From b30abab12b7b7bb0f7f35bfdddfe42d9d43d083e Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 23 Jan 2023 14:53:13 -0500 Subject: [PATCH] release a base CLI container image --- .github/workflows/main.yml | 28 +++++++++-- .github/workflows/mattermost-webhook.yml | 2 +- .github/workflows/publish-containers.yml | 61 ++++++++++++++++++++++++ container-images/Dockerfile.cli-base | 30 ++++++++++++ 4 files changed, 115 insertions(+), 6 deletions(-) create mode 100644 .github/workflows/publish-containers.yml create mode 100644 container-images/Dockerfile.cli-base diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 490c07905..fc2552475 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -89,9 +89,8 @@ jobs: fablab-smoketest: name: Fablab Smoketest + if: github.repository_owner == 'openziti' runs-on: ubuntu-20.04 - outputs: - ZITI_VERSION: ${{ steps.get_version.outputs.ZITI_VERSION }} steps: - name: Git Checkout uses: actions/checkout@v3 @@ -193,6 +192,14 @@ jobs: CC=arm-linux-gnueabihf-gcc $(go env GOPATH)/bin/gox -cgo -os=linux -arch=arm -output=$GOX_OUTPUT ./... CC=aarch64-linux-gnu-gcc $(go env GOPATH)/bin/gox -cgo -os=linux -arch=arm64 -output=$GOX_OUTPUT ./... + # upload Linux artifacts so we can copy them into a container image in another workflow + - name: Upload artifacts + uses: actions/upload-artifact@v3 + with: + name: linux-release-${{ github.run_id }} + path: release/ + retention-days: 5 + - name: Download darwin release artifact uses: actions/download-artifact@v3 with: @@ -210,9 +217,9 @@ jobs: with: version: 1.51.1 - # remaining steps in job only run on the upstream repo, not forks - - name: Publish - if: github.repository_owner == 'openziti' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v')) + - name: Publish GitHub Release + # forks need to run this step with their own GPG key because ziti-ci creates the GH release + if: env.ziti_ci_gpg_key_id != null && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v')) env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ziti_ci_gpg_key: ${{ secrets.ZITI_CI_GPG_KEY }} @@ -311,7 +318,18 @@ jobs: # needs: publish name: Call the On-Demand Smoketest Workflow + # not applicable to forks + if: github.repository_owner == 'openziti' uses: ./.github/workflows/jenkins-smoketest.yml secrets: inherit with: ziti-version: ${{ needs.publish.outputs.ZITI_VERSION }} + + call-publish-containers: + if: github.repository_owner == 'openziti' && (github.ref == 'refs/heads/main') + name: Publish Container Images + needs: publish + uses: ./.github/workflows/publish-containers.yml + secrets: inherit + with: + ziti-version: ${{ needs.publish.outputs.ZITI_VERSION }} diff --git a/.github/workflows/mattermost-webhook.yml b/.github/workflows/mattermost-webhook.yml index a214230f6..c38096299 100644 --- a/.github/workflows/mattermost-webhook.yml +++ b/.github/workflows/mattermost-webhook.yml @@ -15,7 +15,7 @@ jobs: mattermost-ziti-webhook: runs-on: ubuntu-latest name: POST Webhook - if: github.actor != 'dependabot[bot]' + if: github.repository_owner == 'openziti' && github.actor != 'dependabot[bot]' env: ZITI_LOG: 99 ZITI_NODEJS_LOG: 99 diff --git a/.github/workflows/publish-containers.yml b/.github/workflows/publish-containers.yml new file mode 100644 index 000000000..1e7f4b276 --- /dev/null +++ b/.github/workflows/publish-containers.yml @@ -0,0 +1,61 @@ +name: CI build + +on: + workflow_call: + inputs: + ziti-version: + description: 'Ziti Release Version' + type: string + required: true + +jobs: + publish-containers: + runs-on: ubuntu-latest + env: + ZITI_VERSION: ${{ inputs.ziti-version || github.event.inputs.ziti-version }} + steps: + - name: Checkout Workspace + uses: actions/checkout@v3 + + - name: Download darwin release artifact + uses: actions/download-artifact@v3 + with: + name: linux-release-${{ github.run_id }} + path: release/ + + - name: Set up QEMU + uses: docker/setup-qemu-action@v2 + with: + platforms: amd64,arm64 + + - name: Set up Docker BuildKit + id: buildx + uses: docker/setup-buildx-action@v2 + + - name: Login to Docker Hub + uses: docker/login-action@v2 + with: + username: ${{ secrets.DOCKER_HUB_API_USER }} + password: ${{ secrets.DOCKER_HUB_API_TOKEN }} + + - name: Set up Docker image tags for base CLI container + env: + RELEASE_REPO: openziti/ziti-cli + id: tagprep_run + run: | + DOCKER_TAGS="" + DOCKER_TAGS="${RELEASE_REPO}:${ZITI_VERSION},${RELEASE_REPO}:latest" + echo "DEBUG: DOCKER_TAGS=${DOCKER_TAGS}" + echo DOCKER_TAGS="${DOCKER_TAGS}" >> $GITHUB_OUTPUT + + - name: Build & Push Multi-Platform Container Image to Hub + uses: docker/build-push-action@v3 + with: + builder: ${{ steps.buildx.outputs.name }} + context: ${{ github.workspace }}/ + file: ${{ github.workspace }}/container-images/Dockerfile.cli-base + platforms: linux/amd64,linux/arm64 + tags: ${{ steps.tagprep_run.outputs.DOCKER_TAGS }} + build-args: | + ZITI_VERSION=${{ env.ZITI_VERSION }} + push: true diff --git a/container-images/Dockerfile.cli-base b/container-images/Dockerfile.cli-base new file mode 100644 index 000000000..46226fcb0 --- /dev/null +++ b/container-images/Dockerfile.cli-base @@ -0,0 +1,30 @@ +# this builds docker.io/openziti/ziti-cli +FROM registry.access.redhat.com/ubi8/ubi-minimal +# This build stage grabs artifacts that are copied into the final image. +# It uses the same base as the final image to maximize docker cache hits. + +ARG ARTIFACTS_DIR=./release +# e.g. linux +ARG TARGETOS +# e.g. arm +ARG TARGETARCH +# e.g. v7 (OS variant) +# TARGETVARIANT + +### Required OpenShift Labels +LABEL name="openziti/ziti-cli" \ + maintainer="developers@openziti.org" \ + vendor="NetFoundry" \ + summary="Run the OpenZiti CLI" \ + description="Run the OpenZiti CLI" + +### add licenses to this directory +RUN mkdir -m0755 /licenses +COPY ./LICENSE /licenses/apache.txt + +RUN mkdir -p /usr/local/bin +COPY ${ARTIFACTS_DIR}/${TARGETARCH}/${TARGETOS}/ziti /usr/local/bin/ +RUN chmod 0755 /usr/local/bin/ziti +USER nobody + +CMD [ "ziti" ]