Automate Docker Image Build and Publish

.github/scripts/check-latest-tag.js

@@ -0,0 +1,47 @@
+const { execFileSync } = require('child_process');
+const fs = require('fs');
+
+const releaseTag = process.env.RELEASE_TAG;
+const version = releaseTag.startsWith('v') ? releaseTag.slice(1) : releaseTag;
+const sourceImage = `temporalio/temporal:${version}`;
+const latestImage = 'temporalio/temporal:latest';
+
+// Set outputs for use in next step
+fs.appendFileSync(process.env.GITHUB_OUTPUT, `version=${version}\n`);
+fs.appendFileSync(process.env.GITHUB_OUTPUT, `source_image=${sourceImage}\n`);
+fs.appendFileSync(process.env.GITHUB_OUTPUT, `latest_image=${latestImage}\n`);
+
+console.log(`Version: ${version}`);
+console.log('Checking if image is already tagged as latest...');
+
+try {
+  const latestManifest = execFileSync(
+    'docker',
+    ['manifest', 'inspect', latestImage],
+    { encoding: 'utf8' }
+  );
+  const latestDigest = JSON.parse(latestManifest).config.digest;
+
+  const sourceManifest = execFileSync(
+    'docker',
+    ['manifest', 'inspect', sourceImage],
+    { encoding: 'utf8' }
+  );
+  const sourceDigest = JSON.parse(sourceManifest).config.digest;
+
+  if (latestDigest === sourceDigest) {
+    console.log(`Image ${version} is already tagged as latest`);
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, 'already_latest=true\n');
+    process.exit(0);
+  }
+
+  console.log(`Latest digest: ${latestDigest}`);
+  console.log(`Source digest: ${sourceDigest}`);
+  console.log('Digests do not match, will update latest tag');
+  fs.appendFileSync(process.env.GITHUB_OUTPUT, 'already_latest=false\n');
+
+} catch (error) {
+  console.log('Could not compare digests (image may not exist yet)');
+  console.log(`Error: ${error.message}`);
+  fs.appendFileSync(process.env.GITHUB_OUTPUT, 'already_latest=false\n');
+}

.github/workflows/build-and-publish.yml

@@ -0,0 +1,191 @@
+name: Build and Publish (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      publish:
+        description: "Whether to publish the release and Docker image"
+        required: true
+        type: boolean
+      version:
+        description: "Version tag for the release (required if publish is true)"
+        required: false
+        type: string
+      registry_namespace:
+        description: "Registry namespace/organization"
+        required: false
+        type: string
+        default: "temporalio"
+      image_name:
+        description: "Image name"
+        required: false
+        type: string
+        default: "temporal"
+    secrets:
+      DOCKER_USERNAME:
+        required: false
+      DOCKER_PASSWORD:
+        required: false
+
+jobs:
+  build:
+    name: Build and Publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: "go.mod"
+          check-latest: true
+          cache: true
+
+      - name: Get build date
+        id: date
+        run: echo "date=$(date '+%F-%T')" >> "$GITHUB_OUTPUT"
+
+      - name: Get build unix timestamp
+        id: timestamp
+        run: echo "timestamp=$(date '+%s')" >> "$GITHUB_OUTPUT"
+
+      - name: Get git branch
+        id: branch
+        run: echo "branch=$(git rev-parse --abbrev-ref HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Get build platform
+        id: platform
+        run: echo "platform=$(go version | cut -d ' ' -f 4)" >> "$GITHUB_OUTPUT"
+
+      - name: Get Go version
+        id: go
+        run: echo "go=$(go version | cut -d ' ' -f 3)" >> "$GITHUB_OUTPUT"
+
+      - name: Check if release is latest
+        if: inputs.publish
+        id: check_latest_release
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const releaseTag = '${{ inputs.version }}';
+            const { data: release } = await github.rest.repos.getReleaseByTag({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              tag: releaseTag
+            });
+
+            const isLatest = !release.prerelease && !release.draft;
+            core.setOutput('is_latest', isLatest);
+            console.log(`Release: ${release.tag_name}`);
+            console.log(`Prerelease: ${release.prerelease}, Draft: ${release.draft}`);
+            console.log(`Should tag as latest: ${isLatest}`);
+
+      - name: Run GoReleaser (release)
+        if: inputs.publish
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: v2.12.7
+          args: release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BUILD_DATE: ${{ steps.date.outputs.date }}
+          BUILD_TS_UNIX: ${{ steps.timestamp.outputs.timestamp }}
+          GIT_BRANCH: ${{ steps.branch.outputs.branch }}
+          BUILD_PLATFORM: ${{ steps.platform.outputs.platform }}
+          GO_VERSION: ${{ steps.go.outputs.go }}
+
+      - name: Run GoReleaser (snapshot)
+        if: ${{ !inputs.publish }}
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: v2.12.7
+          args: release --snapshot --clean
+        env:
+          BUILD_DATE: ${{ steps.date.outputs.date }}
+          BUILD_TS_UNIX: ${{ steps.timestamp.outputs.timestamp }}
+          GIT_BRANCH: ${{ steps.branch.outputs.branch }}
+          BUILD_PLATFORM: ${{ steps.platform.outputs.platform }}
+          GO_VERSION: ${{ steps.go.outputs.go }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Get build metadata
+        id: meta
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+          INPUT_REGISTRY_NAMESPACE: ${{ inputs.registry_namespace }}
+          INPUT_IMAGE_NAME: ${{ inputs.image_name }}
+          REPO_OWNER: ${{ github.repository_owner }}
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const inputVersion = process.env.INPUT_VERSION;
+            const inputPublish = process.env.INPUT_PUBLISH;
+            const inputRegistryNamespace = process.env.INPUT_REGISTRY_NAMESPACE;
+            const repoOwner = process.env.REPO_OWNER;
+
+            // Get git information
+            const { execSync } = require('child_process');
+            const cliSha = execSync('git rev-parse HEAD', { encoding: 'utf8' }).trim();
+            const imageShaTag = execSync('git rev-parse --short HEAD', { encoding: 'utf8' }).trim();
+
+            core.setOutput('cli_sha', cliSha);
+            core.setOutput('image_sha_tag', imageShaTag);
+
+            // Determine version
+            let version;
+            if (inputPublish === 'true') {
+              // Get version from input, strip 'v' prefix
+              version = inputVersion.startsWith('v') ? inputVersion.slice(1) : inputVersion;
+            } else {
+              version = 'snapshot';
+            }
+            core.setOutput('version', version);
+
+            // Set namespace (defaults to repository owner)
+            const namespace = inputRegistryNamespace || repoOwner;
+            core.setOutput('image_namespace', namespace);
+
+      - name: Build Docker image
+        if: ${{ !inputs.publish }}
+        run: |
+          docker buildx bake \
+            --file docker-bake.hcl \
+            cli
+        env:
+          CLI_SHA: ${{ steps.meta.outputs.cli_sha }}
+          IMAGE_SHA_TAG: ${{ steps.meta.outputs.image_sha_tag }}
+          VERSION: ${{ steps.meta.outputs.version }}
+          TAG_LATEST: false
+          IMAGE_NAMESPACE: ${{ inputs.registry_namespace }}
+          IMAGE_NAME: ${{ inputs.image_name }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+
+      - name: Log in to Docker Hub
+        if: inputs.publish
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Build and push Docker image
+        if: ${{ inputs.publish }}
+        run: |
+          docker buildx bake \
+            --file docker-bake.hcl \
+            --push \
+            cli
+        env:
+          CLI_SHA: ${{ steps.meta.outputs.cli_sha }}
+          IMAGE_SHA_TAG: ${{ steps.meta.outputs.image_sha_tag }}
+          VERSION: ${{ steps.meta.outputs.version }}
+          TAG_LATEST: ${{ steps.check_latest_release.outputs.is_latest == 'true' }}
+          IMAGE_NAMESPACE: ${{ steps.meta.outputs.image_namespace }}
+          IMAGE_NAME: ${{ inputs.image_name }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+

.github/workflows/build-docker-image.yml

@@ -0,0 +1,15 @@
+name: Build Docker Image
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build-and-publish.yml
+    with:
+      publish: false

.github/workflows/release.yml

@@ -0,0 +1,21 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  release:
+    types:
+      - published
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  release:
+    uses: ./.github/workflows/build-and-publish.yml
+    with:
+      publish: true
+      version: ${{ github.ref_name }}
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/trigger-docs.yml

@@ -3,32 +3,39 @@ on:
   workflow_dispatch:
   release:
     types: [published]
+
+permissions:
+  contents: read
+
 jobs:
   update:
+    if: github.repository == 'temporalio/cli'
     runs-on: ubuntu-latest
     defaults:
       run:
         shell: bash
     steps:
       - name: Get user info from GitHub API
         id: get_user
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
         run: |
-          echo "GitHub actor: ${{ github.actor }}"
+          echo "GitHub actor: ${GITHUB_ACTOR}"
           # Query the GitHub API for the user's details.
           curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-            https://api.github.com/users/${{ github.actor }} > user.json
-          
+            "https://api.github.com/users/${GITHUB_ACTOR}" > user.json
+
           # Extract the user's full name if available, default to the username otherwise.
           git_name=$(jq -r '.name // empty' user.json)
           if [ -z "$git_name" ]; then
-            git_name="${{ github.actor }}"
+            git_name="${GITHUB_ACTOR}"
           fi
-          
-          git_email="${{ github.actor }}@users.noreply.github.com"
-          
+
+          git_email="${GITHUB_ACTOR}@users.noreply.github.com"
+
           # Set the outputs for subsequent steps.
-          echo "GIT_NAME=$git_name" >> $GITHUB_OUTPUT
-          echo "GIT_EMAIL=$git_email" >> $GITHUB_OUTPUT
+          echo "GIT_NAME=$git_name" >> "$GITHUB_OUTPUT"
+          echo "GIT_EMAIL=$git_email" >> "$GITHUB_OUTPUT"
 
       - name: Generate token
         id: generate_token