circulation/.github/workflows/build-base-image.yml at main · ThePalaceProject/circulation · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: Build Base Image
on:
  schedule:
    # Every Monday at 6:22am Eastern Time
    - cron: '22 10 * * 1'
  push:
    # Build base image when the Dockerfile or the workflow file changes
    branches:
      - main
    paths:
      - .github/workflows/build-base-image.yml
      - docker/Dockerfile.baseimage
  workflow_dispatch:
    # Allow us to manually trigger build

concurrency:
  # This concurrency group is used to prevent multiple builds from running at the same time.
  group: build-base-${{ github.ref_name }}-${{ github.event_name }}
  cancel-in-progress: true

jobs:
  build:
    name: Build Base Image (${{ matrix.arch.name }})
    strategy:
      fail-fast: false
      matrix:
        arch:
          - name: "amd64"
            runner: "ubuntu-24.04"
          - name: "arm64"
            runner: "ubuntu-24.04-arm"

    runs-on: ${{ matrix.arch.runner }}

    timeout-minutes: 120
    permissions:
      contents: read
      packages: write

    outputs:
      repo: ${{ steps.ghcr-repo.outputs.baseimage }}
      meta: ${{ steps.meta.outputs.json }}

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      # See comment here: https://github.com/actions/runner-images/issues/1187#issuecomment-686735760
      - name: Disable network offload
        run: sudo ethtool -K eth0 tx off rx off

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set GHCR repos
        # Docker doesn't support uppercase letters in repo names, so we need to lowercase the owner
        id: ghcr-repo
        run: |
          baseimage="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/circ-baseimage"
          echo "$baseimage"
          echo "baseimage=$baseimage" >> "$GITHUB_OUTPUT"

      - name: Generate tags for image
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ steps.ghcr-repo.outputs.baseimage }}
          # Generate tags for the image
          # We use the following tags:
            # - The date in YYYYww format, which is the year and week number. 202052 is the last week of 2020.
            # - The latest tag
          tags: |
            type=schedule,pattern={{date 'YYYYww'}}
            type=raw,value=latest

      - name: Build base image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./docker/Dockerfile.baseimage
          labels: ${{ steps.meta.outputs.labels }}
          target: baseimage
          cache-to: type=inline
          outputs: type=image,"name=${{ steps.ghcr-repo.outputs.baseimage }}",push-by-digest=true,name-canonical=true,push=true

      - name: Export digests
        run: |
          mkdir -p ${{ runner.temp }}/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digests
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ matrix.arch.name }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  push:
    name: Tag & Push Images
    runs-on: ubuntu-24.04
    needs: [build]
    permissions:
      contents: read
      packages: write

    steps:
      - name: Download digests
        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest & push images
        working-directory: ${{ runner.temp }}/digests
        run: >
          docker buildx imagetools create
          $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< '${{ needs.build.outputs.meta }}')
          $(printf '${{ needs.build.outputs.repo }}@sha256:%s ' *)