rsafd-docker/.github/workflows/docker-multi-arch.yml at 0f020d1bd41ea161b2d0d991f0b13035fb39ecd0 · PrincetonUniversity/rsafd-docker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: build-and-push

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Image tag (optional override)"
        required: false
        default: ""

jobs:
  build-amd64:
    runs-on: [self-hosted, Linux, X64]
    permissions:
      contents: read
      packages: write
    outputs:
      sha_tag: ${{ steps.meta.outputs.sha_tag }}
      date_tag: ${{ steps.meta.outputs.date_tag }}
      user_tag: ${{ steps.meta.outputs.user_tag }}
      image_name: ${{ steps.name.outputs.image_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set lowercase image name
        id: name
        run: |
          IMAGE_NAME_LOWERCASE=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')/rsafd-docker
          echo "image_name=$IMAGE_NAME_LOWERCASE" >> $GITHUB_OUTPUT
      - name: Compute tags
        id: meta
        run: |
          DATE_TAG=$(date +'%Y%m%d')
            SHA_TAG=${GITHUB_SHA::12}
            USER_TAG="${{ github.event.inputs.tag }}"
            echo "sha_tag=$SHA_TAG" >> $GITHUB_OUTPUT
            echo "date_tag=$DATE_TAG" >> $GITHUB_OUTPUT
            echo "user_tag=$USER_TAG" >> $GITHUB_OUTPUT
      - name: Build & Push (amd64)
        uses: docker/build-push-action@v5
        with:
          context: .
          # Rely on native host arch (amd64)
          tags: ghcr.io/${{ steps.name.outputs.image_name }}:${{ steps.meta.outputs.sha_tag }}-amd64
          push: true
          provenance: false
          sbom: false
          build-args: |
            GH_OWNER=${{ github.repository_owner }}
            GIT_SHA=${{ steps.meta.outputs.sha_tag }}

  build-arm64:
    runs-on: [self-hosted, macOS, ARM64]
    permissions:
      contents: read
      packages: write
    outputs:
      sha_tag: ${{ steps.meta.outputs.sha_tag }}
      date_tag: ${{ steps.meta.outputs.date_tag }}
      user_tag: ${{ steps.meta.outputs.user_tag }}
      image_name: ${{ steps.name.outputs.image_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set lowercase image name
        id: name
        run: |
          IMAGE_NAME_LOWERCASE=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')/rsafd-docker
          echo "image_name=$IMAGE_NAME_LOWERCASE" >> $GITHUB_OUTPUT
      - name: Compute tags
        id: meta
        run: |
          DATE_TAG=$(date +'%Y%m%d')
            SHA_TAG=${GITHUB_SHA::12}
            USER_TAG="${{ github.event.inputs.tag }}"
            echo "sha_tag=$SHA_TAG" >> $GITHUB_OUTPUT
            echo "date_tag=$DATE_TAG" >> $GITHUB_OUTPUT
            echo "user_tag=$USER_TAG" >> $GITHUB_OUTPUT
      - name: Build & Push (arm64)
        uses: docker/build-push-action@v5
        with:
          context: .
          # Native arm64 host build
          tags: ghcr.io/${{ steps.name.outputs.image_name }}:${{ steps.meta.outputs.sha_tag }}-arm64
          push: true
          provenance: false
          sbom: false
          build-args: |
            GH_OWNER=${{ github.repository_owner }}
            GIT_SHA=${{ steps.meta.outputs.sha_tag }}

  manifest:
    runs-on: ubuntu-latest
    needs: [build-amd64, build-arm64]
    permissions:
      contents: read
      packages: write
    steps:
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Create multi-arch manifest tags
        run: |
          set -euo pipefail
          IMAGE=ghcr.io/${{ needs.build-amd64.outputs.image_name }}
          SHA_TAG=${{ needs.build-amd64.outputs.sha_tag }}
          DATE_TAG=${{ needs.build-amd64.outputs.date_tag }}
          USER_TAG=${{ needs.build-amd64.outputs.user_tag }}
          SRC_AMD64=$IMAGE:${SHA_TAG}-amd64
          SRC_ARM64=$IMAGE:${SHA_TAG}-arm64
          if ! docker buildx imagetools inspect $SRC_AMD64 >/dev/null 2>&1; then echo "Missing $SRC_AMD64"; exit 1; fi
          if ! docker buildx imagetools inspect $SRC_ARM64 >/dev/null 2>&1; then echo "Missing $SRC_ARM64"; exit 1; fi
          ARGS=(-t $IMAGE:$SHA_TAG -t $IMAGE:$DATE_TAG -t $IMAGE:latest)
          if [ -n "$USER_TAG" ]; then ARGS+=( -t $IMAGE:$USER_TAG ); fi
          docker buildx imagetools create "${ARGS[@]}" $SRC_AMD64 $SRC_ARM64
          docker buildx imagetools inspect $IMAGE:$SHA_TAG
      - name: Summary
        run: |
          IMAGE=ghcr.io/${{ needs.build-amd64.outputs.image_name }}
          echo "Published multi-arch tags:" >> $GITHUB_STEP_SUMMARY
          echo "$IMAGE:${{ needs.build-amd64.outputs.sha_tag }}" >> $GITHUB_STEP_SUMMARY
          echo "$IMAGE:${{ needs.build-amd64.outputs.date_tag }}" >> $GITHUB_STEP_SUMMARY
          echo "$IMAGE:latest" >> $GITHUB_STEP_SUMMARY
          if [ -n "${{ needs.build-amd64.outputs.user_tag }}" ]; then
            echo "$IMAGE:${{ needs.build-amd64.outputs.user_tag }}" >> $GITHUB_STEP_SUMMARY
          fi