Skip to content

Commit 8d9b2bd

Browse files
OlegOptimumCode
Oleg
authored and
OptimumCode
committed
Extract build job into reusable workflow. Add publish-on-automerge job
1 parent be76d61 commit 8d9b2bd

File tree

2 files changed

+130
-91
lines changed

2 files changed

+130
-91
lines changed

‎.github/workflows/build-image.yml

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
name: Build test harness image
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
image-name:
7+
type: string
8+
required: true
9+
description: 'Name for the image to build'
10+
publish-image:
11+
type: boolean
12+
default: false
13+
description: 'Enables built image publication'
14+
is-latest:
15+
type: boolean
16+
default: false
17+
description: 'If image is the latest a corresponding tag is added to the image'
18+
outputs:
19+
current-version:
20+
description: 'Version of the implementation from the built image'
21+
value: ${{ jobs.build.outputs.current-version }}
22+
23+
permissions: {}
24+
25+
env:
26+
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
27+
28+
jobs:
29+
build:
30+
runs-on: ubuntu-latest
31+
32+
outputs:
33+
current-version: ${{ steps.current-version.outputs.value }}
34+
35+
permissions:
36+
id-token: write
37+
contents: read
38+
attestations: write
39+
packages: write
40+
41+
steps:
42+
- uses: actions/checkout@v4
43+
with:
44+
persist-credentials: false
45+
46+
- name: Install bowtie
47+
uses: bowtie-json-schema/bowtie@main
48+
49+
- name: Build
50+
id: build_image
51+
uses: redhat-actions/buildah-build@v2
52+
with:
53+
context: '.'
54+
containerfiles: |
55+
Dockerfile
56+
image: ${{ inputs.image-name }}
57+
tags: ${{ github.sha }} ${{ inputs.is-latest && 'latest' || '' }}
58+
archs: amd64, arm64
59+
60+
- name: Set DOCKER_HOST so podman-built images are findable
61+
run: |
62+
systemctl --user enable --now podman.socket
63+
sudo loginctl enable-linger $USER
64+
podman --remote info
65+
echo "DOCKER_HOST=unix://$(podman info --format '{{.Host.RemoteSocket.Path}}')" >> $GITHUB_ENV
66+
67+
- name: Smoke Test
68+
env:
69+
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
70+
run: |
71+
bowtie smoke -i "localhost/${IMAGE_WITH_TAG}" --format json
72+
bowtie smoke -i "localhost/${IMAGE_WITH_TAG}" --format markdown >> $GITHUB_STEP_SUMMARY
73+
74+
- name: Collect current version
75+
id: current-version
76+
env:
77+
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
78+
run: |
79+
version=$(bowtie info \
80+
--implementation "localhost/${IMAGE_WITH_TAG}" \
81+
--format json | jq -r '.version // empty')
82+
echo "value=${version}" >> $GITHUB_OUTPUT
83+
84+
- name: Log in to ghcr.io
85+
uses: redhat-actions/podman-login@v1
86+
with:
87+
username: ${{ github.actor }}
88+
password: ${{ github.token }}
89+
registry: ${{ env.IMAGE_REGISTRY }}
90+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
91+
92+
- name: Add tag with version to the image
93+
env:
94+
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
95+
IMAGE_WITH_VERSION: "${{ steps.build_image.outputs.image }}:${{ steps.current-version.outputs.value }}"
96+
run: podman tag ${IMAGE_WITH_TAG} ${IMAGE_WITH_VERSION}
97+
if: inputs.publish-image
98+
99+
- name: Publish
100+
id: push
101+
uses: redhat-actions/push-to-registry@v2
102+
with:
103+
image: ${{ steps.build_image.outputs.image }}
104+
tags: ${{ steps.current-version.outputs.value }} ${{ steps.build_image.outputs.tags }}
105+
registry: ${{ env.IMAGE_REGISTRY }}
106+
if: inputs.publish-image
107+
108+
- name: Generate attestation for images
109+
uses: actions/attest-build-provenance@v2
110+
with:
111+
subject-name: ${{ env.IMAGE_REGISTRY }}/${{ steps.build_image.outputs.image }}
112+
subject-digest: ${{ steps.push.outputs.digest }}
113+
push-to-registry: true
114+
if: inputs.publish-image

‎.github/workflows/build.yml

Lines changed: 16 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -46,97 +46,11 @@ jobs:
4646
build:
4747
needs: meta
4848

49-
runs-on: ubuntu-latest
50-
51-
outputs:
52-
current-version: ${{ steps.current-version.outputs.value }}
53-
54-
permissions:
55-
id-token: write
56-
contents: read
57-
attestations: write
58-
packages: write
59-
60-
steps:
61-
- uses: actions/checkout@v4
62-
with:
63-
persist-credentials: false
64-
65-
- name: Install bowtie
66-
uses: bowtie-json-schema/bowtie@main
67-
68-
- name: Build
69-
id: build_image
70-
uses: redhat-actions/buildah-build@v2
71-
with:
72-
context: '.'
73-
containerfiles: |
74-
Dockerfile
75-
image: ${{ needs.meta.outputs.implementation-name }}
76-
tags: ${{ github.sha }} ${{ github.ref == 'refs/heads/main' && 'latest' || '' }}
77-
archs: amd64, arm64
78-
79-
- name: Set DOCKER_HOST so podman-built images are findable
80-
run: |
81-
systemctl --user enable --now podman.socket
82-
sudo loginctl enable-linger $USER
83-
podman --remote info
84-
echo "DOCKER_HOST=unix://$(podman info --format '{{.Host.RemoteSocket.Path}}')" >> $GITHUB_ENV
85-
86-
- name: Smoke Test
87-
env:
88-
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
89-
run: |
90-
bowtie smoke -i "localhost/${IMAGE_WITH_TAG}" --format json
91-
bowtie smoke -i "localhost/${IMAGE_WITH_TAG}" --format markdown >> $GITHUB_STEP_SUMMARY
92-
93-
- name: Collect current version
94-
id: current-version
95-
env:
96-
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
97-
run: |
98-
version=$(bowtie info \
99-
--implementation "localhost/${IMAGE_WITH_TAG}" \
100-
--format json | jq -r '.version // empty')
101-
echo "value=${version}" >> $GITHUB_OUTPUT
102-
103-
- name: Print collected versions
104-
env:
105-
LATEST_VERSION: ${{ needs.meta.outputs.latest-version }}
106-
CURRENT_VERSION: ${{ steps.current-version.outputs.value }}
107-
run: echo "latest_version=${LATEST_VERSION}; current_version=${CURRENT_VERSION}"
108-
109-
- name: Log in to ghcr.io
110-
uses: redhat-actions/podman-login@v1
111-
with:
112-
username: ${{ github.actor }}
113-
password: ${{ github.token }}
114-
registry: ${{ env.IMAGE_REGISTRY }}
115-
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
116-
117-
- name: Add tag with version to the image
118-
env:
119-
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
120-
IMAGE_WITH_VERSION: "${{ steps.build_image.outputs.image }}:${{ steps.current-version.outputs.value }}"
121-
run: podman tag ${IMAGE_WITH_TAG} ${IMAGE_WITH_VERSION}
122-
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
123-
124-
- name: Publish
125-
id: push
126-
uses: redhat-actions/push-to-registry@v2
127-
with:
128-
image: ${{ steps.build_image.outputs.image }}
129-
tags: ${{ steps.current-version.outputs.value }} ${{ steps.build_image.outputs.tags }}
130-
registry: ${{ env.IMAGE_REGISTRY }}
131-
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
132-
133-
- name: Generate attestation for images
134-
uses: actions/attest-build-provenance@v2
135-
with:
136-
subject-name: ${{ env.IMAGE_REGISTRY }}/${{ steps.build_image.outputs.image }}
137-
subject-digest: ${{ steps.push.outputs.digest }}
138-
push-to-registry: true
139-
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
49+
uses: ./.github/workflows/build-image.yml
50+
with:
51+
image-name: ${{ needs.meta.outputs.implementation-name }}
52+
is-latest: ${{ github.ref == 'refs/heads/main' }}
53+
publish-image: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
14054

14155
mark-previous-version:
14256
needs: [build, meta, automerge]
@@ -192,3 +106,14 @@ jobs:
192106
env:
193107
PR_URL: ${{ github.event.pull_request.html_url }}
194108
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
109+
110+
# Job is required to automatically publish an image for successfully merged dependabot's PR.
111+
# PR is merged with GITHUB_TOKEN and it does not trigger the workflow run on 'push'
112+
publish-on-automerge:
113+
needs: [meta, automerge]
114+
115+
uses: ./.github/workflows/build-image.yml
116+
with:
117+
image-name: ${{ needs.meta.outputs.implementation-name }}
118+
is-latest: ${{ github.event.pull_request.base.ref == 'main' }}
119+
publish-image: true

0 commit comments

Comments
 (0)