From 8b8cc76127bcffca0598dded9fca9002cf85c177 Mon Sep 17 00:00:00 2001 From: Ivan Kozelskikh Date: Sat, 28 Sep 2024 13:26:03 +0500 Subject: [PATCH] IHS-86 Multiplatform containers (#87) * add multiplatform builds refactoring github actions --- .../workflows/publish-container-webapi.yml | 86 ------------------- ...iner-tagger.yml => publish-containers.yml} | 27 ++++-- 2 files changed, 21 insertions(+), 92 deletions(-) delete mode 100644 .github/workflows/publish-container-webapi.yml rename .github/workflows/{publish-container-tagger.yml => publish-containers.yml} (79%) diff --git a/.github/workflows/publish-container-webapi.yml b/.github/workflows/publish-container-webapi.yml deleted file mode 100644 index cce710c..0000000 --- a/.github/workflows/publish-container-webapi.yml +++ /dev/null @@ -1,86 +0,0 @@ -name: Publish WebAPI to GitHub container registry - -on: - push: - branches: [ "master" ] - -env: - REGISTRY: ghcr.io - IMAGE_NAME: image-hosting-storage-webapi - - -jobs: - publish-container: - runs-on: ubuntu-latest - - permissions: - contents: read - packages: write - # This is used to complete the identity challenge - # with sigstore/fulcio when running outside of PRs. - id-token: write - - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - # Install the cosign tool except on PR - # https://github.com/sigstore/cosign-installer - - name: Install cosign - if: github.event_name != 'pull_request' - uses: sigstore/cosign-installer@v3.3.0 - with: - cosign-release: 'v2.2.2' - - # Set up BuildKit Docker container builder to be able to build - # multi-platform images and export cache - # https://github.com/docker/setup-buildx-action - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - # Login against a Docker registry except on PR - # https://github.com/docker/login-action - - name: Log into registry ${{ env.REGISTRY }} - if: github.event_name != 'pull_request' - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - # Extract metadata (tags, labels) for Docker - # https://github.com/docker/metadata-action - - name: Extract Docker metadata - id: meta - uses: docker/metadata-action@v5 - with: - images: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}" - - # Build and push Docker image with Buildx (don't push on PR) - # https://github.com/docker/build-push-action - - name: Build and push Docker image - id: build-and-push - uses: docker/build-push-action@v5 - with: - context: . - file: ./src/ImageHosting.Storage.WebApi/Dockerfile - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data even for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign - - name: Sign the published Docker image - if: ${{ github.event_name != 'pull_request' }} - env: - # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable - TAGS: ${{ steps.meta.outputs.tags }} - DIGEST: ${{ steps.build-and-push.outputs.digest }} - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} diff --git a/.github/workflows/publish-container-tagger.yml b/.github/workflows/publish-containers.yml similarity index 79% rename from .github/workflows/publish-container-tagger.yml rename to .github/workflows/publish-containers.yml index 20f619a..b27800d 100644 --- a/.github/workflows/publish-container-tagger.yml +++ b/.github/workflows/publish-containers.yml @@ -1,4 +1,4 @@ -name: Publish Tagger Hosted Service to GitHub container registry +name: Publish to GitHub container registry on: push: @@ -6,12 +6,23 @@ on: env: REGISTRY: ghcr.io - IMAGE_NAME: image-hosting-storage-tagger - + ORGANIZATION: baklanov-soft jobs: - publish-container: + publish-containers: runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + platform: + - linux/amd64 + - linux/arm64/v8 + include: + - dockerfile: ./src/ImageHosting.Storage.WebApi/Dockerfile + image: ${{ env.REGISTRY }}/${{ env.ORGANIZATION }}/image-hosting-storage-webapi + - dockerfile: ./src/ImageHosting.Storage.Tagger/Dockerfile + image: ${{ env.REGISTRY }}/${{ env.ORGANIZATION }}/image-hosting-storage-tagger permissions: contents: read @@ -31,6 +42,9 @@ jobs: uses: sigstore/cosign-installer@v3.3.0 with: cosign-release: 'v2.2.2' + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 # Set up BuildKit Docker container builder to be able to build # multi-platform images and export cache @@ -54,7 +68,7 @@ jobs: id: meta uses: docker/metadata-action@v5 with: - images: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}" + images: ${{ matrix.image }} # Build and push Docker image with Buildx (don't push on PR) # https://github.com/docker/build-push-action @@ -63,7 +77,8 @@ jobs: uses: docker/build-push-action@v5 with: context: . - file: ./src/ImageHosting.Storage.Tagger/Dockerfile + file: ${{ matrix.dockerfile }} + platforms: ${{ matrix.platform }} push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }}