Build and publish 'decidim' and 'decidim-generator' images on Github.

[oliverbarnes]

A first stab at building Decidim docker images using Github Actions.

You can see it in action (pun intended) here: https://github.com/oliverbarnes/decidim-docker/actions?query=workflow%3ACI

The images are published to the new Github Container Registry, available in beta and opted-in through the organization's settings.

Images generated during testing this PR ca be seen here:

https://github.com/users/oliverbarnes/packages/container/package/decidim-generator
https://github.com/users/oliverbarnes/packages/container/package/decidim

It adapts the existing Dockerfile and Dockerfile-deploy files to build images and publish them to the Github registry. It doesn't build the -dev and -test Dockerfiles, as there's an ongoing discussion about which should be the canonical images (#53).

(The original circleci workflow publishing to Docker Hub is preserved, with original Dockerfiles, and can be run in parallel during a transition period.)

Note that this also changes the name of the image generated from the main Dockerfile from decidim to decidim-generator, to better describe that the image contains the ruby/node env to generate a Decidim app, leaving the decidim image name for the deployable production image generated from Dockerfile-deploy.

The Github workflow extracts the Decidim version from the latest decidim/decidim repo tag, and latest ruby version from the .ruby-version file on the same repo and tag.

Not implemented yet: triggering this automatically when a new decidim/decidim tag is released. There's a possible route available through repository dispatches

Automatic triggering of this build is ready for review at decidim/decidim#6931.

Closes #49

[oliverbarnes]

@tramuntanal @oriolgual what do you think?

(pinging the two of you as you're the latest committers :) I'm assuming you're both maintaining the repo?)

[armandfardeau]

Hi @oliverbarnes, this looks great!
However, it could be useful to add a new section in the readme on how to build locally.

[tramuntanal]

I understand that by merging this PR we would have two parallel ways to push to docker hub.
It would be better to stick with only one.

@oliverbarnes how do you propose to do the transition?

[oliverbarnes]

I understand that by merging this PR we would have two parallel ways to push to docker hub.
It would be better to stick with only one.

@oliverbarnes how do you propose to do the transition?

Good question, I don't I have a clear path in mind yet and would like to discuss.

The workflow in this PR actually pushes to Github's own registry, but it could publish to Docker Hub as well. I'm publishing to GH here as it integrates well with Github Actions and it's an alternative to consider in face of Docker Hub's latest restrictions to repos on free plans.

Docker Hub has the clear advantage of being the default, one just has to run:

docker run decidim:latest

as opposed to this in Github's case:

docker run docker.pkg.github.com/decidim/docker/decidim:latest

With Github the user also needs to be previously authenticated with GH beforehand, whereas Docker Hub allows for anonymous pulls (for now). Here's a comparison between both registry's (and Amazon's), for reference.

One possibility is to publish to both for a while, to see how it goes?

If we modify this we should also modify script/build_images.sh otherwise docker hub won't have the images published because the script will crash no?

That's true. I'm proposing to replace the build scripts and circle ci with the Github workflow.

[oliverbarnes]

Note that this also changes the name of the image generated from the main Dockerfile from decidim to decidim-generator, to better describe that the image contains the ruby/node env to generate a decidim app, and to leave the decidim image name for the deployable production image. I'll update the PR description with this.

[oliverbarnes]

I've set this PR back to draft, and am now updating the workflow according to the reviews on a sandbox PR against my own repo, to test out the build there on pull request rather than on merge: https://github.com/oliverbarnes/decidim-docker/pull/2

[oliverbarnes]

Just learned about the new Github Container Registry in beta, which will replace the Package Registry. I haven't read-up much on it yet, but it'll at least allow for shorter image urls:

ghcr.io/decidim/decidim

Instead of

docker.pkg.github.com/decidim/docker/decidim

(it won't be repo based)

[oliverbarnes]

Ready for another pass. Updates:

• fetches the .ruby-version from latest tag
• publishes the app image to Github Packages as well
• updates Dockerfile-deploy to generate a Decidim app internally using the base decidim-generator image
• moves the original Dockerfiles to /dockerhub and updates the pre-existing circleci/Docker Hub flow as to not disrupt current image publishing

[oliverbarnes]

Just learned about the new Github Container Registry in beta, which will replace the Package Registry. I haven't read-up much on it yet, but it'll at least allow for shorter image urls:

Ended up switching to the new registry already, as it fixes an issue I was having with publishing the built decidim image using decidim-generator as base.

Here are the published images on the new registry, published through my account while this is WIP:

https://github.com/users/oliverbarnes/packages/container/package/decidim-generator
https://github.com/users/oliverbarnes/packages/container/package/decidim

[oliverbarnes]

@tramuntanal would you review this again when you get a chance, please?

[oliverbarnes]

@tramuntanal Docker Hub publishing is preserved and automated Github publishing is now done in parallel (and we can eventually publish to Docker Hub as well). I think this is good for another review and possibly merge?

Merging now would be good to unblock work on automating releases, and work that's under way with configurable images (#61) as well 🙏

[tramuntanal]

@oliverbarnes we must take into account that other repos are using *-test images to execute their test suites like https://github.com/AjuntamentdeBarcelona/decidim-barcelona, https://github.com/AjuntamentdeBarcelona/decidim-barcelona-organizations or https://github.com/AjuntamentdeBarcelona/decidim-barcelona, when we have this merged we should check these repos

[oliverbarnes]

Thanks @tramuntanal! That's good to know - I've created an issue to add it to the flow, as well as the *-dev images.

[oliverbarnes]

Btw, @tramuntanal a few steps are still needed to be taken for the flow to be enabled:

• opting-in to the Github Container Registry through the organization's settings
• Adding a PAT_TOKEN secret (or create a Github App so we can authenticate with it - this will require another PR to update the registry step). Meanwhile, the build won't work
• And while the image building will be triggered on updates to the Dockerfiles and to the workflow manifest, the full automation will only happen once GitHub Action workflow on release triggering decidim/docker build decidim#6931 is merged. That also needs either a PAT_TOKEN secret or a Github App (safest) to be setup.