Repository navigation
chore(deps): update ferrlabs/.github digest to 2ea7662 #175
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | ||
| on: | ||
| release: | ||
| types: [published] | ||
| # The image is built on release only, so a Dockerfile that stops linting or | ||
| # building stays invisible until a version has been tagged and published | ||
| # without one, which is how five releases went out with no image at all. A | ||
| # change to the file now has to prove itself before it is merged. | ||
| pull_request: | ||
| paths: | ||
| - Dockerfile | ||
| - site/Dockerfile | ||
| - .github/workflows/docker.yml | ||
| workflow_dispatch: | ||
| inputs: | ||
| version: | ||
| description: 'Version (without the v prefix)' | ||
| required: true | ||
| target: | ||
| description: 'Which image to build' | ||
| type: choice | ||
| options: [server, site] | ||
| default: server | ||
| # Read at the top. Pushing, signing and reporting are the business of the three | ||
| # jobs that do them, and the two jobs that only build a pull request need none | ||
| # of it. | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| meta: | ||
| name: Resolve build parameters | ||
| permissions: {} | ||
| # The server releases as `v0.40.0` and the site as `site@2026.8.18`, so the | ||
| # tag says which image to build. Matching only `v` meant a site release built | ||
| # nothing at all, and a server release rebuilt the site under the server's | ||
| # version. | ||
| if: | | ||
| startsWith(github.event.release.tag_name, 'v') || | ||
| startsWith(github.event.release.tag_name, 'site@') || | ||
| github.event_name == 'workflow_dispatch' | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| version: ${{ steps.meta.outputs.version }} | ||
| major_minor: ${{ steps.meta.outputs.major_minor }} | ||
| ref: ${{ steps.meta.outputs.ref }} | ||
| kind: ${{ steps.meta.outputs.kind }} | ||
| steps: | ||
| - id: meta | ||
| run: | | ||
| set -euo pipefail | ||
| if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | ||
| KIND="${{ inputs.target }}" | ||
| VERSION="${{ inputs.version }}" | ||
| if [ "${KIND}" = "site" ]; then | ||
| REF="refs/tags/site@${VERSION}" | ||
| else | ||
| REF="refs/tags/v${VERSION}" | ||
| fi | ||
| else | ||
| TAG="${{ github.event.release.tag_name }}" | ||
| REF="refs/tags/${TAG}" | ||
| case "${TAG}" in | ||
| site@*) KIND=site; VERSION="${TAG#site@}" ;; | ||
| v*) KIND=server; VERSION="${TAG#v}" ;; | ||
| *) echo "::error::unrecognised release tag ${TAG}"; exit 1 ;; | ||
| esac | ||
| fi | ||
| { | ||
| echo "kind=${KIND}" | ||
| echo "version=${VERSION}" | ||
| echo "major_minor=$(echo "${VERSION}" | cut -d. -f1-2)" | ||
| echo "ref=${REF}" | ||
| } >> "$GITHUB_OUTPUT" | ||
| build: | ||
| name: Build & Push LFSX | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| id-token: write | ||
| attestations: write | ||
| security-events: write | ||
| needs: meta | ||
| if: needs.meta.outputs.kind == 'server' | ||
| uses: FerrLabs/.github/.github/workflows/reusable-docker-build.yml@2ea766256b2f8a92114638a0eb8f54967e9bca25 # main | ||
| with: | ||
| image-name: ghcr.io/ferrlabs/lfsx | ||
| tag: ${{ needs.meta.outputs.version }} | ||
| ref: ${{ needs.meta.outputs.ref }} | ||
| context: . | ||
| dockerfile: Dockerfile | ||
| platforms: linux/amd64,linux/arm64 | ||
| sccache-gha: true | ||
| extra-tags: ghcr.io/ferrlabs/lfsx:${{ needs.meta.outputs.major_minor }} | ||
| smoke-test-cmd: | | ||
| podman run -d --name lfsx-smoke -p 18080:8080 "$SMOKE_IMAGE" | ||
| trap 'podman logs lfsx-smoke; podman rm -f lfsx-smoke >/dev/null' EXIT | ||
| for _ in $(seq 30); do | ||
| if curl -fsS http://127.0.0.1:18080/health | grep -qx ok; then | ||
| echo "health ok" | ||
| exit 0 | ||
| fi | ||
| sleep 1 | ||
| done | ||
| echo "::error::the image never answered /health" | ||
| exit 1 | ||
| # The lfsx.dev site is a separate image from the server: same repository, but | ||
| # its own Dockerfile, its own package registry, its own deployment target (the | ||
| # cluster's `lfsx` namespace), and since the release config split, its own | ||
| # version, on a calendar clock. It has no sccache (nothing Rust compiles | ||
| # here) and stays amd64: that is the cluster's only architecture, and an | ||
| # arm64 build would double the time for nobody. | ||
| site: | ||
| name: Build & Push Site | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| id-token: write | ||
| attestations: write | ||
| security-events: write | ||
| needs: meta | ||
| if: needs.meta.outputs.kind == 'site' | ||
| uses: FerrLabs/.github/.github/workflows/reusable-docker-build.yml@2ea766256b2f8a92114638a0eb8f54967e9bca25 # main | ||
| with: | ||
| image-name: ghcr.io/ferrlabs/lfsx/site | ||
| tag: ${{ needs.meta.outputs.version }} | ||
| ref: ${{ needs.meta.outputs.ref }} | ||
| context: . | ||
| dockerfile: site/Dockerfile | ||
| platforms: linux/amd64 | ||
| extra-tags: ghcr.io/ferrlabs/lfsx/site:${{ needs.meta.outputs.major_minor }} | ||
| smoke-test-cmd: | | ||
| podman run -d --name lfsx-site-smoke -p 18081:8080 "$SMOKE_IMAGE" | ||
| trap 'podman logs lfsx-site-smoke; podman rm -f lfsx-site-smoke >/dev/null' EXIT | ||
| for _ in $(seq 30); do | ||
| if curl -fsS -o /dev/null http://127.0.0.1:18081/; then | ||
| echo "site ok" | ||
| exit 0 | ||
| fi | ||
| sleep 1 | ||
| done | ||
| echo "::error::the site image never served /" | ||
| exit 1 | ||
| secrets: | ||
| packages-read: ${{ secrets.FERRFLOW_PACKAGES_READ || secrets.GITHUB_TOKEN }} | ||
| verify: | ||
|
Check failure on line 151 in .github/workflows/docker.yml
|
||
| name: Build without publishing | ||
| permissions: | ||
| contents: read | ||
| if: github.event_name == 'pull_request' | ||
| uses: FerrLabs/.github/.github/workflows/reusable-docker-build.yml@2ea766256b2f8a92114638a0eb8f54967e9bca25 # main | ||
| with: | ||
| image-name: ghcr.io/ferrlabs/lfsx | ||
| tag: pr-${{ github.event.pull_request.number }} | ||
| context: . | ||
| dockerfile: Dockerfile | ||
| # Both, because the arm64 cross-compile is the half a laptop cannot try | ||
| # and the half that has broken before. It is a cross build rather than an | ||
| # emulated one, so the second platform costs a compile and not an hour. | ||
| platforms: linux/amd64,linux/arm64 | ||
| sccache-gha: true | ||
| push: false | ||
| verify-site: | ||
| name: Build the site without publishing | ||
| permissions: | ||
| contents: read | ||
| if: github.event_name == 'pull_request' | ||
| uses: FerrLabs/.github/.github/workflows/reusable-docker-build.yml@2ea766256b2f8a92114638a0eb8f54967e9bca25 # main | ||
| with: | ||
| image-name: ghcr.io/ferrlabs/lfsx/site | ||
| tag: pr-${{ github.event.pull_request.number }} | ||
| context: . | ||
| dockerfile: site/Dockerfile | ||
| platforms: linux/amd64 | ||
| push: false | ||
| secrets: | ||
| packages-read: ${{ secrets.FERRFLOW_PACKAGES_READ || secrets.GITHUB_TOKEN }} | ||
