Skip to content

Commit 149a051

Browse files
asgrimasgrim
authored
Merge pull request #350 from asgrim/docker-main-branch-image
De-duplicate docker image build for nightly and release tags
2 parents 4b20e77 + 70fcaa6 commit 149a051

File tree

3 files changed

+144
-69
lines changed

3 files changed

+144
-69
lines changed

‎.github/workflows/build-and-push-docker-image.yml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# Invoking this pipeline requires additional permissions, so must be invoked
2+
# in a way to pass those permissions on, e.g.:
3+
#
4+
# build-and-push-docker-image:
5+
# needs: build-phar
6+
# permissions:
7+
# contents: read
8+
# id-token: write
9+
# attestations: write
10+
# packages: write
11+
# uses: ./.github/workflows/build-and-push-docker-image.yml
12+
# with:
13+
# tags: |
14+
# type=raw,value=bin
15+
# type=semver,pattern={{version}}-bin
16+
17+
name: "Build and push the PIE Docker Image"
18+
19+
on:
20+
workflow_call:
21+
inputs:
22+
tags:
23+
description: Tag definition - see docker/metadata-action
24+
type: string
25+
required: true
26+
27+
permissions:
28+
contents: read
29+
30+
jobs:
31+
docker-binary-only-image:
32+
name: Docker binary-only image
33+
runs-on: ubuntu-latest
34+
35+
permissions:
36+
# attestations:write is required for build provenance attestation.
37+
attestations: write
38+
# id-token:write is required for build provenance attestation.
39+
id-token: write
40+
# packages:write is required to publish Docker images to GitHub's registry.
41+
packages: write
42+
43+
steps:
44+
- name: Checkout repository
45+
uses: actions/checkout@v5
46+
47+
- name: Fetch built PHAR from artifacts
48+
uses: actions/download-artifact@v5
49+
with:
50+
name: pie-${{ github.sha }}.phar
51+
52+
- name: Verify the PHAR
53+
env:
54+
GH_TOKEN: ${{ github.token }}
55+
run: gh attestation verify pie.phar --repo ${{ github.repository }}
56+
57+
- name: Set up QEMU
58+
uses: docker/setup-qemu-action@v3
59+
60+
- name: Set up Docker Buildx
61+
uses: docker/setup-buildx-action@v3
62+
63+
- name: Log in to the Container registry
64+
uses: docker/login-action@v3
65+
with:
66+
registry: ghcr.io
67+
username: ${{ github.actor }}
68+
password: ${{ secrets.GITHUB_TOKEN }}
69+
70+
- name: Extract metadata (tags, labels) for Docker
71+
id: meta
72+
uses: docker/metadata-action@v5
73+
with:
74+
flavor: |
75+
latest=false
76+
images: ghcr.io/${{ github.repository }}
77+
tags: |
78+
${{ inputs.tags }}
79+
80+
- name: Build and push Docker image
81+
id: build-and-push
82+
uses: docker/build-push-action@v6
83+
with:
84+
context: .
85+
platforms: linux/amd64,linux/arm64
86+
file: Dockerfile
87+
target: standalone-binary
88+
push: true
89+
tags: ${{ steps.meta.outputs.tags }}
90+
labels: ${{ steps.meta.outputs.labels }}
91+
92+
- name: Generate artifact attestation
93+
uses: actions/attest-build-provenance@v3
94+
with:
95+
subject-name: ghcr.io/${{ github.repository }}
96+
subject-digest: ${{ steps.build-and-push.outputs.digest }}
97+
push-to-registry: true

‎.github/workflows/docker-nightly-image-push.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: "Nightly Docker Image Build"
2+
3+
on:
4+
# Runs on pushes targeting the default branch
5+
push:
6+
branches: ["main"]
7+
8+
# Allows you to run this workflow manually from the Actions tab
9+
workflow_dispatch:
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
build-phar:
16+
# See build-phar.yml for a list of the permissions and why they are needed
17+
permissions:
18+
contents: read
19+
id-token: write
20+
attestations: write
21+
uses: ./.github/workflows/build-phar.yml
22+
23+
build-and-push-docker-image:
24+
needs: build-phar
25+
# See build-and-push-docker-image.yml for a list of the permissions and why they are needed
26+
permissions:
27+
contents: read
28+
id-token: write
29+
attestations: write
30+
packages: write
31+
uses: ./.github/workflows/build-and-push-docker-image.yml
32+
with:
33+
tags: |
34+
type=raw,value=nightly-bin

‎.github/workflows/release.yml‎

Lines changed: 13 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -39,76 +39,20 @@ jobs:
3939
with:
4040
files: pie.phar
4141

42-
docker-binary-only-image:
43-
needs: build-phar
44-
name: Docker binary-only image
45-
runs-on: ubuntu-latest
42+
build-and-push-docker-image:
4643
if: ${{ startsWith(github.ref, 'refs/tags/') }}
47-
44+
needs: build-phar
45+
# See build-and-push-docker-image.yml for a list of the permissions and why they are needed
4846
permissions:
49-
# attestations:write is required for build provenance attestation.
50-
attestations: write
51-
# id-token:write is required for build provenance attestation.
47+
contents: read
5248
id-token: write
53-
# packages:write is required to publish Docker images to GitHub's registry.
49+
attestations: write
5450
packages: write
55-
56-
steps:
57-
- name: Checkout repository
58-
uses: actions/checkout@v5
59-
60-
- name: Fetch built PHAR from artifacts
61-
uses: actions/download-artifact@v5
62-
with:
63-
name: pie-${{ github.sha }}.phar
64-
65-
- name: Verify the PHAR
66-
env:
67-
GH_TOKEN: ${{ github.token }}
68-
run: gh attestation verify pie.phar --repo ${{ github.repository }}
69-
70-
- name: Set up QEMU
71-
uses: docker/setup-qemu-action@v3
72-
73-
- name: Set up Docker Buildx
74-
uses: docker/setup-buildx-action@v3
75-
76-
- name: Log in to the Container registry
77-
uses: docker/login-action@v3
78-
with:
79-
registry: ghcr.io
80-
username: ${{ github.actor }}
81-
password: ${{ secrets.GITHUB_TOKEN }}
82-
83-
- name: Extract metadata (tags, labels) for Docker
84-
id: meta
85-
uses: docker/metadata-action@v5
86-
with:
87-
flavor: |
88-
latest=false
89-
images: ghcr.io/${{ github.repository }}
90-
# @TODO v1.0 Consider introducing more granular tags (major and major.minor)
91-
# @see https://github.com/php/pie/pull/122#pullrequestreview-2477496308
92-
# @see https://github.com/php/pie/pull/122#discussion_r1867331273
93-
tags: |
94-
type=raw,value=bin
95-
type=semver,pattern={{version}}-bin
96-
97-
- name: Build and push Docker image
98-
id: build-and-push
99-
uses: docker/build-push-action@v6
100-
with:
101-
context: .
102-
platforms: linux/amd64,linux/arm64
103-
file: Dockerfile
104-
target: standalone-binary
105-
push: true
106-
tags: ${{ steps.meta.outputs.tags }}
107-
labels: ${{ steps.meta.outputs.labels }}
108-
109-
- name: Generate artifact attestation
110-
uses: actions/attest-build-provenance@v3
111-
with:
112-
subject-name: ghcr.io/${{ github.repository }}
113-
subject-digest: ${{ steps.build-and-push.outputs.digest }}
114-
push-to-registry: true
51+
uses: ./.github/workflows/build-and-push-docker-image.yml
52+
with:
53+
# @TODO v1.0 Consider introducing more granular tags (major and major.minor)
54+
# @see https://github.com/php/pie/pull/122#pullrequestreview-2477496308
55+
# @see https://github.com/php/pie/pull/122#discussion_r1867331273
56+
tags: |
57+
${{ ((!contains(github.ref, 'alpha') && !contains(github.ref, 'beta') && !contains(github.ref, 'rc')) && 'type=raw,value=bin') || '' }}
58+
type=semver,pattern={{version}}-bin

0 commit comments

Comments
 (0)