Build multi-architecture images #197
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,16 +8,52 @@ on: | |
| pull_request: | ||
| branches: [ master ] | ||
|
|
||
|
|
||
| env: | ||
| CI: true | ||
|
|
||
|
|
||
| # Job progression. We make sure that the base image [oss] builds and passes tests before kicking off the other builds | ||
|
|
||
| # ┌──────────────────┐ ┌────────────────┐ ┌────────────────┐ | ||
| # ┌─────────┐ ┌─────────┬────► Build Latest NJS ├────────►Test Latest NJS ├─────►│Push Latest NJS │ | ||
| # │Build OSS├────►│Test OSS │ └──────────────────┘ └────────────────┘ └────────────────┘ | ||
| # └─────────┘ └──┬──────┤ | ||
| # │ │ ┌──────────────────┐ ┌──────────────────┐ ┌─────────────────┐ | ||
| # │ └────►Build Unprivileged├───────►Test Unprivileged ├────►│Push Unprivileged│ | ||
| # │ └──────────────────┘ └──────────────────┘ ├────────┬────────┘ | ||
| # │ ├────────┤ | ||
| # └──────────────────────────────────────────────────────────────►│Push OSS│ | ||
| # └────────┘ | ||
|
|
||
| # As a last step, if we are on the main/master branch, multi-architecture images will be built and pushed to github packages | ||
| # and docker hub | ||
|
|
||
| jobs: | ||
| build-oss-for-test: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| - name: Build and export | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| file: Dockerfile.oss | ||
| context: . | ||
| tags: nginx-s3-gateway , nginx-s3-gateway:oss | ||
| outputs: type=docker,dest=/tmp/oss.tar | ||
| - name: Upload artifact | ||
| uses: actions/upload-artifact@v3 | ||
| with: | ||
| name: oss | ||
| path: /tmp/oss.tar | ||
|
There was a problem hiding this comment. annotation: The other two images use this as a base. Therefore we export the built image for use in:
|
||
|
|
||
| test-oss: | ||
| runs-on: ubuntu-latest | ||
| needs: build-oss-for-test | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Install dependencies | ||
| run: sudo apt-get update -qq && sudo apt-get install -y curl wait-for-it | ||
| - name: Restore cached binaries | ||
|
|
@@ -34,35 +70,58 @@ jobs: | |
| curl --insecure --retry 6 --fail --silent --location "https://dl.min.io/client/mc/release/linux-$(dpkg --print-architecture)/archive/mc.RELEASE.2023-06-19T19-31-19Z.sha256sum" | sha256sum --check - | ||
| mv mc.RELEASE.2023-06-19T19-31-19Z mc | ||
| chmod +x mc | ||
|
|
||
| - name: Download artifact | ||
| uses: actions/download-artifact@v3 | ||
| with: | ||
| name: oss | ||
| path: /tmp | ||
| - name: Load image | ||
| run: | | ||
| docker load --input /tmp/oss.tar | ||
| - name: Run tests - stable njs version | ||
| run: ./test.sh --type oss | ||
|
|
||
| build-latest-njs-for-test: | ||
| runs-on: ubuntu-latest | ||
| needs: test-oss | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| with: | ||
| driver: docker | ||
| - name: Download artifact | ||
| uses: actions/download-artifact@v3 | ||
| with: | ||
| name: oss | ||
| path: /tmp | ||
| - name: Load image | ||
| run: | | ||
| docker load --input /tmp/oss.tar | ||
| - name: Build and load oss image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| file: Dockerfile.latest-njs | ||
| context: . | ||
| tags: nginx-s3-gateway:latest-njs-oss | ||
| load: true | ||
| # Save manually here since we need to use the `docker` buildx `driver` but that can't output | ||
| # a file that upload-artifact likes. | ||
| - name: save image | ||
| run: | | ||
| docker save nginx-s3-gateway:latest-njs-oss > /tmp/latest-njs.tar | ||
| - name: Upload artifact - latest-njs | ||
| uses: actions/upload-artifact@v3 | ||
| with: | ||
| name: latest-njs | ||
| path: /tmp/latest-njs.tar | ||
|
|
||
| test-latest-njs: | ||
| runs-on: ubuntu-latest | ||
| needs: build-latest-njs-for-test | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Install dependencies | ||
| run: sudo apt-get update -qq && sudo apt-get install -y curl wait-for-it | ||
| - name: Restore cached binaries | ||
|
|
@@ -75,79 +134,159 @@ jobs: | |
| run: | | ||
| mkdir .bin || exit 0 | ||
| cd .bin | ||
| curl --insecure --retry 6 --fail --location --output mc.RELEASE.2023-06-19T19-31-19Z "https://dl.min.io/client/mc/release/linux-$(dpkg --print-architecture)/archive/mc.RELEASE.2023-06-19T19-31-19Z" | ||
| curl --insecure --retry 6 --fail --silent --location "https://dl.min.io/client/mc/release/linux-$(dpkg --print-architecture)/archive/mc.RELEASE.2023-06-19T19-31-19Z.sha256sum" | sha256sum --check - | ||
| mv mc.RELEASE.2023-06-19T19-31-19Z mc | ||
| chmod +x mc | ||
| - name: Download artifact | ||
| uses: actions/download-artifact@v3 | ||
| with: | ||
| name: latest-njs | ||
| path: /tmp | ||
| - name: Load image | ||
| run: | | ||
| docker load --input /tmp/latest-njs.tar | ||
| docker tag nginx-s3-gateway:latest-njs-oss nginx-s3-gateway | ||
| - name: Run tests - latest njs version | ||
| run: ./test.sh --latest-njs --type oss | ||
|
|
||
| build-unprivileged-for-test: | ||
| runs-on: ubuntu-latest | ||
| needs: test-oss | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| with: | ||
| driver: docker | ||
|
There was a problem hiding this comment. annotation: |
||
| - name: Download artifact | ||
| uses: actions/download-artifact@v3 | ||
| with: | ||
| name: oss | ||
| path: /tmp | ||
|
There was a problem hiding this comment. I would check to see if github actions has defined an environment variable for the temp path. Generally, it isn't great to assume that There was a problem hiding this comment. Thank you for this note. I discovered |
||
| - name: Load image | ||
| run: | | ||
| docker load --input /tmp/oss.tar | ||
| - name: Build and load oss image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| file: Dockerfile.unprivileged | ||
| context: . | ||
| tags: nginx-s3-gateway:unprivileged-oss | ||
| load: true | ||
| # Save manually here since we need to use the `docker` buildx `driver` but that can't output | ||
| # a file that upload-artifact likes. | ||
| - name: save image | ||
| run: | | ||
| docker save nginx-s3-gateway:unprivileged-oss > /tmp/unprivileged.tar | ||
| - name: Upload artifact - unprivileged | ||
| uses: actions/upload-artifact@v3 | ||
| with: | ||
| name: unprivileged | ||
| path: /tmp/unprivileged.tar | ||
|
There was a problem hiding this comment. Refresh my memory if the uploaded artifacts eventually get cleaned up. I have a vague memory that they do. There was a problem hiding this comment. There's a default setting for the repo which I believe is 30 days. However based on this comment I'm going to update the retention explicitly since so it's obvious from the script.
Also worth noting that artifacts are only accessible from the workflow in which they were created so there's no chance of us pulling an old artifact which I was worried about initially. |
||
|
|
||
| test-unprivileged: | ||
| runs-on: ubuntu-latest | ||
| needs: build-unprivileged-for-test | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Install dependencies | ||
| run: sudo apt-get update -qq && sudo apt-get install -y curl wait-for-it | ||
| - name: Restore cached binaries | ||
| id: cache-binaries-restore | ||
| uses: actions/cache/restore@v3 | ||
| with: | ||
| path: .bin | ||
| key: ${{ runner.os }}-binaries | ||
| - name: Install MinIO Client | ||
| run: | | ||
| mkdir .bin || exit 0 | ||
| cd .bin | ||
| curl --insecure --retry 6 --fail --location --output mc.RELEASE.2023-06-19T19-31-19Z "https://dl.min.io/client/mc/release/linux-$(dpkg --print-architecture)/archive/mc.RELEASE.2023-06-19T19-31-19Z" | ||
| curl --insecure --retry 6 --fail --silent --location "https://dl.min.io/client/mc/release/linux-$(dpkg --print-architecture)/archive/mc.RELEASE.2023-06-19T19-31-19Z.sha256sum" | sha256sum --check - | ||
| mv mc.RELEASE.2023-06-19T19-31-19Z mc | ||
| chmod +x mc | ||
| - name: Download artifact | ||
| uses: actions/download-artifact@v3 | ||
| with: | ||
| name: unprivileged | ||
| path: /tmp | ||
| - name: Load image | ||
| run: | | ||
| docker load --input /tmp/unprivileged.tar | ||
| docker tag nginx-s3-gateway:unprivileged-oss nginx-s3-gateway | ||
| - name: Run tests - unprivileged | ||
| run: ./test.sh --unprivileged --type oss | ||
|
|
||
| # After the tests are done, build multiarch and push to both github packages and dockerhub if we are on master/main | ||
| tag-and-push: | ||
| runs-on: ubuntu-latest | ||
| needs: [test-oss, test-latest-njs, test-unprivileged] | ||
|
|
||
| if: | | ||
| github.ref == 'refs/heads/master' || | ||
| github.ref == 'refs/heads/main' | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Get current date | ||
| id: date | ||
| run: echo "date=$(date +'%Y%m%d')" >> $GITHUB_OUTPUT | ||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| with: | ||
| platforms: linux/amd64,linux/arm64 | ||
| - name: Login to Docker Hub | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| username: ${{ secrets.DOCKER_HUB_USERNAME }} | ||
| password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} | ||
| - name: Login to GitHub Container Registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.repository_owner }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Build and push image [oss] | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| file: Dockerfile.oss | ||
| context: . | ||
| push: true | ||
| platforms: linux/amd64,linux/arm64 | ||
| provenance: false | ||
|
There was a problem hiding this comment. annotation: ref: https://docs.docker.com/build/attestations/slsa-provenance/ If we want these to go to dockerhub, we could also separate the builds again but I think the simplicity of having them both push is more desireable. |
||
| tags: | | ||
| ghcr.io/${{ github.repository }}/nginx-oss-s3-gateway:latest-${{ steps.date.outputs.date }} | ||
| ghcr.io/${{ github.repository }}/nginx-oss-s3-gateway:latest | ||
| nginxinc/nginx-s3-gateway:latest-${{ steps.date.outputs.date }} | ||
| nginxinc/nginx-s3-gateway:latest | ||
|
Comment on lines
+266
to
+270
There was a problem hiding this comment. annotation: |
||
|
|
||
| - name: Build and push image [latest-njs] | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| file: Dockerfile.latest-njs | ||
| context: . | ||
| push: true | ||
| platforms: linux/amd64,linux/arm64 | ||
| provenance: false | ||
| tags: | | ||
| ghcr.io/${{ github.repository }}/nginx-oss-s3-gateway:latest-njs-oss-${{ steps.date.outputs.date }} | ||
| ghcr.io/${{ github.repository }}/nginx-oss-s3-gateway:latest-njs-oss | ||
| nginxinc/nginx-s3-gateway:latest-njs-oss-${{ steps.date.outputs.date }} | ||
| nginxinc/nginx-s3-gateway:latest-njs-oss | ||
|
|
||
| - name: Build and push image [unprivileged] | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| file: Dockerfile.unprivileged | ||
| context: . | ||
| push: true | ||
| platforms: linux/amd64,linux/arm64 | ||
| provenance: false | ||
| tags: | | ||
| ghcr.io/${{ github.repository }}/nginx-oss-s3-gateway:unprivileged-oss-${{ steps.date.outputs.date }} | ||
| ghcr.io/${{ github.repository }}/nginx-oss-s3-gateway:unprivileged-oss | ||
| nginxinc/nginx-s3-gateway:unprivileged-oss-${{ steps.date.outputs.date }} | ||
| nginxinc/nginx-s3-gateway:unprivileged-oss | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
annotation: This is temporary until we get the whole test suite refactored. For now we skip the image build step in the test script since this pipeline ensures that the correct images are available.