1919 required : false
2020 description : " Optional sub-key to append to the image name for build layer caching"
2121 type : string
22+ platforms :
23+ required : false
24+ description : " Platforms for which to build (default: linux/amd64,linux/arm64)"
25+ type : string
26+ default : linux/amd64,linux/arm64
2227 outputs :
2328 outcome :
2429 description : " The outcome of the build"
3338jobs :
3439 build :
3540 name : Build Images
36- runs-on : [ self-hosted, Linux ]
41+ runs-on : [ cw ]
42+ container : ' ghcr.io/coreweave/github-actions-images/github-base-runner:v1.9.0'
43+ timeout-minutes : 960
44+ defaults :
45+ run :
46+ shell : bash
3747 outputs :
3848 outcome : ${{ steps.docker-build.outcome }}
3949 tags : ${{ steps.meta.outputs.tags }}
4050 version : ${{ steps.meta.outputs.version }}
4151 steps :
42- - uses : actions/checkout@v3
43- - name : Set up Docker Buildx
44- uses : docker/setup-buildx-action@v2.2.1
45- - name : Login to GitHub container registry
46- uses : docker/login-action@v2.2.0
52+ - uses : actions/checkout@v4
53+ - name : Fetch BuildKit Client Certs
54+ uses : dopplerhq/secrets-fetch-action@v1.2.0
55+ id : client-certs
4756 with :
48- registry : ghcr.io
49- username : ${{ github.actor }}
50- password : ${{ secrets.GITHUB_TOKEN }}
51- - name : Login to DockerHub container registry
52- uses : docker/login-action@v2.2.0
57+ doppler-token : ${{ secrets.ORG_BUILDKIT_CLIENT_TOKEN }}
58+ doppler-project : ${{ secrets.BUILDKIT_CONSUMER_DOPPLER_PROJECT }}
59+ doppler-config : prod
60+ inject-env-vars : false
61+ - name : Set up Docker Buildx
62+ uses : docker/setup-buildx-action@v3.7.1
5363 with :
54- username : ${{ secrets.DOCKERHUB_USERNAME }}
55- password : ${{ secrets.DOCKERHUB_PASSWORD }}
64+ driver : remote
65+ endpoint : ${{ secrets.BUILDKIT_CONSUMER_AMD64_ENDPOINT }}
66+ platforms : linux/amd64
67+ append : |
68+ - endpoint: ${{ secrets.BUILDKIT_CONSUMER_ARM64_ENDPOINT }}
69+ platforms: linux/arm64
70+ env :
71+ BUILDER_NODE_0_AUTH_TLS_CACERT : ${{ steps.client-certs.outputs.TLS_CACERT }}
72+ BUILDER_NODE_0_AUTH_TLS_CERT : ${{ steps.client-certs.outputs.TLS_CERT }}
73+ BUILDER_NODE_0_AUTH_TLS_KEY : ${{ steps.client-certs.outputs.TLS_KEY }}
74+ BUILDER_NODE_1_AUTH_TLS_CACERT : ${{ steps.client-certs.outputs.TLS_CACERT }}
75+ BUILDER_NODE_1_AUTH_TLS_CERT : ${{ steps.client-certs.outputs.TLS_CERT }}
76+ BUILDER_NODE_1_AUTH_TLS_KEY : ${{ steps.client-certs.outputs.TLS_KEY }}
5677 - name : Get base registry
5778 run : |
5879 echo "REGISTRY=ghcr.io/${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
@@ -70,14 +91,21 @@ jobs:
7091 echo "CACHE_KEY=${{ inputs.image-name }}-${{ inputs.cache-key }}" >> $GITHUB_ENV
7192 - name : Extract metadata (tags, labels) for Docker
7293 id : meta
73- uses : docker/metadata-action@v4.1 .1
94+ uses : docker/metadata-action@v5.5 .1
7495 with :
7596 images : ${{ env.REGISTRY }}/${{ inputs.image-name }}
7697 tags : |
7798 type=sha,prefix=${{ env.TAG_PREFIX }},suffix=${{ env.TAG_SUFFIX }},format=short
99+ - name : Initialize registry credentials file
100+ env :
101+ USER : ${{ github.actor }}
102+ PASS : ${{ secrets.GITHUB_TOKEN }}
103+ run : |
104+ jq -n '.auths."ghcr.io" = { username: env.USER, password: env.PASS }' \
105+ | install -m400 /dev/stdin ~/.docker/config.json
78106 - name : Build and push Docker image
79107 id : docker-build
80- uses : docker/build-push-action@v3.2 .0
108+ uses : docker/build-push-action@v6.9 .0
81109 with :
82110 context : ${{ inputs.folder }}
83111 build-args : |-
@@ -87,6 +115,11 @@ jobs:
87115 labels : ${{ steps.meta.outputs.labels }}
88116 cache-from : type=registry,ref=${{ env.REGISTRY }}/buildcache:${{ env.CACHE_KEY || inputs.image-name }}
89117 cache-to : type=registry,ref=${{ env.REGISTRY }}/buildcache:${{ env.CACHE_KEY || inputs.image-name }},mode=max
118+ platforms : ${{ inputs.platforms }}
119+ - name : Clear registry credentials
120+ if : always()
121+ run : |
122+ rm -f ~/.docker/config.json && [ ! -e ~/.docker/config.json ]
90123 - uses : 8BitJonny/gh-get-current-pr@2.1.3
91124 id : PR
92125 with :
0 commit comments