From 103285855e61992f911e42868166d39bd3ce741c Mon Sep 17 00:00:00 2001 From: Stavros Date: Tue, 7 Oct 2025 15:34:08 +0300 Subject: [PATCH] feat: add distroless to release workflow --- .github/workflows/nightly.yml | 4 + .github/workflows/release.yml | 157 ++++++++++++++++++++++++++++++++++ 2 files changed, 161 insertions(+) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index afc94f1..241dd7b 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -173,6 +173,7 @@ jobs: outputs: type=image,push-by-digest=true,name-canonical=true,push=true cache-from: type=gha cache-to: type=gha,mode=max + github-token: ${{ secrets.GITHUB_TOKEN }} build-args: | VERSION=${{ needs.generate-metadata.outputs.VERSION }} COMMIT_HASH=${{ needs.generate-metadata.outputs.COMMIT_HASH }} @@ -231,6 +232,7 @@ jobs: file: Dockerfile.distroless cache-from: type=gha cache-to: type=gha,mode=max + github-token: ${{ secrets.GITHUB_TOKEN }} build-args: | VERSION=${{ needs.generate-metadata.outputs.VERSION }} COMMIT_HASH=${{ needs.generate-metadata.outputs.COMMIT_HASH }} @@ -287,6 +289,7 @@ jobs: outputs: type=image,push-by-digest=true,name-canonical=true,push=true cache-from: type=gha cache-to: type=gha,mode=max + github-token: ${{ secrets.GITHUB_TOKEN }} build-args: | VERSION=${{ needs.generate-metadata.outputs.VERSION }} COMMIT_HASH=${{ needs.generate-metadata.outputs.COMMIT_HASH }} @@ -345,6 +348,7 @@ jobs: file: Dockerfile.distroless cache-from: type=gha cache-to: type=gha,mode=max + github-token: ${{ secrets.GITHUB_TOKEN }} build-args: | VERSION=${{ needs.generate-metadata.outputs.VERSION }} COMMIT_HASH=${{ needs.generate-metadata.outputs.COMMIT_HASH }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1a1bd25..58711b3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -143,6 +143,9 @@ jobs: labels: ${{ steps.meta.outputs.labels }} tags: ghcr.io/${{ github.repository_owner }}/tinyauth outputs: type=image,push-by-digest=true,name-canonical=true,push=true + cache-from: type=gha + cache-to: type=gha,mode=max + github-token: ${{ secrets.GITHUB_TOKEN }} build-args: | VERSION=${{ needs.generate-metadata.outputs.VERSION }} COMMIT_HASH=${{ needs.generate-metadata.outputs.COMMIT_HASH }} @@ -162,6 +165,62 @@ jobs: if-no-files-found: error retention-days: 1 + image-build-distroless: + runs-on: ubuntu-latest + needs: + - generate-metadata + - image-build + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: ghcr.io/${{ github.repository_owner }}/tinyauth + + - name: Login to GitHub Container Registry + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build and push + uses: docker/build-push-action@v6 + id: build + with: + platforms: linux/amd64 + labels: ${{ steps.meta.outputs.labels }} + tags: ghcr.io/${{ github.repository_owner }}/tinyauth + outputs: type=image,push-by-digest=true,name-canonical=true,push=true + file: Dockerfile.distroless + cache-from: type=gha + cache-to: type=gha,mode=max + github-token: ${{ secrets.GITHUB_TOKEN }} + build-args: | + VERSION=${{ needs.generate-metadata.outputs.VERSION }} + COMMIT_HASH=${{ needs.generate-metadata.outputs.COMMIT_HASH }} + BUILD_TIMESTAMP=${{ needs.generate-metadata.outputs.BUILD_TIMESTAMP }} + + - name: Export digest + run: | + mkdir -p ${{ runner.temp }}/digests + digest="${{ steps.build.outputs.digest }}" + touch "${{ runner.temp }}/digests/${digest#sha256:}" + + - name: Upload digest + uses: actions/upload-artifact@v4 + with: + name: digests-distroless-linux-amd64 + path: ${{ runner.temp }}/digests/* + if-no-files-found: error + retention-days: 1 + image-build-arm: runs-on: ubuntu-24.04-arm needs: @@ -194,6 +253,9 @@ jobs: labels: ${{ steps.meta.outputs.labels }} tags: ghcr.io/${{ github.repository_owner }}/tinyauth outputs: type=image,push-by-digest=true,name-canonical=true,push=true + cache-from: type=gha + cache-to: type=gha,mode=max + github-token: ${{ secrets.GITHUB_TOKEN }} build-args: | VERSION=${{ needs.generate-metadata.outputs.VERSION }} COMMIT_HASH=${{ needs.generate-metadata.outputs.COMMIT_HASH }} @@ -213,6 +275,62 @@ jobs: if-no-files-found: error retention-days: 1 + image-build-arm-distroless: + runs-on: ubuntu-24.04-arm + needs: + - generate-metadata + - image-build-arm + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: ghcr.io/${{ github.repository_owner }}/tinyauth + + - name: Login to GitHub Container Registry + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build and push + uses: docker/build-push-action@v6 + id: build + with: + platforms: linux/arm64 + labels: ${{ steps.meta.outputs.labels }} + tags: ghcr.io/${{ github.repository_owner }}/tinyauth + outputs: type=image,push-by-digest=true,name-canonical=true,push=true + file: Dockerfile.distroless + cache-from: type=gha + cache-to: type=gha,mode=max + github-token: ${{ secrets.GITHUB_TOKEN }} + build-args: | + VERSION=${{ needs.generate-metadata.outputs.VERSION }} + COMMIT_HASH=${{ needs.generate-metadata.outputs.COMMIT_HASH }} + BUILD_TIMESTAMP=${{ needs.generate-metadata.outputs.BUILD_TIMESTAMP }} + + - name: Export digest + run: | + mkdir -p ${{ runner.temp }}/digests + digest="${{ steps.build.outputs.digest }}" + touch "${{ runner.temp }}/digests/${digest#sha256:}" + + - name: Upload digest + uses: actions/upload-artifact@v4 + with: + name: digests-distroless-linux-arm64 + path: ${{ runner.temp }}/digests/* + if-no-files-found: error + retention-days: 1 + image-merge: runs-on: ubuntu-latest needs: @@ -252,6 +370,45 @@ jobs: docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ $(printf 'ghcr.io/${{ github.repository_owner }}/tinyauth@sha256:%s ' *) + image-merge-distroless: + runs-on: ubuntu-latest + needs: + - image-build-distroless + - image-build-arm-distroless + steps: + - name: Download digests + uses: actions/download-artifact@v4 + with: + path: ${{ runner.temp }}/digests + pattern: digests-distroless-* + merge-multiple: true + + - name: Login to GitHub Container Registry + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: ghcr.io/${{ github.repository_owner }}/tinyauth + tags: | + type=semver,pattern={{version}},prefix=v,suffix=-distroless + type=semver,pattern={{major}},prefix=v,suffix=-distroless + type=semver,pattern={{major}}.{{minor}},prefix=v,suffix=-distroless + + - name: Create manifest list and push + working-directory: ${{ runner.temp }}/digests + run: | + docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ + $(printf 'ghcr.io/${{ github.repository_owner }}/tinyauth@sha256:%s ' *) + update-release: runs-on: ubuntu-latest needs: