|
| 1 | +name: docker-compose-ci |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + tags: |
| 6 | + - 'v[0-9]+.[0-9]+.[0-9]+' # v1.2.3 |
| 7 | +permissions: |
| 8 | + contents: read |
| 9 | + packages: write |
| 10 | + id-token: write |
| 11 | + |
| 12 | +concurrency: |
| 13 | + group: docker-compose-ci-${{ github.ref }} |
| 14 | + cancel-in-progress: true |
| 15 | + |
| 16 | +env: |
| 17 | + REPO_SLUG: centralized-observability |
| 18 | + PLATFORMS: linux/amd64,linux/arm64 |
| 19 | + DOCKERHUB_NAMESPACE: "hasanjaveddeveloper" # optional mirroring |
| 20 | + PUSH_IMAGES: "true" # always push in GitHub CI |
| 21 | + ALLOW_LOCAL_PUSH: "true" # allows push when not running under act |
| 22 | + |
| 23 | +jobs: |
| 24 | + images: |
| 25 | + name: Build and Push Images (GHCR) |
| 26 | + runs-on: ubuntu-latest |
| 27 | + if: > |
| 28 | + github.event_name == 'workflow_dispatch' || |
| 29 | + startsWith(github.ref, 'refs/heads/master') || |
| 30 | + startsWith(github.ref, 'refs/tags/v') |
| 31 | + steps: |
| 32 | + # ---------- Source checkout ---------- |
| 33 | + - name: Checkout (act) |
| 34 | + if: ${{ env.ACT }} |
| 35 | + run: echo "Repo mounted by act. Skipping actions/checkout." |
| 36 | + |
| 37 | + - name: Checkout |
| 38 | + if: ${{ !env.ACT }} |
| 39 | + uses: actions/checkout@v4 |
| 40 | + with: |
| 41 | + fetch-depth: 1 |
| 42 | + |
| 43 | + # ---------- Tooling ---------- |
| 44 | + - name: Set up QEMU |
| 45 | + if: ${{ !env.ACT }} |
| 46 | + uses: docker/setup-qemu-action@v3 |
| 47 | + |
| 48 | + - name: Set up Docker Buildx |
| 49 | + if: ${{ !env.ACT }} |
| 50 | + uses: docker/setup-buildx-action@v3 |
| 51 | + |
| 52 | + - name: Bootstrap buildx (act) |
| 53 | + if: ${{ env.ACT }} |
| 54 | + run: | |
| 55 | + docker buildx create --use --driver docker --name actdocker || true |
| 56 | + docker buildx inspect --bootstrap |
| 57 | +
|
| 58 | + - name: Force single-arch for act and non-tag builds |
| 59 | + run: | |
| 60 | + if [ -n "${ACT:-}" ]; then echo "PLATFORMS=linux/amd64" >> $GITHUB_ENV; fi |
| 61 | + if [[ "${GITHUB_REF}" != refs/tags/v* ]]; then echo "PLATFORMS=linux/amd64" >> $GITHUB_ENV; fi |
| 62 | + shell: bash |
| 63 | + |
| 64 | + - name: Compute tag override lines |
| 65 | + id: tags |
| 66 | + shell: bash |
| 67 | + run: | |
| 68 | + set -euo pipefail |
| 69 | + OWNER_LC="${GITHUB_REPOSITORY_OWNER,,}" |
| 70 | + REPO_SLUG="${REPO_SLUG}" |
| 71 | + REF="${GITHUB_REF}" |
| 72 | + HUB_NS="${DOCKERHUB_NAMESPACE:-}" |
| 73 | +
|
| 74 | + add_lines() { # svc, tags... |
| 75 | + local svc="$1"; shift |
| 76 | + local -a tags=( "$@" ) |
| 77 | + for t in "${tags[@]}"; do printf '%s.tags=%s\n' "$svc" "$t"; done |
| 78 | + } |
| 79 | +
|
| 80 | + # GHCR base tags |
| 81 | + is_master=false |
| 82 | + is_tag=false |
| 83 | +
|
| 84 | + if [[ "$REF" == "refs/heads/master" ]]; then |
| 85 | + is_master=true |
| 86 | + elif [[ "$REF" == refs/tags/v* ]]; then |
| 87 | + is_tag=true |
| 88 | + fi |
| 89 | +
|
| 90 | + # Non-master, non-tag branches -> edge |
| 91 | + if ! $is_master && ! $is_tag; then |
| 92 | + user_tags+=( "ghcr.io/${OWNER_LC}/${REPO_SLUG}/userapi:edge" ) |
| 93 | + api_tags+=( "ghcr.io/${OWNER_LC}/${REPO_SLUG}/api:edge" ) |
| 94 | + web_tags+=( "ghcr.io/${OWNER_LC}/${REPO_SLUG}/web:edge" ) |
| 95 | + fi |
| 96 | +
|
| 97 | + # Master branch -> latest |
| 98 | + if $is_master; then |
| 99 | + user_tags+=( "ghcr.io/${OWNER_LC}/${REPO_SLUG}/userapi:latest" ) |
| 100 | + api_tags+=( "ghcr.io/${OWNER_LC}/${REPO_SLUG}/api:latest" ) |
| 101 | + web_tags+=( "ghcr.io/${OWNER_LC}/${REPO_SLUG}/web:latest" ) |
| 102 | + fi |
| 103 | +
|
| 104 | + # Release tags -> vX.Y.Z and X.Y (optionally also latest if you want) |
| 105 | + if $is_tag; then |
| 106 | + ver="${REF#refs/tags/}" # vX.Y.Z |
| 107 | + short="${ver#v}" # X.Y.Z |
| 108 | + minor="${short%.*}" # X.Y |
| 109 | + |
| 110 | + user_tags+=( "ghcr.io/${OWNER_LC}/${REPO_SLUG}/userapi:${ver}" ) |
| 111 | + api_tags+=( "ghcr.io/${OWNER_LC}/${REPO_SLUG}/api:${ver}" ) |
| 112 | + web_tags+=( "ghcr.io/${OWNER_LC}/${REPO_SLUG}/web:${ver}" ) |
| 113 | + |
| 114 | + fi |
| 115 | +
|
| 116 | + # Docker Hub mirrors (optional, only if namespace present) |
| 117 | + if [[ -n "$HUB_NS" ]]; then |
| 118 | + hub_user=( "${user_tags[@]/#ghcr.io\/${OWNER_LC}\/${REPO_SLUG}\/userapi:/docker.io/${HUB_NS}/${REPO_SLUG}-userapi:}" ) |
| 119 | + hub_api=( "${api_tags[@]/#ghcr.io\/${OWNER_LC}\/${REPO_SLUG}\/api:/docker.io/${HUB_NS}/${REPO_SLUG}-api:}" ) |
| 120 | + hub_web=( "${web_tags[@]/#ghcr.io\/${OWNER_LC}\/${REPO_SLUG}\/web:/docker.io/${HUB_NS}/${REPO_SLUG}-web:}" ) |
| 121 | + user_tags+=( "${hub_user[@]}" ) |
| 122 | + api_tags+=( "${hub_api[@]}" ) |
| 123 | + web_tags+=( "${hub_web[@]}" ) |
| 124 | + fi |
| 125 | +
|
| 126 | + { |
| 127 | + echo "user_set<<EOF"; add_lines userapi "${user_tags[@]}"; echo "EOF" |
| 128 | + echo "api_set<<EOF"; add_lines api "${api_tags[@]}"; echo "EOF" |
| 129 | + echo "web_set<<EOF"; add_lines web "${web_tags[@]}"; echo "EOF" |
| 130 | + } >> "$GITHUB_OUTPUT" |
| 131 | +
|
| 132 | + # ---------- GHCR login ---------- |
| 133 | + - name: Login to GHCR (act) |
| 134 | + if: ${{ env.ACT }} |
| 135 | + shell: bash |
| 136 | + run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.repository_owner }}" --password-stdin |
| 137 | + |
| 138 | + - name: Login to GHCR |
| 139 | + if: ${{ !env.ACT }} |
| 140 | + uses: docker/login-action@v3 |
| 141 | + with: |
| 142 | + registry: ghcr.io |
| 143 | + username: ${{ github.repository_owner }} |
| 144 | + password: ${{ secrets.GITHUB_TOKEN }} |
| 145 | + |
| 146 | + # ACT: login to Docker Hub via CLI |
| 147 | + - name: Login to Docker Hub (act) |
| 148 | + shell: bash |
| 149 | + run: echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin |
| 150 | + |
| 151 | + # GitHub CI: login action |
| 152 | + - name: Login to Docker Hub |
| 153 | + uses: docker/login-action@v3 |
| 154 | + with: |
| 155 | + username: ${{ secrets.DOCKERHUB_USERNAME }} |
| 156 | + password: ${{ secrets.DOCKERHUB_TOKEN }} |
| 157 | + |
| 158 | + # ---------- ACT: CLI bake (avoids dial-stdio) ---------- |
| 159 | + - name: Bake (ACT) |
| 160 | + if: ${{ env.ACT }} |
| 161 | + shell: bash |
| 162 | + env: |
| 163 | + DO_PUSH: ${{ env.PUSH_IMAGES == 'true' && env.ALLOW_LOCAL_PUSH == 'true' && 'true' || 'false' }} |
| 164 | + run: | |
| 165 | + set -euo pipefail |
| 166 | + COMMON_SET=( |
| 167 | + "--set" "*.platform=${PLATFORMS}" |
| 168 | + "--set" "*.labels.org.opencontainers.image.revision=${GITHUB_SHA}" |
| 169 | + ) |
| 170 | + while IFS= read -r l; do COMMON_SET+=( "--set" "$l" ); done <<< "${{ steps.tags.outputs.user_set }}" |
| 171 | + while IFS= read -r l; do COMMON_SET+=( "--set" "$l" ); done <<< "${{ steps.tags.outputs.api_set }}" |
| 172 | + while IFS= read -r l; do COMMON_SET+=( "--set" "$l" ); done <<< "${{ steps.tags.outputs.web_set }}" |
| 173 | +
|
| 174 | + if [ "$DO_PUSH" = "true" ]; then |
| 175 | + docker buildx bake -f ./docker-bake.hcl "${COMMON_SET[@]}" --push |
| 176 | + else |
| 177 | + docker buildx bake -f ./docker-bake.hcl "${COMMON_SET[@]}" --load |
| 178 | + fi |
| 179 | +
|
| 180 | + # ---------- GitHub CI: bake action ---------- |
| 181 | + - name: Bake and Push (GitHub) |
| 182 | + if: ${{ !env.ACT }} |
| 183 | + uses: docker/bake-action@v5 |
| 184 | + with: |
| 185 | + files: ./docker-bake.hcl |
| 186 | + push: ${{ env.PUSH_IMAGES == 'true' }} |
| 187 | + set: | |
| 188 | + *.platform=${{ env.PLATFORMS }} |
| 189 | + *.labels.org.opencontainers.image.revision=${{ github.sha }} |
| 190 | + ${{ steps.tags.outputs.user_set }} |
| 191 | + ${{ steps.tags.outputs.api_set }} |
| 192 | + ${{ steps.tags.outputs.web_set }} |
0 commit comments