Skip to content

Commit 4e9434d

Browse files
a-bMichael Chinigo
a-b
and
Michael Chinigo
authored
GHA workflow that builds CI base image (#20)
* GHA workflow that builds CI base image Co-authored-by: Al Berez <[email protected]> Co-authored-by: Michael Chinigo <[email protected]>
1 parent d14848f commit 4e9434d

File tree

4 files changed

+3561
-0
lines changed

4 files changed

+3561
-0
lines changed

‎.github/workflows/ensure-ci-image.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: Ensure CI image
2+
3+
on:
4+
workflow_dispatch:
5+
6+
env:
7+
IMAGE_REGISTRY: ghcr.io
8+
CI_DOCKERFILE_DIR: ./ci # Relative to project root
9+
CI_DOCKERFILE_PATH: Dockerfile # Relative to CI_DOCKERFILE_DIR
10+
CI_DOCKERFILE_MOST_RECENT_SHA: # Determined dynamically later on
11+
12+
jobs:
13+
calculate-latest-label:
14+
runs-on: ubuntu-latest
15+
16+
permissions:
17+
contents: read
18+
19+
outputs:
20+
ci_dockerfile_latest_sha: ${{ steps.calculate_latest_sha.outputs.ci_dockerfile_latest_sha }}
21+
22+
steps:
23+
- name: Checkout repo
24+
uses: actions/checkout@v4
25+
26+
- name: Calculate label for CI image
27+
id: calculate_latest_sha
28+
env:
29+
IMAGE_NAME: ${{ github.repository }}
30+
run: |
31+
dockerfile_path=${CI_DOCKERFILE_DIR}/${CI_DOCKERFILE_PATH}
32+
33+
[[ ! -f ${dockerfile_path} ]] && echo "Could not find Dockerfile at ${dockerfile_path}" 1>&2 && exit 1
34+
35+
echo "ci_dockerfile_latest_sha=$(git log --max-count 1 --pretty=format:%H "${dockerfile_path}")" >> $GITHUB_OUTPUT
36+
37+
build-and-push-ci-image:
38+
runs-on: ubuntu-latest
39+
40+
permissions:
41+
contents: read
42+
packages: write
43+
44+
needs:
45+
- calculate-latest-label
46+
47+
steps:
48+
- name: Checkout repo
49+
uses: actions/checkout@v4
50+
51+
- name: Login to GitHub container registry
52+
uses: docker/login-action@v3
53+
with:
54+
registry: ${{ env.IMAGE_REGISTRY }}
55+
username: ${{ github.actor }}
56+
password: ${{ secrets.GITHUB_TOKEN }}
57+
58+
- name: Set up Docker Buildx
59+
uses: docker/setup-buildx-action@v3
60+
61+
- name: Extract metadata
62+
uses: docker/metadata-action@v5
63+
id: meta
64+
with:
65+
images: ${{ env.IMAGE_REGISTRY }}/${{ github.repository }}-ci
66+
tags: |
67+
type=raw,value=${{ needs.calculate-latest-label.outputs.ci_dockerfile_latest_sha }}
68+
type=raw,value=${{ github.ref_name }}-latest
69+
70+
- name: Build and push CI image
71+
uses: docker/build-push-action@v5
72+
with:
73+
push: true
74+
context: ${{ env.CI_DOCKERFILE_DIR }}/..
75+
file: ${{ env.CI_DOCKERFILE_DIR }}/${{ env.CI_DOCKERFILE_PATH }}
76+
tags: ${{ steps.meta.outputs.tags }}
77+
labels: ${{ steps.meta.outputs.labels }}

‎ci/Dockerfile

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
FROM summerwind/actions-runner:latest
2+
3+
ENV bbl_version 8.4.111
4+
ENV bosh_cli_version 7.2.3
5+
ENV NODE_VERSION 22.2.0
6+
ENV terraform_version 0.11.5
7+
8+
USER root
9+
RUN usermod -a -G sudo root
10+
11+
ENV PATH="./node_modules/.bin:/node_modules/.bin:${PATH}"
12+
13+
RUN \
14+
apt-get update && \
15+
apt-get -y install \
16+
shellcheck \
17+
yamllint && \
18+
apt list --installed
19+
20+
COPY package.json \
21+
package-lock.json \
22+
./
23+
24+
RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" \
25+
&& case "${dpkgArch##*-}" in \
26+
amd64) ARCH='x64';; \
27+
ppc64el) ARCH='ppc64le';; \
28+
s390x) ARCH='s390x';; \
29+
arm64) ARCH='arm64';; \
30+
armhf) ARCH='armv7l';; \
31+
i386) ARCH='x86';; \
32+
*) echo "unsupported architecture"; exit 1 ;; \
33+
esac \
34+
# use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150
35+
&& export GNUPGHOME="$(mktemp -d)" \
36+
# gpg keys listed at https://github.com/nodejs/node#release-keys
37+
&& set -ex \
38+
&& for key in \
39+
4ED778F539E3634C779C87C6D7062848A1AB005C \
40+
141F07595B7B3FFE74309A937405533BE57C7D57 \
41+
74F12602B6F1C4E913FAA37AD3A89613643B6201 \
42+
DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \
43+
61FC681DFB92A079F1685E77973F295594EC4689 \
44+
8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 \
45+
C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8 \
46+
890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 \
47+
C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C \
48+
108F52B48DB57BB0CC439B2997B01419BD92F80A \
49+
A363A499291CBBC940DD62E41F10027AF002F8B0 \
50+
CC68F5A3106FF448322E48ED27F5E38D5B0A215F \
51+
; do \
52+
gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \
53+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \
54+
done \
55+
&& curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH.tar.xz" \
56+
&& curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \
57+
&& gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \
58+
&& gpgconf --kill all \
59+
&& rm -rf "$GNUPGHOME" \
60+
&& grep " node-v$NODE_VERSION-linux-$ARCH.tar.xz\$" SHASUMS256.txt | sha256sum -c - \
61+
&& tar -xJf "node-v$NODE_VERSION-linux-$ARCH.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \
62+
&& rm "node-v$NODE_VERSION-linux-$ARCH.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \
63+
&& ln -s /usr/local/bin/node /usr/local/bin/nodejs \
64+
# smoke tests
65+
&& node --version \
66+
&& npm --version \
67+
&& npm install-clean
68+
69+
# bosh-cli
70+
RUN \
71+
wget --no-verbose https://s3.amazonaws.com/bosh-cli-artifacts/bosh-cli-${bosh_cli_version}-linux-amd64 --output-document="/usr/local/bin/bosh" && \
72+
chmod +x /usr/local/bin/bosh
73+
74+
# bbl and dependencies
75+
RUN \
76+
wget --no-verbose https://github.com/cloudfoundry/bosh-bootloader/releases/download/v${bbl_version}/bbl-v${bbl_version}_linux_x86-64 -P /tmp && \
77+
mv /tmp/bbl-* /usr/local/bin/bbl && \
78+
cd /usr/local/bin && \
79+
chmod +x bbl
80+
81+
RUN \
82+
wget --no-verbose https://github.com/cloudfoundry/bosh-bootloader/archive/v${bbl_version}.tar.gz -P /tmp && \
83+
mkdir -p /var/repos/bosh-bootloader && \
84+
tar xvf /tmp/v${bbl_version}.tar.gz --strip-components=1 -C /var/repos/bosh-bootloader && \
85+
rm -rf /tmp/*
86+
87+
RUN \
88+
wget --no-verbose "https://releases.hashicorp.com/terraform/${terraform_version}/terraform_${terraform_version}_linux_amd64.zip" -P /tmp && \
89+
cd /tmp && \
90+
curl https://releases.hashicorp.com/terraform/${terraform_version}/terraform_${terraform_version}_SHA256SUMS | grep linux_amd64 | shasum -c - && \
91+
unzip "/tmp/terraform_${terraform_version}_linux_amd64.zip" -d /tmp && \
92+
mv /tmp/terraform /usr/local/bin/terraform && \
93+
cd /usr/local/bin && \
94+
chmod +x terraform && \
95+
rm -rf /tmp/*

0 commit comments

Comments
 (0)