tben
f7ef218507
CI / check (push) Canceled after 0s
The Gitea registry is on a VPN, which a GitHub runner can never reach, so the mirror step in the release workflow could only ever fail: its last four releases reported a step that did nothing. The workflow now builds and pushes to GHCR alone, which is the registry the installer defaults to, and nothing in CI mentions Gitea. The image reaches the Gitea registry through `scripts/mirror-gitea.sh` (`bun run mirror:gitea`) instead, run in parallel with a release and from the VPN side: it copies from the Gitea host over ssh, where skopeo can see both registries, so nothing has to be installed there. `skopeo copy --all` keeps the manifest list and its signatures, and every destination tag is read back and compared with GHCR's digest, so a partial copy fails loudly instead of being assumed to have worked. `latest` and `major.minor` are only moved while that release still owns them in GHCR, so mirroring an older release never rolls them back. Neither direction can fail the other now, which is the point: a registry that is down, slow or full no longer takes a release with it.
97 lines
3.2 KiB
YAML
97 lines
3.2 KiB
YAML
name: Release image
|
|
|
|
# Builds and pushes the multi-arch image to GHCR, the registry the installer
|
|
# defaults to.
|
|
#
|
|
# The Gitea registry is on a VPN, which a GitHub runner can never reach, so CI
|
|
# does not touch it at all: `scripts/mirror-gitea.sh` copies a release into it
|
|
# from the VPN side, in parallel and after the fact. Keeping the two apart is
|
|
# what makes a registry outage unable to fail a release.
|
|
on:
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
concurrency:
|
|
group: release-image
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
image:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: docker/setup-qemu-action@v3
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Log in to GHCR
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# The version the app reports on Settings > General when the build
|
|
# isn't a published release.
|
|
- name: Read the source version
|
|
id: source
|
|
run: |
|
|
set -euo pipefail
|
|
echo "version=$(sed -n -E 's/^[[:space:]]*"version": "([^"]+)",?$/\1/p' package.json | head -n1)" >> "$GITHUB_OUTPUT"
|
|
|
|
# The same four tags for every kind of build: a release gets its own
|
|
# version plus the moving `latest` and `major.minor`, so that
|
|
# scripts/mirror-gitea.sh can copy whichever of them still belong to
|
|
# it, and a dispatch build gets the commit tag only, since it is not a
|
|
# release and must not move `latest`.
|
|
- name: Work out image tags
|
|
id: tags
|
|
env:
|
|
EVENT: ${{ github.event_name }}
|
|
RELEASE_TAG: ${{ github.event.release.tag_name }}
|
|
SOURCE_VERSION: ${{ steps.source.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
sha="sha-${GITHUB_SHA::12}"
|
|
if [ "$EVENT" = "release" ] && [ -n "$RELEASE_TAG" ]; then
|
|
version="$RELEASE_TAG"
|
|
minor="$(printf '%s' "$version" | sed -E 's/^v?([0-9]+)\.([0-9]+).*/\1.\2/')"
|
|
tags="$(printf '%s\n' \
|
|
"ghcr.io/moduletrace/cobble:latest" \
|
|
"ghcr.io/moduletrace/cobble:${version}" \
|
|
"ghcr.io/moduletrace/cobble:${minor}" \
|
|
"ghcr.io/moduletrace/cobble:${sha}")"
|
|
else
|
|
version="$SOURCE_VERSION"
|
|
tags="ghcr.io/moduletrace/cobble:${sha}"
|
|
fi
|
|
{
|
|
echo "version=$version"
|
|
echo "tags<<EOF"
|
|
echo "$tags"
|
|
echo "EOF"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
# The only push CI makes. The installer defaults to this registry, so
|
|
# this step failing has to fail the release.
|
|
- name: Build and push to GHCR
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile
|
|
platforms: linux/amd64,linux/arm64
|
|
push: true
|
|
build-args: |
|
|
COBBLE_VERSION=${{ steps.tags.outputs.version }}
|
|
tags: ${{ steps.tags.outputs.tags }}
|
|
provenance: false
|
|
sbom: false
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|