feat: add Alpine image #33
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build and publish a Docker image. | |
| # | |
| # Assumed to run as a subworkflow of .github/workflows/release.yml; specifically, as a local | |
| # artifacts job within `cargo-dist`. | |
| # | |
| # Adapted from https://github.com/astral-sh/ty/blob/main/.github/workflows/build-docker.yml | |
| name: "Build Docker image" | |
| on: | |
| workflow_call: | |
| inputs: | |
| plan: | |
| required: true | |
| type: string | |
| pull_request: | |
| paths: | |
| - .github/workflows/build-docker.yml | |
| env: | |
| PREK_BASE_IMG: ghcr.io/${{ github.repository_owner }}/prek | |
| PREK_ALPINE_IMG: ghcr.io/${{ github.repository_owner }}/prek-alpine | |
| permissions: | |
| contents: read | |
| packages: write # zizmor: ignore[excessive-permissions] | |
| jobs: | |
| docker-build: | |
| name: Build Docker image (${{ matrix.image }}, ${{ matrix.platform }}) | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: release | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: | |
| - linux/amd64 | |
| - linux/arm64 | |
| image: | |
| - minimal | |
| - alpine | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Check tag consistency | |
| if: ${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }} | |
| env: | |
| TAG: ${{ inputs.plan != '' && fromJson(inputs.plan).announcement_tag || 'dry-run' }} | |
| run: | | |
| version=$(grep -m 1 "^version = " pyproject.toml | sed -e 's/version = "\(.*\)"/\1/g') | |
| if [ "${TAG}" != "v${version}" ]; then | |
| echo "The input tag does not match the version from pyproject.toml:" >&2 | |
| echo "${TAG}" >&2 | |
| echo "${version}" >&2 | |
| exit 1 | |
| else | |
| echo "Releasing ${version}" | |
| fi | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 | |
| env: | |
| DOCKER_METADATA_ANNOTATIONS_LEVELS: index | |
| with: | |
| images: ${{ matrix.image == 'alpine' && env.PREK_ALPINE_IMG || env.PREK_BASE_IMG }} | |
| # Defining this makes sure the org.opencontainers.image.version OCI label becomes the actual release version and not the branch name | |
| tags: | | |
| type=raw,value=dry-run,enable=${{ inputs.plan == '' || fromJson(inputs.plan).announcement_tag_is_implicit }} | |
| type=semver,pattern={{ raw }},value=${{ inputs.plan != '' && fromJson(inputs.plan).announcement_tag || 'dry-run' }},enable=${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }} | |
| - name: Normalize Platform Pair (replace / with -) | |
| run: | | |
| platform=${{ matrix.platform }} | |
| echo "PLATFORM_TUPLE=${platform//\//-}" >> "$GITHUB_ENV" | |
| # Adapted from https://docs.docker.com/build/ci/github-actions/multi-platform/ | |
| - name: Build and push by digest | |
| id: build | |
| uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 | |
| with: | |
| context: . | |
| platforms: ${{ matrix.platform }} | |
| target: ${{ matrix.image }} | |
| cache-from: type=gha,scope=prek-${{ matrix.image }}-${{ env.PLATFORM_TUPLE }} | |
| cache-to: type=gha,mode=min,scope=prek-${{ matrix.image }}-${{ env.PLATFORM_TUPLE }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| outputs: type=image,name=${{ matrix.image == 'alpine' && env.PREK_ALPINE_IMG || env.PREK_BASE_IMG }},push-by-digest=true,name-canonical=true,push=${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }} | |
| - name: Export digests | |
| env: | |
| digest: ${{ steps.build.outputs.digest }} | |
| run: | | |
| mkdir -p /tmp/digests | |
| touch "/tmp/digests/${digest#sha256:}" | |
| - name: Upload digests | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| name: digests-${{ matrix.image }}-${{ env.PLATFORM_TUPLE }} | |
| path: /tmp/digests/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| docker-publish: | |
| name: Publish Docker image (${{ matrix.image }}) | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: release | |
| needs: | |
| - docker-build | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| if: ${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| image: | |
| - minimal | |
| - alpine | |
| steps: | |
| - name: Download digests | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: /tmp/digests | |
| pattern: digests-${{ matrix.image }}-* | |
| merge-multiple: true | |
| - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 | |
| env: | |
| DOCKER_METADATA_ANNOTATIONS_LEVELS: index | |
| with: | |
| images: ${{ matrix.image == 'alpine' && env.PREK_ALPINE_IMG || env.PREK_BASE_IMG }} | |
| # Order is on purpose such that the label org.opencontainers.image.version has the first pattern with the full version | |
| tags: | | |
| type=raw,value=${{ fromJson(inputs.plan).announcement_tag }} | |
| type=semver,pattern=v{{ major }}.{{ minor }},value=${{ fromJson(inputs.plan).announcement_tag }} | |
| - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Adapted from https://docs.docker.com/build/ci/github-actions/multi-platform/ | |
| - name: Create manifest list and push | |
| working-directory: /tmp/digests | |
| env: | |
| IMAGE_NAME: ${{ matrix.image == 'alpine' && env.PREK_ALPINE_IMG || env.PREK_BASE_IMG }} | |
| run: | | |
| # shellcheck disable=SC2046 | |
| readarray -t lines <<< "$DOCKER_METADATA_OUTPUT_ANNOTATIONS"; annotations=(); for line in "${lines[@]}"; do annotations+=(--annotation "$line"); done | |
| docker buildx imagetools create \ | |
| "${annotations[@]}" \ | |
| $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | |
| $(printf "${IMAGE_NAME}@sha256:%s " *) | |
| - name: Export manifest digest | |
| id: manifest-digest | |
| env: | |
| IMAGE_NAME: ${{ matrix.image == 'alpine' && env.PREK_ALPINE_IMG || env.PREK_BASE_IMG }} | |
| VERSION: ${{ steps.meta.outputs.version }} | |
| run: | | |
| digest="$( | |
| docker buildx imagetools inspect \ | |
| "${IMAGE_NAME}:${VERSION}" \ | |
| --format '{{json .Manifest}}' \ | |
| | jq -r '.digest' | |
| )" | |
| echo "digest=${digest}" >> "$GITHUB_OUTPUT" | |
| - name: Generate artifact attestation | |
| uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 | |
| with: | |
| subject-name: ${{ matrix.image == 'alpine' && env.PREK_ALPINE_IMG || env.PREK_BASE_IMG }} | |
| subject-digest: ${{ steps.manifest-digest.outputs.digest }} |