Skip to content

Feature/docker ci cd #544

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NadeeshaMedagama wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Feature/docker ci cd #544

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6422cb2
feat: add multi-stage Dockerfile, test Dockerfile, and .dockerignore
NadeeshaMedagama Mar 3, 2026
35b9cfa
ci: add Docker test, build, and push workflow (docker.yml)
NadeeshaMedagama Mar 3, 2026
99d2b14
ci: integrate Docker workflow into Release, Merge, and PR pipelines
NadeeshaMedagama Mar 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
# Git
.git
.github
.gitignore

# Build artifacts
build/
packaging/deb/
packaging/rpm/
packaging/windows/

# Documentation
docs/

# IDE & editor
.idea/
*.swp
*.swo
*~

# OS files
.DS_Store
Thumbs.db

# Markdown (not needed in image)
*.md
LICENSE

Comment on lines +1 to +28
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The vendor/ directory is not excluded from the Docker build context in .dockerignore. Since the Dockerfiles use go mod download to fetch dependencies, the vendor/ directory is not needed and unnecessarily inflates the build context. Adding vendor/ to .dockerignore would speed up Docker builds significantly.

Copilot uses AI. Check for mistakes.
7 changes: 7 additions & 0 deletions .github/workflows/Merge.yml
100644 → 100755
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,3 +20,10 @@ jobs:
if: ${{ always() && contains(join(needs.*.result, ','), 'success') }}
needs: [build, vet, unit-test]
uses: ./.github/workflows/integration.yml
docker:
if: ${{ always() && contains(join(needs.*.result, ','), 'success') }}
needs: [build, vet, unit-test]
uses: ./.github/workflows/docker.yml
secrets:
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
7 changes: 7 additions & 0 deletions .github/workflows/PR.yml
100644 → 100755
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,3 +23,10 @@ jobs:
if: ${{ always() && contains(join(needs.*.result, ','), 'success') }}
needs: [build, vet, unit-test]
uses: ./.github/workflows/integration.yml
docker:
if: ${{ always() && contains(join(needs.*.result, ','), 'success') }}
needs: [build, vet, unit-test]
uses: ./.github/workflows/docker.yml
secrets:
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
7 changes: 7 additions & 0 deletions .github/workflows/Release.yml
100644 → 100755
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,13 @@ jobs:
if: ${{ always() && contains(join(needs.*.result, ','), 'success') }}
needs: [build, e2e, integration, unit-test, vet]
uses: ./.github/workflows/publish.yml
docker:
if: ${{ always() && contains(join(needs.*.result, ','), 'success') }}
needs: [build, e2e, integration, unit-test, vet]
uses: ./.github/workflows/docker.yml
secrets:
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
docs:
if: ${{ always() && contains(join(needs.*.result, ','), 'success') }}
needs: [build, e2e, integration, unit-test, vet]
Expand Down
127 changes: 127 additions & 0 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,127 @@
name: Docker Test, Build & Push

on:
workflow_call:
secrets:
DOCKERHUB_USERNAME:
required: true
description: "Docker Hub username"
DOCKERHUB_TOKEN:
required: true
description: "Docker Hub access token"

env:
IMAGE_NAME: mirantis/cri-dockerd

jobs:
# -----------------------------------------------------------
# Stage 1 – Run unit tests inside a Docker container
# -----------------------------------------------------------
docker-test:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3

- name: Load environment
uses: c-py/action-dotenv-to-setenv@v4
with:
env-file: .github/.env

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Build test image
uses: docker/build-push-action@v6
with:
context: .
file: ./Dockerfile.test
build-args: |
GO_VERSION=${{ env.GO_VERSION }}
push: false
load: true
tags: cri-dockerd-test:ci
cache-from: type=gha
cache-to: type=gha,mode=max

- name: Run unit tests in container
run: docker run --rm cri-dockerd-test:ci

# -----------------------------------------------------------
# Stage 2 – Build multi-arch image & push to Docker Hub
# -----------------------------------------------------------
docker-build-push:
runs-on: ubuntu-latest
needs: [docker-test]
permissions:
contents: read
packages: write
steps:
- name: Checkout
uses: actions/checkout@v3
with:
fetch-depth: 0 # needed for git describe

- name: Load environment
uses: c-py/action-dotenv-to-setenv@v4
with:
env-file: .github/.env

- name: Set version metadata
id: meta
run: |
VERSION=$(git describe --tags 2>/dev/null | sed 's/^v//' || echo "dev")
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The VERSION detection logic is broken when no git tags exist. The command git describe --tags 2>/dev/null | sed 's/^v//' || echo "dev" evaluates the exit code of sed (the last command in the pipe), not git describe. Since sed always succeeds even on empty input, || echo "dev" is never reached, and VERSION will be an empty string instead of "dev" when no tags exist. To fix this, either capture git describe output in a variable first (e.g., VERSION=$(git describe --tags 2>/dev/null) && VERSION=${VERSION#v} || VERSION=dev) or use set -o pipefail at the start of the run block.

Suggested change
VERSION=$(git describe --tags 2>/dev/null | sed 's/^v//' || echo "dev")
VERSION=$(git describe --tags 2>/dev/null) && VERSION=${VERSION#v} || VERSION=dev

Copilot uses AI. Check for mistakes.
REVISION=$(git log -1 --pretty='%h')
PRERELEASE=$(echo "${VERSION}" | grep -q dev && echo "pre" || echo "")
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
echo "revision=${REVISION}" >> "$GITHUB_OUTPUT"
echo "prerelease=${PRERELEASE}" >> "$GITHUB_OUTPUT"

- name: Set up QEMU
uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}

- name: Docker metadata (tags & labels)
id: docker_meta
uses: docker/metadata-action@v5
with:
images: ${{ env.IMAGE_NAME }}
tags: |
# tag semver on release tags
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
# branch name
type=ref,event=branch
# short SHA
type=sha,prefix=
# "latest" on default branch
type=raw,value=latest,enable={{is_default_branch}}

- name: Build and push
uses: docker/build-push-action@v6
with:
context: .
file: ./Dockerfile
platforms: linux/amd64,linux/arm64
push: true
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The docker-build-push job unconditionally sets push: true, which means it will push an image to Docker Hub on every PR event (since docker.yml is also called from PR.yml). This is likely unintended — PR builds should not publish images to the public registry. Consider conditionally setting push based on the GitHub event type, for example by adding push: ${{ github.event_name != 'pull_request' }}.

Suggested change
push: true
push: ${{ github.event_name != 'pull_request' }}

Copilot uses AI. Check for mistakes.
tags: ${{ steps.docker_meta.outputs.tags }}
labels: ${{ steps.docker_meta.outputs.labels }}
build-args: |
GO_VERSION=${{ env.GO_VERSION }}
VERSION=${{ steps.meta.outputs.version }}
REVISION=${{ steps.meta.outputs.revision }}
PRERELEASE=${{ steps.meta.outputs.prerelease }}
cache-from: type=gha
cache-to: type=gha,mode=max

- name: Print image digest
run: echo "Image pushed with digest ${{ steps.docker_meta.outputs.digest }}"
Comment on lines +125 to +126
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The "Print image digest" step incorrectly references steps.docker_meta.outputs.digest. The docker_meta step id refers to the docker/metadata-action@v5 step, which does not produce a digest output. The image digest is an output of the docker/build-push-action@v6 "Build and push" step. To fix this, add an id (e.g., id: build) to the "Build and push" step and then reference it as steps.build.outputs.digest.

Copilot uses AI. Check for mistakes.

44 changes: 44 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
# syntax=docker/dockerfile:1

# ---- Build Stage ----
ARG GO_VERSION=1.24.9
FROM golang:${GO_VERSION}-bookworm AS builder

ARG VERSION=""
ARG REVISION=""
ARG PRERELEASE=""
ARG TARGETOS=linux
ARG TARGETARCH=amd64

WORKDIR /go/src/github.com/Mirantis/cri-dockerd

# Cache Go modules
COPY go.mod go.sum ./
RUN go mod download

# Copy source
COPY . .

# Build the binary
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath \
-ldflags "-s -w \
-X github.com/Mirantis/cri-dockerd/cmd/version.Version=${VERSION} \
-X github.com/Mirantis/cri-dockerd/cmd/version.PreRelease=${PRERELEASE} \
-X github.com/Mirantis/cri-dockerd/cmd/version.GitCommit=${REVISION}" \
-o /usr/local/bin/cri-dockerd

# ---- Test Stage ----
FROM builder AS test
RUN go test ./...

Comment on lines +30 to +33
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The "Test Stage" (FROM builder AS test) defined in Dockerfile is never actually used. The CI pipeline runs tests via Dockerfile.test in the docker-test job, and the docker-build-push job builds only the final runtime stage. If the intent is to run tests as part of the main Docker build, then the workflow should add a --target test step; otherwise this stage is unused dead code and should be removed to avoid confusion.

Suggested change
# ---- Test Stage ----
FROM builder AS test
RUN go test ./...

Copilot uses AI. Check for mistakes.
# ---- Final Stage ----
FROM debian:bookworm-slim AS runtime

RUN apt-get update && apt-get install -y --no-install-recommends \
ca-certificates \
&& rm -rf /var/lib/apt/lists/*

COPY --from=builder /usr/local/bin/cri-dockerd /usr/local/bin/cri-dockerd

ENTRYPOINT ["cri-dockerd"]

18 changes: 18 additions & 0 deletions Dockerfile.test
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
# syntax=docker/dockerfile:1

# Dockerfile for running unit tests in CI
ARG GO_VERSION=1.24.9
FROM golang:${GO_VERSION}-bookworm

WORKDIR /go/src/github.com/Mirantis/cri-dockerd

# Cache Go modules
COPY go.mod go.sum ./
RUN go mod download

# Copy source
COPY . .

# Default command: run all unit tests
CMD ["go", "test", "-v", "./..."]

Loading