Merge pull request #7166 from Agoric/ari/docker_github

fix: change docker publishing to github
Agoric · Mar 15, 2023 · 278a284 · 278a284
2 parents 3d87d1d + 9741377
commit 278a284
Show file tree

Hide file tree

Showing 4 changed files with 44 additions and 23 deletions.
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -9,6 +9,8 @@ on:
     tags:
       - '@agoric/sdk@*'
   workflow_dispatch:
+env:
+  REGISTRY: ghcr.io
 
 jobs:
   snapshot:
@@ -33,6 +35,9 @@ jobs:
   docker-parallel-build:
     needs: snapshot
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     strategy:
       matrix:
         platform:
@@ -55,27 +60,28 @@ jobs:
         uses: docker/setup-qemu-action@v2
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
-      - name: Login to DockerHub
+      - name: Login to Docker Registry
         uses: docker/login-action@v2
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: ${{ env.REGISTRY }}
       - name: Build and Push ssh-node
         uses: docker/build-push-action@v3
         with:
           file: packages/deployment/Dockerfile.ssh-node
           context: packages/deployment/docker
           platforms: ${{ matrix.platform }}
           push: true
-          tags: 'agoric/ssh-node:${{ env.BUILD_TAG }}'
+          tags: '${{ env.REGISTRY }}/agoric/ssh-node:${{ env.BUILD_TAG }}'
       - name: Build and Push sdk
         uses: docker/build-push-action@v3
         with:
           file: packages/deployment/Dockerfile.sdk
           context: ./
           platforms: ${{ matrix.platform }}
           push: true
-          tags: 'agoric/agoric-sdk:${{ env.BUILD_TAG }}'
+          tags: '${{ env.REGISTRY }}/agoric/agoric-sdk:${{ env.BUILD_TAG }}'
           # When changing/adding entries here, make sure to search the whole
           # project for `@@AGORIC_DOCKER_SUBMODULES@@`
           build-args: |
@@ -91,7 +97,7 @@ jobs:
           file: packages/deployment/Dockerfile
           context: packages/deployment
           platforms: ${{ matrix.platform }}
-          tags: 'agoric/cosmic-swingset-setup:${{ env.BUILD_TAG }}'
+          tags: '${{ env.REGISTRY }}/agoric/cosmic-swingset-setup:${{ env.BUILD_TAG }}'
           push: true
           build-args: |
             TAG=${{ env.BUILD_TAG }}
@@ -104,10 +110,13 @@ jobs:
           to: ${{ secrets.NOTIFY_EMAIL_TO }}
           password: ${{ secrets.NOTIFY_EMAIL_PASSWORD }}
 
-  # Publish the build's multiarch images to DockerHub.
+  # Publish the build's multiarch images to Docker Registry.
   docker-sdk:
     needs: [docker-parallel-build, snapshot]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     outputs:
       tag: '${{ steps.docker-tags.outputs.tags }}'
       tags: '${{ steps.docker-tags.outputs.tags }} ${{ needs.snapshot.outputs.tag }}'
@@ -116,11 +125,12 @@ jobs:
         uses: docker/setup-qemu-action@v2
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
-      - name: Login to DockerHub
+      - name: Login to Docker Registry
         uses: docker/login-action@v2
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: ${{ env.REGISTRY }}
       - name: Compute tags
         id: docker-tags
         run: |
@@ -153,9 +163,9 @@ jobs:
               for ARCH in linux/amd64 linux/arm64/v8; do
                 uarch=$(echo "$ARCH" | tr / _)
                 BUILD_TAG="${{ needs.snapshot.outputs.tag }}-$uarch"
-                sources="$sources $IMAGE:$BUILD_TAG"
+                sources="$sources $REGISTRY/$IMAGE:$BUILD_TAG"
               done
-              docker buildx imagetools create --tag "$IMAGE:$TAG"$sources
+              docker buildx imagetools create --tag "$REGISTRY/$IMAGE:$TAG"$sources
             done
           done
 
@@ -164,6 +174,9 @@ jobs:
   docker-ibc-alpha:
     needs: [docker-sdk, snapshot]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     if: ${{ needs.docker-sdk.outputs.tag }} != dev
     steps:
       - uses: actions/checkout@v3
@@ -172,7 +185,7 @@ jobs:
       - name: Prefix tags
         id: prefix-tags
         run: |
-          IMAGE="agoric/agoric-sdk"
+          IMAGE="$REGISTRY/agoric/agoric-sdk"
           for TAG in ibc-alpha; do
             PREFIXED="$PREFIXED$sep$IMAGE:$TAG"
             sep=,
@@ -182,11 +195,12 @@ jobs:
         uses: docker/setup-qemu-action@v2
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
-      - name: Login to DockerHub
+      - name: Login to Docker Registry
         uses: docker/login-action@v2
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: ${{ env.REGISTRY }}
       - name: Build and Push
         uses: docker/build-push-action@v3
         with:
@@ -209,14 +223,17 @@ jobs:
   docker-solo:
     needs: [docker-sdk, snapshot]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v3
       - name: Save SDK_TAG
         run: echo "SDK_TAG=${{ needs.snapshot.outputs.tag }}" >> $GITHUB_ENV
       - name: Prefix tags
         id: prefix-tags
         run: |
-          IMAGE="agoric/cosmic-swingset-solo"
+          IMAGE="$REGISTRY/agoric/cosmic-swingset-solo"
           for TAG in ${{ needs.docker-sdk.outputs.tags }}; do
             PREFIXED="$PREFIXED$sep$IMAGE:$TAG"
             sep=,
@@ -226,11 +243,12 @@ jobs:
         uses: docker/setup-qemu-action@v2
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
-      - name: Login to DockerHub
+      - name: Login to Docker Registry
         uses: docker/login-action@v2
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: ${{ env.REGISTRY }}
       - name: Build and Push
         uses: docker/build-push-action@v3
         with:

diff --git a/packages/deployment/Dockerfile b/packages/deployment/Dockerfile
@@ -1,5 +1,6 @@
 ARG TAG=latest
 ARG REPO=agoric/agoric-sdk
+ARG REGISTRY=ghcr.io
 
 # FIXME: Journalbeat compilation is currently broken, but non-essential.
 # Removed from the build.
@@ -9,7 +10,7 @@ ARG REPO=agoric/agoric-sdk
 # RUN apt-get update -y && apt-get install -y libsystemd-dev
 # RUN go get github.com/mheese/journalbeat
 
-FROM $REPO:$TAG
+FROM $REGISTRY/$REPO:$TAG
 
 RUN /usr/src/agoric-sdk/packages/deployment/scripts/install-deps.sh
 

diff --git a/packages/deployment/Dockerfile.ibc-alpha b/packages/deployment/Dockerfile.ibc-alpha
@@ -1,3 +1,4 @@
 ARG SDK_TAG=latest
-FROM agoric/agoric-sdk:$SDK_TAG
+ARG REGISTRY=ghcr.io
+FROM $REGISTRY/agoric/agoric-sdk:$SDK_TAG
 ENTRYPOINT [ "/usr/src/agoric-sdk/packages/cosmic-swingset/scripts/chain-entry.sh", "single-node" ]
diff --git a/packages/solo/Dockerfile b/packages/solo/Dockerfile
@@ -1,5 +1,6 @@
 ARG TAG=latest
-FROM agoric/agoric-sdk:$TAG
+ARG REGISTRY=ghcr.io
+FROM $REGISTRY/agoric/agoric-sdk:$TAG
 
 WORKDIR /data/solo