Use registry images instead of building

Add publish workflow that builds and pushes service images to GHCR
on master merge. Update test workflow to pull pre-built images from
the registry with a local build fallback when pull fails.

Closes #97

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: szachovy

.github/workflows/publish.yml

@@ -0,0 +1,39 @@
+---
+name: "Publish"
+
+on:  # yamllint disable-line rule:truthy
+  push:
+    branches: "master"
+
+env:
+  REGISTRY: "ghcr.io"
+
+jobs:
+  publish:
+    runs-on: "ubuntu-22.04"
+    permissions:
+      contents: "read"
+      packages: "write"
+    strategy:
+      matrix:
+        include:
+          - image: "ghcr.io/szachovy/superset-cluster-mysql-server"
+            context: "services/mysql-server"
+          - image: "ghcr.io/szachovy/superset-cluster-mysql-mgmt"
+            context: "services/mysql-mgmt"
+          - image: "ghcr.io/szachovy/superset-cluster-superset-service"
+            context: "services/superset"
+    steps:
+      - uses: "actions/checkout@v4"
+
+      - name: "Log in to GitHub Container Registry"
+        uses: "docker/login-action@v3"
+        with:
+          registry: "${{ env.REGISTRY }}"
+          username: "${{ github.actor }}"
+          password: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: "Build and push image"
+        run: |
+          docker build --quiet -t "${{ matrix.image }}:latest" "${{ matrix.context }}"
+          docker push "${{ matrix.image }}:latest"

.github/workflows/tests.yml

@@ -47,34 +47,28 @@ jobs:
         run: "terraform apply --auto-approve"
         working-directory: "${{ env.TERRAFORM_WORKING_DIRECTORY }}"
 
-      - name: "Build and pre-load service images into test containers"
+      - name: "Pull or build service images and pre-load into test containers"
         run: |
-          if [ "$GITHUB_REF_NAME" = "master" ]; then
-            IMAGE_TAG="latest"
-          else
-            IMAGE_TAG="${GITHUB_REF_NAME//\//-}"
-          fi
-          build_and_load() {
+          pull_or_build_and_load() {
             local image_name="$1"
             local build_context="$2"
             shift 2
             local nodes=("$@")
-            docker build --quiet -t "${image_name}:${IMAGE_TAG}" "$build_context"
-            if [ "$IMAGE_TAG" != "latest" ]; then
-              docker tag "${image_name}:${IMAGE_TAG}" "${image_name}:latest"
+            if ! docker pull "${image_name}:latest" 2>/dev/null; then
+              echo "Pull failed for ${image_name}:latest, building locally"
+              docker build --quiet -t "${image_name}:latest" "$build_context"
             fi
             for node in "${nodes[@]}"; do
               docker save "${image_name}:latest" | docker exec -i "$node" docker load
             done
-            docker rmi "${image_name}:${IMAGE_TAG}" || true
             docker rmi "${image_name}:latest" || true
             docker image prune --force
           }
-          build_and_load "ghcr.io/szachovy/superset-cluster-mysql-server" \
+          pull_or_build_and_load "ghcr.io/szachovy/superset-cluster-mysql-server" \
             "services/mysql-server" node-2 node-3 node-4
-          build_and_load "ghcr.io/szachovy/superset-cluster-mysql-mgmt" \
+          pull_or_build_and_load "ghcr.io/szachovy/superset-cluster-mysql-mgmt" \
             "services/mysql-mgmt" node-0 node-1
-          build_and_load "ghcr.io/szachovy/superset-cluster-superset-service" \
+          pull_or_build_and_load "ghcr.io/szachovy/superset-cluster-superset-service" \
             "services/superset" node-0 node-1
           docker image prune --all --force
 

CHANGELOG.md

@@ -13,11 +13,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   [RELIABILITY.md](./docs/RELIABILITY.md) documents in the documentation. (#93)
 * CodeQL code scanning workflow for Python static analysis. (#29)
 * Dependabot updates for `github-actions` and `terraform` ecosystems. (#29)
+* CI workflow to build and push service images to GitHub Container Registry on master merge. (#97)
 
 ### Changed
 
 * Completed [ARCHITECTURE.md](./docs/ARCHITECTURE.md) (#93)
 * Migrated CI from self-hosted to GitHub-hosted runners with Docker-in-Docker test infrastructure. (#94)
+* Test workflow pulls pre-built images from GHCR with local build fallback. (#97)
 
 ### Fixed