|
1 | 1 | --- |
2 | | -name: Base Container Image |
| 2 | +name: Container Images Releasing |
3 | 3 |
|
4 | 4 | on: |
5 | 5 | push: |
| 6 | + tags: |
| 7 | + - 'v[6-9].**' |
6 | 8 | branches: |
7 | 9 | - 'develop' |
8 | | - - 'master' |
| 10 | + # "Path filters are not evaluated for pushes of tags" https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore |
9 | 11 | paths: |
10 | 12 | - 'modules/container-base/**' |
| 13 | + - '!modules/container-base/src/backports/**' |
| 14 | + - '!modules/container-base/README.md' |
11 | 15 | - 'modules/dataverse-parent/pom.xml' |
12 | 16 | - '.github/workflows/container_base_push.yml' |
13 | | - pull_request: |
14 | | - branches: |
15 | | - - 'develop' |
16 | | - - 'master' |
17 | | - paths: |
18 | | - - 'modules/container-base/**' |
19 | | - - 'modules/dataverse-parent/pom.xml' |
20 | | - - '.github/workflows/container_base_push.yml' |
21 | | - schedule: |
22 | | - - cron: '23 3 * * 0' # Run for 'develop' every Sunday at 03:23 UTC |
| 17 | + |
| 18 | + # These TODOs are left for #10618 |
| 19 | + # TODO: we are missing a workflow_call option here, so we can trigger this flow from pr comments and maven tests (keep the secrets availability in mind!) |
| 20 | + # TODO: we are missing a pull_request option here (filter for stuff that would trigger the maven runs!) so we can trigger preview builds for them when coming from the main repo (keep the secrets availability in mind!) |
23 | 21 |
|
24 | 22 | env: |
25 | | - IMAGE_TAG: unstable |
26 | 23 | PLATFORMS: linux/amd64,linux/arm64 |
| 24 | + DEVELOPMENT_BRANCH: develop |
27 | 25 |
|
28 | 26 | jobs: |
29 | 27 | build: |
30 | | - name: Build image |
| 28 | + name: Base Image |
31 | 29 | runs-on: ubuntu-latest |
32 | 30 | permissions: |
33 | 31 | contents: read |
34 | 32 | packages: read |
35 | | - strategy: |
36 | | - matrix: |
37 | | - jdk: [ '17' ] |
38 | 33 | # Only run in upstream repo - avoid unnecessary runs in forks |
39 | 34 | if: ${{ github.repository_owner == 'IQSS' }} |
| 35 | + outputs: |
| 36 | + base-image-ref: ${{ steps.finalize.outputs.base-image-ref }} |
40 | 37 |
|
41 | 38 | steps: |
42 | | - - name: Checkout repository |
43 | | - uses: actions/checkout@v3 |
44 | | - |
45 | | - - name: Set up JDK ${{ matrix.jdk }} |
46 | | - uses: actions/setup-java@v3 |
| 39 | + - name: Checkout and Setup Maven |
| 40 | + uses: IQSS/dataverse/.github/actions/setup-maven@develop |
47 | 41 | with: |
48 | | - java-version: ${{ matrix.jdk }} |
49 | | - distribution: 'adopt' |
50 | | - - name: Cache Maven packages |
51 | | - uses: actions/cache@v3 |
52 | | - with: |
53 | | - path: ~/.m2 |
54 | | - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} |
55 | | - restore-keys: ${{ runner.os }}-m2 |
56 | | - |
57 | | - - name: Build base container image with local architecture |
58 | | - run: mvn -f modules/container-base -Pct package |
| 42 | + pom-paths: modules/container-base/pom.xml |
59 | 43 |
|
60 | | - # Run anything below only if this is not a pull request. |
61 | | - # Accessing, pushing tags etc. to DockerHub will only succeed in upstream because secrets. |
62 | | - |
63 | | - - if: ${{ github.event_name == 'push' && github.ref_name == 'develop' }} |
64 | | - name: Push description to DockerHub |
65 | | - uses: peter-evans/dockerhub-description@v3 |
| 44 | + # Note: Accessing, pushing tags etc. to DockerHub will only succeed in upstream and |
| 45 | + # on events in context of upstream because secrets. PRs run in context of forks by default! |
| 46 | + - name: Log in to the Container registry |
| 47 | + uses: docker/login-action@v3 |
66 | 48 | with: |
67 | 49 | username: ${{ secrets.DOCKERHUB_USERNAME }} |
68 | 50 | password: ${{ secrets.DOCKERHUB_TOKEN }} |
69 | | - repository: gdcc/base |
70 | | - short-description: "Dataverse Base Container image providing Payara application server and optimized configuration" |
71 | | - readme-filepath: ./modules/container-base/README.md |
72 | 51 |
|
73 | | - - if: ${{ github.event_name != 'pull_request' }} |
74 | | - name: Log in to the Container registry |
75 | | - uses: docker/login-action@v2 |
| 52 | + # In case this is a push to develop, we care about buildtime. |
| 53 | + # Configure a remote ARM64 build host in addition to the local AMD64 in two steps. |
| 54 | + - name: Setup SSH agent |
| 55 | + if: ${{ github.event_name != 'schedule' }} |
| 56 | + uses: webfactory/ssh-agent@v0.9.0 |
76 | 57 | with: |
77 | | - registry: ${{ env.REGISTRY }} |
78 | | - username: ${{ secrets.DOCKERHUB_USERNAME }} |
79 | | - password: ${{ secrets.DOCKERHUB_TOKEN }} |
80 | | - - if: ${{ github.event_name != 'pull_request' }} |
81 | | - name: Set up QEMU for multi-arch builds |
82 | | - uses: docker/setup-qemu-action@v2 |
83 | | - - name: Re-set image tag based on branch |
84 | | - if: ${{ github.ref_name == 'master' }} |
85 | | - run: echo "IMAGE_TAG=alpha" >> $GITHUB_ENV |
86 | | - - if: ${{ github.event_name != 'pull_request' }} |
87 | | - name: Deploy multi-arch base container image to Docker Hub |
88 | | - run: mvn -f modules/container-base -Pct deploy -Dbase.image.tag=${{ env.IMAGE_TAG }} -Ddocker.platforms=${{ env.PLATFORMS }} |
| 58 | + ssh-private-key: ${{ secrets.BUILDER_ARM64_SSH_PRIVATE_KEY }} |
| 59 | + - name: Provide the known hosts key and the builder config |
| 60 | + if: ${{ github.event_name != 'schedule' }} |
| 61 | + run: | |
| 62 | + echo "${{ secrets.BUILDER_ARM64_SSH_HOST_KEY }}" > ~/.ssh/known_hosts |
| 63 | + mkdir -p modules/container-base/target/buildx-state/buildx/instances |
| 64 | + cat > modules/container-base/target/buildx-state/buildx/instances/maven << EOF |
| 65 | + { "Name": "maven", |
| 66 | + "Driver": "docker-container", |
| 67 | + "Dynamic": false, |
| 68 | + "Nodes": [{"Name": "maven0", |
| 69 | + "Endpoint": "unix:///var/run/docker.sock", |
| 70 | + "Platforms": [{"os": "linux", "architecture": "amd64"}], |
| 71 | + "DriverOpts": null, |
| 72 | + "Flags": ["--allow-insecure-entitlement=network.host"], |
| 73 | + "Files": null}, |
| 74 | + {"Name": "maven1", |
| 75 | + "Endpoint": "ssh://${{ secrets.BUILDER_ARM64_SSH_CONNECTION }}", |
| 76 | + "Platforms": [{"os": "linux", "architecture": "arm64"}], |
| 77 | + "DriverOpts": null, |
| 78 | + "Flags": ["--allow-insecure-entitlement=network.host"], |
| 79 | + "Files": null}]} |
| 80 | + EOF |
| 81 | +
|
| 82 | + # Determine the base image name we are going to use from here on |
| 83 | + - name: Determine base image name |
| 84 | + run: | |
| 85 | + if [[ "${{ github.ref_name }}" = "${{ env.DEVELOPMENT_BRANCH }}" ]]; then |
| 86 | + echo "BASE_IMAGE=$( mvn initialize help:evaluate -Pct -f modules/container-base -Dexpression=base.image -q -DforceStdout )" | tee -a "${GITHUB_ENV}" |
| 87 | + echo "BASE_IMAGE_UPCOMING=$( mvn initialize help:evaluate -Pct -f modules/container-base -Dexpression=base.image -Dbase.image.tag.suffix="" -q -DforceStdout )" | tee -a "${GITHUB_ENV}" |
| 88 | + else |
| 89 | + echo "BASE_IMAGE=$( mvn initialize help:evaluate -Pct -f modules/container-base -Dexpression=base.image -Dbase.image.tag.suffix="" -q -DforceStdout )" | tee -a "${GITHUB_ENV}" |
| 90 | + fi |
| 91 | + - name: Calculate revision number for immutable tag (on release branches only) |
| 92 | + if: ${{ github.ref_name != env.DEVELOPMENT_BRANCH }} |
| 93 | + id: revision-tag |
| 94 | + uses: ./.github/actions/get-image-revision |
| 95 | + with: |
| 96 | + image-ref: ${{ env.BASE_IMAGE }} |
| 97 | + tag-options-prefix: "-Dbase.image.tag.suffix='' -Ddocker.tags.revision=" |
| 98 | + - name: Configure update of "latest" tag for development branch |
| 99 | + id: develop-tag |
| 100 | + if: ${{ github.ref_name == env.DEVELOPMENT_BRANCH }} |
| 101 | + run: | |
| 102 | + echo "tag-options=-Ddocker.tags.develop=unstable -Ddocker.tags.upcoming=${BASE_IMAGE_UPCOMING#*:}" | tee -a "${GITHUB_OUTPUT}" |
| 103 | +
|
| 104 | + - name: Deploy multi-arch base container image to Docker Hub |
| 105 | + id: build |
| 106 | + run: | |
| 107 | + mvn -f modules/container-base -Pct deploy -Ddocker.noCache -Ddocker.platforms=${{ env.PLATFORMS }} \ |
| 108 | + -Ddocker.imagePropertyConfiguration=override ${{ steps.develop-tag.outputs.tag-options }} ${{ steps.revision-tag.outputs.tag-options }} |
| 109 | +
|
| 110 | + - name: Determine appropriate base image ref for app image |
| 111 | + id: finalize |
| 112 | + run: | |
| 113 | + if [[ "${{ github.ref_name }}" = "${{ env.DEVELOPMENT_BRANCH }}" ]]; then |
| 114 | + echo "base-image-ref=${BASE_IMAGE_UPCOMING}" | tee -a "$GITHUB_OUTPUT" |
| 115 | + else |
| 116 | + echo "base-image-ref=gdcc/base:${{ steps.revision-tag.outputs.revision-tag }}" | tee -a "$GITHUB_OUTPUT" |
| 117 | + fi |
| 118 | +
|
89 | 119 | push-app-img: |
90 | 120 | name: "Rebase & Publish App Image" |
91 | 121 | permissions: |
92 | 122 | contents: read |
93 | 123 | packages: write |
94 | 124 | pull-requests: write |
95 | | - needs: build |
96 | | - # We do not release a new base image for pull requests, so do not trigger. |
97 | | - if: ${{ github.event_name != 'pull_request' }} |
98 | | - uses: ./.github/workflows/container_app_push.yml |
99 | 125 | secrets: inherit |
| 126 | + needs: |
| 127 | + - build |
| 128 | + uses: ./.github/workflows/container_app_push.yml |
| 129 | + with: |
| 130 | + base-image-ref: ${{ needs.build.outputs.base-image-ref }} |
0 commit comments