Skip to content

General update to trixie with python 3.13 (WIP) #155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
bjoernt wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

General update to trixie with python 3.13 (WIP) #155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions .github/workflows/barbican-exporter-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ on:
- main
pull_request:

env:
REGISTRY: ghcr.io

jobs:
build-and-push:
runs-on: ubuntu-latest
Expand Down Expand Up @@ -37,7 +40,9 @@ jobs:
type=ref,event=branch
type=ref,event=pr
type=sha

- name: Set registry URL
run: |
echo "GHCR_URL=${REGISTRY}/${GITHUB_REPOSITORY,,}" >> ${GITHUB_ENV}
Copy link
Copy Markdown
Collaborator

@cloudnull cloudnull Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are we setting the ghcr_url? i see it in the build args, but what purpose does it serve?

Copy link
Copy Markdown
Contributor Author

@bjoernt bjoernt Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is there to allow containers build to reference multi stage from forked repos, like openstack-venv so you can test and build the entire chain like I had to from a forked repo instead of using hard coded repos

FROM ${GHCR_URL}/openstack-venv:${VENV_TAG} AS dependency_build

- name: Build and push Docker image
uses: docker/build-push-action@v4
with:
Expand All @@ -46,4 +51,6 @@ jobs:
push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
build-args: EXPORTER_PORT=9100 # Default, overridden by env in deployment
build-args: |
GHCR_URL=${{ env.GHCR_URL }}
EXPORTER_PORT=9100
6 changes: 6 additions & 0 deletions .github/workflows/container-build-alert-proxy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@ jobs:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
- name: Dynamically set MY_DATE environment variable
run: echo "MY_DATE=$(date +%s)" >> $GITHUB_ENV
- name: Set registry URL
run: |
echo "GHCR_URL=${REGISTRY}/${GITHUB_REPOSITORY,,}" >> ${GITHUB_ENV}
- name: Build and push Docker image
uses: docker/build-push-action@v6
with:
Expand All @@ -63,6 +66,8 @@ jobs:
labels: ${{ steps.meta.outputs.labels }}
build-args: |
CACHEBUST=${{ github.sha }}
GHCR_URL=${{ env.GHCR_URL }}

- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@0.33.1 # using latest trivy scanner
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
Expand Down Expand Up @@ -118,3 +123,4 @@ jobs:
labels: ${{ steps.meta.outputs.labels }}
build-args: |
CACHEBUST=${{ github.sha }}
GHCR_URL=${{ env.GHCR_URL }}
22 changes: 20 additions & 2 deletions .github/workflows/container-build-apache.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,25 +35,32 @@ env:
# workaround until there's a better way to handle this.
mod_wsgi: >
["5.0.2"]
venv_tag: >
['3.13-trixie-latest','3.12-bookworm-latest']

jobs:
init:
runs-on: ubuntu-latest
outputs:
apache-mod-wsgi-version: ${{ steps.generate-matrix.outputs.mod_wsgi }}
venv-tag: ${{ steps.generate-matrix.outputs.venv_tag }}
steps:
- name: generate-matrix
id: generate-matrix
run: |
if [ "${{ github.event_name == 'workflow_dispatch' }}" = "true" ]; then
mod_wsgi="$(echo '${{ github.event.inputs.apache-mod-wsgi-version }}' | jq -R '[select(length>0)]' | jq -c '.')"
venv_tag="['3.13-trixie-latest']"
fi
echo "mod_wsgi=${mod_wsgi:-${{ env.mod_wsgi }}}" >> $GITHUB_OUTPUT
echo "venv_tag=${venv_tag:-${{ env.venv_tag }}}" >> $GITHUB_OUTPUT
build-and-push-image:
needs:
- init
strategy:
matrix:
apache-mod-wsgi-version: ${{ fromJSON(needs.init.outputs.apache-mod-wsgi-version) }}
venv-tag: ${{ fromJSON(needs.init.outputs.venv-tag) }}
runs-on: ubuntu-latest
steps:
- name: Checkout
Expand Down Expand Up @@ -81,6 +88,9 @@ jobs:
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
- name: Set registry URL
run: |
echo "GHCR_URL=${REGISTRY}/${GITHUB_REPOSITORY,,}" >> ${GITHUB_ENV}
- name: Build and push Docker image
uses: docker/build-push-action@v6
with:
Expand All @@ -96,6 +106,9 @@ jobs:
build-args: |
MOD_WSGI_VERSION=${{ matrix.apache-mod-wsgi-version }}
CACHEBUST=${{ github.sha }}
GHCR_URL=${{ env.GHCR_URL }}
VENV_TAG=${{ matrix.venv-tag }}
PYTHON_CONTAINER=${{ case(matrix.venv-tag == '3.13-trixie-latest','python:3.13-slim-trixie','python:3.12-slim-bookworm') }}
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@0.33.1 # using latest trivy scanner
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
Expand Down Expand Up @@ -146,9 +159,14 @@ jobs:
cache-from: type=gha
cache-to: type=gha,mode=max
tags: |
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.MY_DATE }}
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.apache-mod-wsgi-version }}-${{ matrix.venv-tag }}
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.apache-mod-wsgi-version }}-${{ matrix.venv-tag }}-${{ env.MY_DATE }}
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.venv-tag }}
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.venv-tag }}-${{ env.MY_DATE }}
labels: ${{ steps.meta.outputs.labels }}
build-args: |
MOD_WSGI_VERSION=${{ matrix.apache-mod-wsgi-version }}
CACHEBUST=${{ github.sha }}
GHCR_URL=${{ env.GHCR_URL }}
VENV_TAG=${{ matrix.venv-tag }}
PYTHON_CONTAINER=${{ case(matrix.venv-tag == '3.13-trixie-latest','python:3.13-slim-trixie','python:3.12-slim-bookworm') }}
28 changes: 25 additions & 3 deletions .github/workflows/container-build-barbican.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
name: Create and publish a barbican image
name: Create and publish a Barbican image

permissions:
actions: read
Expand Down Expand Up @@ -42,26 +42,39 @@ env:
# workaround until there's a better way to handle this.
openstack_constraints: >
["unmaintained/2024.1", "stable/2025.1"]

venv_tag: >
['3.13-trixie-latest','3.12-bookworm-latest']
jobs:
init:
runs-on: ubuntu-latest
outputs:
openstack-constraints: ${{ steps.generate-matrix.outputs.openstack_constraints }}
venv-tag: ${{ steps.generate-matrix.outputs.venv_tag }}
steps:
- name: generate-matrix
id: generate-matrix
run: |
if [ "${{ github.event_name == 'workflow_dispatch' }}" = "true" ]; then
openstack_constraints="$(echo '${{ github.event.inputs.openstack-constraints }}' | jq -R '[select(length>0)]' | jq -c '.')"
venv_tag="['3.13-trixie-latest']"
if [ "${{ github.event.inputs.openstack-constraints }}" == "unmaintained/2024.1" ]; then
venv_tag="['3.12-bookworm-latest']"
fi
fi
echo "openstack_constraints=${openstack_constraints:-${{ env.openstack_constraints }}}" >> $GITHUB_OUTPUT
echo "venv_tag=${venv_tag:-${{ env.venv_tag }}}" >> $GITHUB_OUTPUT
build-and-push-image:
needs:
- init
strategy:
matrix:
openstack-constraints: ${{ fromJSON(needs.init.outputs.openstack-constraints)}}
openstack-constraints: ${{ fromJSON(needs.init.outputs.openstack-constraints) }}
venv-tag: ${{ fromJSON(needs.init.outputs.venv-tag) }}
exclude:
- openstack-constraints: unmaintained/2024.1
venv-tag: 3.13-trixie-latest
- openstack-constraints: stable/2025.1
venv-tag: 3.12-bookworm-latest
runs-on: ubuntu-latest
steps:
- name: Checkout
Expand Down Expand Up @@ -89,6 +102,9 @@ jobs:
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
- name: Set registry URL
run: |
echo "GHCR_URL=${REGISTRY}/${GITHUB_REPOSITORY,,}" >> ${GITHUB_ENV}
- name: Build and push Docker image
uses: docker/build-push-action@v6
with:
Expand All @@ -105,6 +121,9 @@ jobs:
OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}
OS_CONSTRAINTS=${{ matrix.openstack-constraints }}
CACHEBUST=${{ github.sha }}
GHCR_URL=${{ env.GHCR_URL }}
VENV_TAG=${{ matrix.venv-tag }}
PYTHON_CONTAINER=${{ case(matrix.venv-tag == '3.13-trixie-latest','python:3.13-slim-trixie','python:3.12-slim-bookworm') }}
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@0.33.1 # using latest trivy scanner
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
Expand Down Expand Up @@ -162,3 +181,6 @@ jobs:
OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}
OS_CONSTRAINTS=${{ matrix.openstack-constraints }}
CACHEBUST=${{ github.sha }}
GHCR_URL=${{ env.GHCR_URL }}
VENV_TAG=${{ matrix.venv-tag }}
PYTHON_CONTAINER=${{ case(matrix.venv-tag == '3.13-trixie-latest','python:3.13-slim-trixie','python:3.12-slim-bookworm') }}
Loading
Loading