Skip to content

Commit 09d08be

Browse files
darwin67darwin67
committed
ci: publish multi-arch release images
1 parent b1378c1 commit 09d08be

5 files changed

Lines changed: 195 additions & 23 deletions

File tree

‎.github/workflows/release-artifacts.yaml‎

Lines changed: 121 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,27 @@ on:
1515

1616
permissions:
1717
contents: write
18+
packages: write
1819

1920
concurrency:
2021
group: release-artifacts-${{ inputs.release_tag || github.ref_name }}
2122
cancel-in-progress: false
2223

2324
jobs:
2425
build:
25-
runs-on: depot-ubuntu-24.04-8
26+
name: Build ${{ matrix.arch }}
27+
runs-on: ${{ matrix.runner }}
2628
timeout-minutes: 360
29+
strategy:
30+
fail-fast: false
31+
matrix:
32+
include:
33+
- arch: x86_64
34+
docker_arch: amd64
35+
runner: depot-ubuntu-24.04-8
36+
- arch: aarch64
37+
docker_arch: arm64
38+
runner: depot-ubuntu-24.04-arm-8
2739
env:
2840
CCACHE_MAXSIZE: 8G
2941
CCACHE_BASEDIR: ${{ github.workspace }}
@@ -43,6 +55,8 @@ jobs:
4355
date_stamp="$(printf '%s\n' "${RELEASE_TAG}" | sed -E 's/^v([0-9]{4})-([0-9]{2})-([0-9]{2})\.[0-9]{2}$/\1\2\3/')"
4456
echo "tag=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"
4557
echo "date_stamp=${date_stamp}" >> "$GITHUB_OUTPUT"
58+
image_name="$(printf 'ghcr.io/%s\n' "${GITHUB_REPOSITORY}" | tr '[:upper:]' '[:lower:]')"
59+
echo "image_name=${image_name}" >> "$GITHUB_OUTPUT"
4660
4761
- name: Checkout
4862
uses: actions/checkout@v4
@@ -59,10 +73,10 @@ jobs:
5973
uses: actions/cache@v4
6074
with:
6175
path: ${{ github.workspace }}/.ccache
62-
key: ccache-${{ runner.os }}-release-${{ steps.tag.outputs.tag }}-${{ hashFiles('flake.nix', 'flake.lock', 'configure.py', 'CMakeLists.txt', 'cmake/**', '.gitmodules') }}
76+
key: ccache-${{ runner.os }}-${{ matrix.arch }}-release-${{ steps.tag.outputs.tag }}-${{ hashFiles('flake.nix', 'flake.lock', 'configure.py', 'CMakeLists.txt', 'cmake/**', '.gitmodules') }}
6377
restore-keys: |
64-
ccache-${{ runner.os }}-release-${{ hashFiles('flake.nix', 'flake.lock', 'configure.py', 'CMakeLists.txt', 'cmake/**', '.gitmodules') }}-
65-
ccache-${{ runner.os }}-release-
78+
ccache-${{ runner.os }}-${{ matrix.arch }}-release-${{ hashFiles('flake.nix', 'flake.lock', 'configure.py', 'CMakeLists.txt', 'cmake/**', '.gitmodules') }}-
79+
ccache-${{ runner.os }}-${{ matrix.arch }}-release-
6680
6781
- name: Configure ccache
6882
run: |
@@ -93,11 +107,85 @@ jobs:
93107
-name '*.changes' -o \
94108
-name '*.buildinfo' \
95109
\) -print -exec cp {} release-artifacts/ \;
96-
shasum -a 256 release-artifacts/* > release-artifacts/checksums.txt
110+
111+
- name: Log in to GHCR
112+
uses: docker/login-action@v3
113+
with:
114+
registry: ghcr.io
115+
username: ${{ github.actor }}
116+
password: ${{ github.token }}
117+
118+
- name: Set up Docker Buildx
119+
uses: docker/setup-buildx-action@v3
120+
121+
- name: Build and push ${{ matrix.arch }} image
122+
uses: docker/build-push-action@v5
123+
with:
124+
context: .
125+
file: dist/docker/debian/Dockerfile.release
126+
platforms: linux/${{ matrix.docker_arch }}
127+
push: true
128+
build-args: |
129+
RELEASE=${{ steps.tag.outputs.tag }}
130+
tags: |
131+
${{ steps.tag.outputs.image_name }}:${{ steps.tag.outputs.tag }}-${{ matrix.docker_arch }}
132+
labels: |
133+
org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
134+
org.opencontainers.image.revision=${{ github.sha }}
135+
org.opencontainers.image.version=${{ steps.tag.outputs.tag }}
136+
137+
- uses: actions/upload-artifact@v4
138+
with:
139+
name: ssdb-${{ steps.tag.outputs.tag }}-${{ matrix.arch }}-release-artifacts
140+
path: release-artifacts/
141+
if-no-files-found: error
142+
143+
- name: Show ccache stats
144+
if: always()
145+
run: nix develop .#cpp -c ccache --show-stats
146+
147+
publish:
148+
name: Publish release
149+
runs-on: ubuntu-latest
150+
needs: [build]
151+
steps:
152+
- name: Validate release tag
153+
id: tag
154+
env:
155+
RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
156+
run: |
157+
if ! printf '%s\n' "${RELEASE_TAG}" | grep -Eq '^v[0-9]{4}-[0-9]{2}-[0-9]{2}\.[0-9]{2}$'; then
158+
echo "Release tag is not valid: ${RELEASE_TAG}"
159+
exit 1
160+
fi
161+
162+
image_name="$(printf 'ghcr.io/%s\n' "${GITHUB_REPOSITORY}" | tr '[:upper:]' '[:lower:]')"
163+
echo "tag=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"
164+
echo "image_name=${image_name}" >> "$GITHUB_OUTPUT"
165+
166+
- name: Checkout
167+
uses: actions/checkout@v4
168+
with:
169+
fetch-depth: 0
170+
ref: ${{ steps.tag.outputs.tag }}
171+
172+
- name: Download release artifacts
173+
uses: actions/download-artifact@v4
174+
with:
175+
pattern: ssdb-${{ steps.tag.outputs.tag }}-*-release-artifacts
176+
path: release-artifacts
177+
merge-multiple: true
178+
179+
- name: Write checksums
180+
run: |
181+
find release-artifacts -type f -print0 \
182+
| sort -z \
183+
| xargs -0 shasum -a 256 > release-artifacts/checksums.txt
97184
98185
- name: Write release notes
99186
env:
100187
RELEASE_TAG: ${{ steps.tag.outputs.tag }}
188+
IMAGE_NAME: ${{ steps.tag.outputs.image_name }}
101189
run: |
102190
changelog_version="${RELEASE_TAG#v}"
103191
awk -v version="## [${changelog_version}]" '
@@ -114,11 +202,35 @@ jobs:
114202
} > RELEASE_NOTES.md
115203
fi
116204
117-
- uses: actions/upload-artifact@v4
205+
{
206+
echo
207+
echo "## Container Image"
208+
echo
209+
echo "- \`${IMAGE_NAME}:${RELEASE_TAG}\`"
210+
echo "- \`${IMAGE_NAME}:${RELEASE_TAG}-amd64\`"
211+
echo "- \`${IMAGE_NAME}:${RELEASE_TAG}-arm64\`"
212+
} >> RELEASE_NOTES.md
213+
214+
- name: Log in to GHCR
215+
uses: docker/login-action@v3
118216
with:
119-
name: ssdb-${{ steps.tag.outputs.tag }}-release-artifacts
120-
path: release-artifacts/
121-
if-no-files-found: error
217+
registry: ghcr.io
218+
username: ${{ github.actor }}
219+
password: ${{ github.token }}
220+
221+
- name: Set up Docker Buildx
222+
uses: docker/setup-buildx-action@v3
223+
224+
- name: Publish multi-arch image tags
225+
env:
226+
IMAGE_NAME: ${{ steps.tag.outputs.image_name }}
227+
RELEASE_TAG: ${{ steps.tag.outputs.tag }}
228+
run: |
229+
docker buildx imagetools create \
230+
--tag "${IMAGE_NAME}:${RELEASE_TAG}" \
231+
--tag "${IMAGE_NAME}:latest" \
232+
"${IMAGE_NAME}:${RELEASE_TAG}-amd64" \
233+
"${IMAGE_NAME}:${RELEASE_TAG}-arm64"
122234
123235
- name: Publish GitHub release
124236
uses: softprops/action-gh-release@v2
@@ -127,7 +239,3 @@ jobs:
127239
body_path: RELEASE_NOTES.md
128240
files: release-artifacts/*
129241
fail_on_unmatched_files: true
130-
131-
- name: Show ccache stats
132-
if: always()
133-
run: nix develop .#cpp -c ccache --show-stats

‎dist/docker/debian/Dockerfile.release‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
3+
FROM ubuntu:24.04
4+
5+
ARG RELEASE=unknown
6+
7+
LABEL org.opencontainers.image.title="ssdb"
8+
LABEL org.opencontainers.image.description="ssdb database server"
9+
LABEL org.opencontainers.image.version="${RELEASE}"
10+
11+
COPY release-artifacts/*.deb /packages/
12+
COPY dist/docker/etc /etc/
13+
COPY dist/docker/scylla-housekeeping-service.sh /scylla-housekeeping-service.sh
14+
COPY dist/docker/scyllasetup.py /scyllasetup.py
15+
COPY dist/docker/commandlineparser.py /commandlineparser.py
16+
COPY dist/docker/docker-entrypoint.py /docker-entrypoint.py
17+
COPY dist/docker/scylla_bashrc /scylla_bashrc
18+
COPY dist/common/supervisor/scylla-server.sh \
19+
dist/common/supervisor/scylla-node-exporter.sh \
20+
dist/common/supervisor/scylla_util.sh \
21+
/opt/scylladb/supervisor/
22+
23+
RUN apt-get -y clean \
24+
&& apt-get -y update \
25+
&& apt-get -y upgrade \
26+
&& apt-get -y --no-install-suggests install dialog apt-utils \
27+
&& echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections \
28+
&& rm -f /etc/rsyslog.conf \
29+
&& apt-get -y --no-install-suggests install \
30+
ca-certificates \
31+
curl \
32+
hostname \
33+
python3 \
34+
python3-yaml \
35+
rsyslog \
36+
sudo \
37+
supervisor \
38+
systemd \
39+
&& echo LANG=C.UTF-8 > /etc/default/locale \
40+
&& (dpkg -i /packages/*.deb || apt-get -f -y install) \
41+
&& apt-get -y clean \
42+
&& rm -rf /var/lib/apt/lists/* /packages \
43+
&& cat /scylla_bashrc >> /etc/bash.bashrc \
44+
&& mkdir -p /etc/supervisor.conf.d /var/log/scylla /opt/scylladb/supervisor \
45+
&& chown -R scylla:scylla /var/lib/scylla \
46+
&& sed -i -e 's/^SCYLLA_ARGS=".*"$/SCYLLA_ARGS="--log-to-syslog 0 --log-to-stdout 1 --network-stack posix"/' /etc/default/scylla-server \
47+
&& touch /opt/scylladb/SCYLLA-CONTAINER-FILE
48+
49+
ENV PATH=/opt/scylladb/python3/bin:/usr/bin:/usr/sbin
50+
ENV LANG=C.UTF-8
51+
ENV LANGUAGE=
52+
ENV LC_ALL=C.UTF-8
53+
54+
EXPOSE 10000 9042 9160 9180 7000 7001 22
55+
VOLUME ["/var/lib/scylla"]
56+
57+
ENTRYPOINT ["/docker-entrypoint.py"]

‎docs/plans/002-release_flow.org‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,11 @@ Initial artifacts:
4242
- relocatable server tarball from =ninja dist-server-tar=;
4343
- Debian packages from =ninja dist-server-deb=;
4444
- RPM packages from =ninja dist-server-rpm=;
45+
- multi-arch container images published to GitHub Container Registry;
4546
- SHA-256 checksums for uploaded artifacts.
4647

4748
Future artifacts:
4849

49-
- container images built from the Debian packages;
5050
- APT/YUM repository publishing;
5151
- SBOM and provenance attestations;
5252
- statically linked Rust rewrite binaries where a crate can actually support
@@ -59,7 +59,8 @@ The implemented flow follows the Atlas/Inngest pattern:
5959
1. =auto-release-pr.yml= creates or refreshes =release/next=.
6060
2. The release PR title is =chore(release): vYYYY-MM-DD.NN=.
6161
3. =release-tag.yml= tags the merged release PR commit.
62-
4. =release-artifacts.yaml= builds and publishes tar, Debian, and RPM artifacts.
62+
4. =release-artifacts.yaml= builds and publishes tar, Debian, RPM, and GHCR
63+
container artifacts for =x86_64= and =aarch64=.
6364

6465
The release tag is date-indexed rather than semver. That avoids implying API or
6566
storage-format stability while this fork is still in early packaging and
@@ -73,8 +74,11 @@ the inherited product/version metadata is deliberately rebranded.
7374
- Keep release PRs going through normal branch protection and CI.
7475
- Release builds require Linux runners; macOS is intentionally limited to the
7576
portable/Rust shell.
76-
- Release artifact builds are expensive and should use an 8-core runner with
77-
ccache enabled.
77+
- Release artifact builds are expensive and should use native =x86_64= and
78+
=aarch64= runners with ccache enabled.
79+
- The workflow currently expects =depot-ubuntu-24.04-8= and
80+
=depot-ubuntu-24.04-arm-8= runner labels.
81+
- GHCR publishing requires =packages: write= workflow permission.
7882

7983
* Open Checklist
8084

@@ -85,13 +89,14 @@ the inherited product/version metadata is deliberately rebranded.
8589
RPM packages, and checksums.
8690
- [X] Document why the inherited server should not be treated as a static
8791
binary release.
88-
- [ ] Verify =make release-artifacts= on a Linux runner.
92+
- [X] Add native =x86_64= and =aarch64= release artifact jobs.
93+
- [X] Add GHCR container image publishing from generated Debian packages.
94+
- [ ] Verify =make release-artifacts= on native =x86_64= and =aarch64= Linux
95+
runners.
8996
- [ ] Confirm generated Debian package names and install paths are acceptable
9097
while =SCYLLA-VERSION-GEN= still emits =scylla= as the product name.
9198
- [ ] Rebrand product metadata before public ssdb package distribution if
9299
=scylla-*= package names are not intended.
93-
- [ ] Add container-image publishing after package names and install paths are
94-
settled.
95100
- [ ] Add package repository publishing for APT/YUM after package signing is
96101
ready.
97102
- [ ] Add SBOM and provenance attestations after artifact shape stabilizes.

‎docs/relicensing/inventory.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,16 @@ It is an audit starting point, not a legal conclusion.
66
- Source: tracked files in the current working tree
77
- Generator: `docs/relicensing/generate-inventory.py`
88
- Complete per-file inventory: `inventory.tsv`
9-
- Tracked files scanned: `5962`
9+
- Tracked files scanned: `5964`
1010

1111
## License Classes
1212

1313
| Category | Files |
1414
|-----------------|-------|
15-
| AGPL-only | 1694 |
15+
| AGPL-only | 1695 |
1616
| Apache-only | 47 |
1717
| dual-licensed | 372 |
18-
| unknown-license | 3849 |
18+
| unknown-license | 3850 |
1919

2020
## File Flags
2121

‎docs/relicensing/inventory.tsv‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -785,6 +785,7 @@ dist/debuginfo/CMakeLists.txt unknown-license no
785785
dist/debuginfo/install.sh AGPL-only AGPL-3.0-or-later Copyright (C) 2022-present ScyllaDB no
786786
dist/debuginfo/scripts/create-relocatable-package.py AGPL-only AGPL-3.0-or-later Copyright (C) 2022-present ScyllaDB no
787787
dist/docker/commandlineparser.py unknown-license no
788+
dist/docker/debian/Dockerfile.release AGPL-only AGPL-3.0-or-later no
788789
dist/docker/debian/README.md unknown-license no
789790
dist/docker/debian/build_docker.sh AGPL-only AGPL-3.0-or-later Copyright (C) 2021-present ScyllaDB no
790791
dist/docker/docker-entrypoint.py unknown-license no
@@ -1271,6 +1272,7 @@ docs/operating-scylla/security/security-checklist.rst unknown-license no
12711272
docs/operating-scylla/system-configuration/index.rst unknown-license no
12721273
docs/operating-scylla/system-configuration/snitch.rst unknown-license no
12731274
docs/plans/000-rust_rewrite_apache2_relicensing.org unknown-license Copyright notices | copyright | copyright and NOTICE obligations are preserved; | copyright attribution from inherited files. Copyright notices are | copyright holders. | copyright holders. The | copyright inventory. | copyright notices and required attribution intact. | copyright notices to make the project look less derived. | copyright notices. | copyright risk. | copyright, license, and attribution notices. no
1275+
docs/plans/001-cassandra_conformance_suite.org unknown-license no
12741276
docs/plans/002-release_flow.org Apache-only Apache-2.0 no
12751277
docs/pyproject.toml unknown-license no
12761278
docs/reference/_common/enterprise-vs-oss-matrix-link.rst unknown-license no

0 commit comments

Comments
 (0)