Skip to content

Commit 9f188f8

Browse files
frristfrrist
committed
ci: implement docker container pipeline
1 parent c234f47 commit 9f188f8

3 files changed

Lines changed: 208 additions & 8 deletions

File tree

‎.dockerignore‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,30 @@ deploy/Makefile
77
deploy/.tfworkspace
88
deploy/app
99
deploy/shared
10+
11+
# Git/CI
1012
.github
1113
.git
12-
.gitignore
14+
.gitignore
15+
16+
# Documentation
17+
*.md
18+
LICENSE
19+
20+
# Docker tooling
21+
docker-compose*.yml
22+
23+
# Environment files
24+
.env*
25+
26+
# IDE/Editor
27+
.idea
28+
.vscode
29+
*.swp
30+
31+
# Build artifacts
32+
bin/
33+
34+
# Config (service uses env vars)
35+
*.yaml
36+
*.yml

‎.github/workflows/publish-ghcr.yml‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
name: Container
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
tags:
8+
- 'v*'
9+
workflow_run:
10+
workflows: [Releaser]
11+
types:
12+
- completed
13+
pull_request:
14+
15+
concurrency:
16+
group: ${{ github.workflow }}-${{ github.ref }}
17+
cancel-in-progress: true
18+
19+
env:
20+
REGISTRY: ghcr.io
21+
IMAGE_NAME: ${{ github.repository }}
22+
23+
jobs:
24+
# PR Build Check - validate Dockerfile compiles, single platform, no push
25+
build-check:
26+
if: github.event_name == 'pull_request'
27+
name: Build Check
28+
runs-on: ubuntu-latest
29+
steps:
30+
- name: Checkout
31+
uses: actions/checkout@v4
32+
33+
- name: Set up Docker Buildx
34+
uses: docker/setup-buildx-action@v3
35+
36+
- name: Build (amd64 only, no push)
37+
uses: docker/build-push-action@v6
38+
with:
39+
context: .
40+
push: false
41+
platforms: linux/amd64
42+
cache-from: type=gha
43+
44+
# Prepare ref for Releaser workflow integration
45+
prepare-checkout:
46+
if: github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success'
47+
name: Prepare ref
48+
runs-on: ubuntu-latest
49+
outputs:
50+
ref: ${{ steps.releaser.outputs.version }}
51+
steps:
52+
- name: Get ref from Releaser
53+
id: releaser
54+
uses: ipdxco/unified-github-workflows/.github/actions/inspect-releaser@v1.0
55+
with:
56+
artifacts-url: ${{ github.event.workflow_run.artifacts_url }}
57+
58+
# Publish on push to main branch
59+
publish-main:
60+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
61+
name: Publish (main)
62+
runs-on: ubuntu-latest
63+
permissions:
64+
contents: read
65+
packages: write
66+
steps:
67+
- name: Checkout
68+
uses: actions/checkout@v4
69+
70+
- name: Set up QEMU
71+
uses: docker/setup-qemu-action@v3
72+
73+
- name: Set up Docker Buildx
74+
uses: docker/setup-buildx-action@v3
75+
76+
- name: Log in to Container registry
77+
uses: docker/login-action@v3
78+
with:
79+
registry: ${{ env.REGISTRY }}
80+
username: ${{ github.actor }}
81+
password: ${{ secrets.GITHUB_TOKEN }}
82+
83+
- name: Extract metadata
84+
id: meta
85+
uses: docker/metadata-action@v5
86+
with:
87+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
88+
tags: |
89+
type=raw,value=main
90+
type=sha,prefix=sha-,format=short
91+
92+
- name: Build and push
93+
uses: docker/build-push-action@v6
94+
with:
95+
context: .
96+
push: true
97+
platforms: linux/amd64,linux/arm64
98+
tags: ${{ steps.meta.outputs.tags }}
99+
labels: ${{ steps.meta.outputs.labels }}
100+
cache-from: type=gha
101+
cache-to: type=gha,mode=max
102+
103+
# Publish on release tag (v*) - direct push or via Releaser
104+
publish-release:
105+
name: Publish (release)
106+
needs: [prepare-checkout]
107+
# Run if: direct tag push OR workflow_run completed successfully
108+
# always() allows running even when prepare-checkout was skipped (direct tag push)
109+
if: |
110+
always() && !cancelled() && !failure() &&
111+
((github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
112+
(github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success'))
113+
runs-on: ubuntu-latest
114+
permissions:
115+
contents: read
116+
packages: write
117+
steps:
118+
- name: Determine ref
119+
id: ref
120+
run: |
121+
if [ "${{ github.event_name }}" = "workflow_run" ]; then
122+
echo "ref=${{ needs.prepare-checkout.outputs.ref }}" >> $GITHUB_OUTPUT
123+
else
124+
echo "ref=${{ github.ref }}" >> $GITHUB_OUTPUT
125+
fi
126+
127+
- name: Checkout
128+
uses: actions/checkout@v4
129+
with:
130+
ref: ${{ steps.ref.outputs.ref }}
131+
132+
- name: Set up QEMU
133+
uses: docker/setup-qemu-action@v3
134+
135+
- name: Set up Docker Buildx
136+
uses: docker/setup-buildx-action@v3
137+
138+
- name: Log in to Container registry
139+
uses: docker/login-action@v3
140+
with:
141+
registry: ${{ env.REGISTRY }}
142+
username: ${{ github.actor }}
143+
password: ${{ secrets.GITHUB_TOKEN }}
144+
145+
- name: Extract metadata
146+
id: meta
147+
uses: docker/metadata-action@v5
148+
with:
149+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
150+
tags: |
151+
type=semver,pattern={{version}}
152+
153+
- name: Build and push
154+
uses: docker/build-push-action@v6
155+
with:
156+
context: .
157+
push: true
158+
platforms: linux/amd64,linux/arm64
159+
tags: ${{ steps.meta.outputs.tags }}
160+
labels: ${{ steps.meta.outputs.labels }}
161+
cache-from: type=gha
162+
cache-to: type=gha,mode=max

‎Dockerfile‎

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,30 @@
1-
FROM golang:1.25-bookworm AS build
1+
# Build stage - use native platform for faster cross-compilation
2+
FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS build
23

3-
WORKDIR /registrar
4+
ARG TARGETOS=linux
5+
ARG TARGETARCH
46

5-
COPY go.* .
7+
WORKDIR /src
8+
9+
# Copy dependency files first for better layer caching
10+
COPY go.mod go.sum ./
611
RUN go mod download
12+
13+
# Copy source code
714
COPY . .
815

9-
RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="-w -s" -o registrar github.com/storacha/delegator
16+
# Build with cross-compilation and stripped binary
17+
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
18+
go build -ldflags="-s -w" -o /app github.com/storacha/delegator
19+
20+
FROM alpine:latest AS prod
21+
22+
# Create non-root user
23+
RUN adduser -D -H appuser
24+
USER appuser
1025

11-
FROM scratch
12-
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
13-
COPY --from=build /registrar/registrar /usr/bin/
26+
# Copy binary from build stage
27+
COPY --from=build /app /usr/bin/registrar
1428

1529
EXPOSE 8080
1630

0 commit comments

Comments
 (0)