${GHCR_BASE}:latest" \ | |
| "${GHCR_REF[@]}" | |
| - name: Notify Slack of Container Build | |
| uses: slackapi/slack-github-action@v1.19.0 | |
| with: | |
| channel-id: "#notifications" | |
| slack-message: "Just Pushed to ${{ env.SHARED_ARTIFACT_REPOSITORY_PATH }}/${{ env.IMAGE }}:${{ needs.prepare-release.outputs.version }}" | |
| env: | |
| SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} | |
| - name: Notify Slack of GHCR Push | |
| uses: slackapi/slack-github-action@v1.19.0 | |
| with: | |
| channel-id: "#codecollections" | |
| slack-message: "Just deployed latest version of codecollection-devtools to https://github.com/orgs/runwhen-contrib/packages/container/package/codecollection-devtools" | |
| env: | |
| SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} |