Rework Container CI (#7)

Author: opajonk

.github/workflows/ci.yaml

@@ -1,5 +1,5 @@
 name: 'Validate DevContainer'
-description: 'This workflow is checking that updates do not break stuff. If on main branch, publish to latest tag.'
+description: 'This workflow is checking that updates do not break stuff. If on main branch, publish to "latest" tag.'
 on:
   pull_request:
   push:
@@ -34,6 +34,9 @@ jobs:
       - name: Check, Build, Test
         uses: devcontainers/ci@v0.3
         with:
+          # The .devcontainer is never published as pre-built container.
+          # We want to only use it for building and testing the actual container, which resides in src/s-core-devcontainer.
+          push: "never"
           runCmd: |
             # Check
             pre-commit run --show-diff-on-failure --color=always --all-files || exit -1
@@ -47,10 +50,12 @@ jobs:
       # Upload devcontainer from src/s-core-devcontainer
       - name: Publish
         uses: devcontainers/ci@v0.3
+        if: github.ref == 'refs/heads/main'
         with:
-          cacheFrom: ghcr.io/eclipse-score/devcontainer
-          imageName: ghcr.io/eclipse-score/devcontainer
-          # publish latest from main branch; tags are handled in release workflow
-          imageTag: latest
-          refFilterForPush: 'refs/heads/main'
-          subFolder: src/s-core-devcontainer
+          # We do not use the push feature of devcontainers/ci here, since that would push the wrong container.
+          # Instead, we use the publish script which pushes the correct container (residing in src/s-core-devcontainer).
+          push: "never"
+          runCmd: |
+            # manually login to ghcr.io for publishing
+            echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+            ./scripts/publish.sh "latest"

.github/workflows/release.yaml

@@ -29,6 +29,9 @@ jobs:
       - name: Check, Build, Test
         uses: devcontainers/ci@v0.3
         with:
+          # The .devcontainer is never published as pre-built container.
+          # We want to only use it for building and testing the actual container, which resides in src/s-core-devcontainer.
+          push: "never"
           runCmd: |
             # Check
             pre-commit run --show-diff-on-failure --color=always --all-files || exit -1
@@ -43,7 +46,9 @@ jobs:
       - name: Publish
         uses: devcontainers/ci@v0.3
         with:
-          imageName: ghcr.io/eclipse-score/devcontainer
-          cacheFrom: ghcr.io/eclipse-score/devcontainer
-          imageTag: ${{ github.ref_name }}
-          subFolder: src/s-core-devcontainer
+          # We do not use the push feature of devcontainers/ci here, since that would push the wrong container.
+          # Instead, we use the publish script which pushes the correct container (residing in src/s-core-devcontainer).
+          push: "never"
+          runCmd: |
+            # Note: "${{ github.ref_name }}" will be the tag name, e.g., "1.0.0"
+            ./scripts/publish.sh "${{ github.ref_name }}"

README.md

@@ -91,7 +91,7 @@ They are used by the CI, but especially the build and test scripts can be run al
 ````console
 $ ./scripts/build.sh
 [... build output..]
-{"outcome":"success","imageName":["vsc-s-core-devcontainer-209943ec6ff795f57b20cdf85a70c904d1e3b4a329d1e01c79f0ffea615c6e40-features"]}
+{"outcome":"success","imageName":["ghcr.io/eclipse-score/devcontainer"]}
 
 $ ./scripts/test.sh
 [... test output...]
@@ -112,16 +112,15 @@ So in order to execute `S-CORE DevContainer` on your host (and test it as part o
 
 * export this newly built S-CORE DevContainer image
 * import the image on your host machine
-* use the image name in the `.devcontainer/devcontainer.json` of the targeted S-CORE module
+* use the image name and tag `latest` in the `.devcontainer/devcontainer.json` of the targeted S-CORE module
 
 Concretely, this can be done as follows:
 
-* Run `docker save <imageName> > export.img` in `Development Container A`.
-For example, given above build output, this would be `docker save vsc-s-core-devcontainer-209943ec6ff795f57b20cdf85a70c904d1e3b4a329d1e01c79f0ffea615c6e40-features > export.img`
+* Run `docker save "ghcr.io/eclipse-score/devcontainer" > export.img` in `Development Container A`.
 * On your **host machine** (!!), open a console and run `docker load < /path/to/export.img`.
-* In the working copy of the targeted S-CORE module, edit the file `.devcontainer/devcontainer.json` and change the `"image": "..."` entry to `"image": "<imageName>"`.
-Given above build output, this would be `"image": "vsc-s-core-devcontainer-209943ec6ff795f57b20cdf85a70c904d1e3b4a329d1e01c79f0ffea615c6e40-features"`.
+* In the working copy of the targeted S-CORE module, edit the file `.devcontainer/devcontainer.json` and change the `"image": "..."` entry to `"image": "ghcr.io/eclipse-score/devcontainer:latest"` (if not already set like this).
 The Visual Studio Code instance related to the targeted S-CORE module will now ask you to rebuild the DevContainer.
+If not, press <kbd>Ctrl</kbd> + <kbd>Shift</kbd> + <kbd>p</kbd> and run from there "Dev Containers: Rebuilt Container Without Cache".
 Do so, and you have a running instance of `S-CORE DevContainer` related to the targeted S-CORE module.
 
 ### Version Pinning

scripts/build.sh

@@ -1,4 +1,4 @@
 #!/usr/bin/env bash
 set -euxo pipefail
 
-devcontainer build --workspace-folder src/s-core-devcontainer
+devcontainer build --workspace-folder src/s-core-devcontainer --image-name ghcr.io/eclipse-score/devcontainer:latest --cache-from ghcr.io/eclipse-score/devcontainer

scripts/publish.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+TAG="${1:-latest}"
+
+if [[ "$TAG" != "latest" ]]; then
+    docker tag "ghcr.io/eclipse-score/devcontainer:latest" "ghcr.io/eclipse-score/devcontainer:${TAG}"
+fi
+
+docker push "ghcr.io/eclipse-score/devcontainer:${TAG}"

scripts/test.sh

@@ -15,10 +15,6 @@ devcontainer up \
   --workspace-folder "${PROJECT_DIR}/src/${IMAGE}/" \
   --remove-existing-container
 
-CONTAINER_ID=$(docker container ls --filter "label=${ID_LABEL}" --quiet)
-IMAGE_NAME=$(docker container inspect --format '{{ .Config.Image }}' "${CONTAINER_ID}")
-IMAGE_ID=$(docker image ls --filter "reference=${IMAGE_NAME}" --quiet)
-
 # Run actual test
 echo "(*) Running test..."
 devcontainer exec --workspace-folder "${PROJECT_DIR}/src/${IMAGE}" --id-label "${ID_LABEL}" \