mirror of
https://github.com/Stirling-Tools/Stirling-PDF.git
synced 2026-09-03 05:10:16 +03:00
270 lines
11 KiB
YAML
270 lines
11 KiB
YAML
name: Build Docker images (PR test)
|
|
|
|
# Reusable workflow called from build.yml on PRs to verify the three
|
|
# embedded Dockerfiles (default, ultra-lite, fat) still build cleanly,
|
|
# optionally against a freshly-built base image when the PR touches the
|
|
# base Dockerfile.
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
docker-base-changed:
|
|
description: "Whether the docker base image changed (forwarded from files-changed)."
|
|
required: false
|
|
type: string
|
|
default: "false"
|
|
dockerfiles-changed:
|
|
description: "Whether any Dockerfile changed (forwarded from files-changed). Gates the slow arm64 build leg."
|
|
required: false
|
|
type: string
|
|
default: "false"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
# A changed base image is shared by all three embedded-image builds. Build
|
|
# it once and transfer it as an artifact; the matrix jobs use the local
|
|
# Docker driver so the loaded image is visible to the build.
|
|
prepare-base-image:
|
|
if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
|
|
environment:
|
|
name: ci-unsigned
|
|
deployment: false
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Build base image locally
|
|
run: docker build --platform linux/amd64 -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base
|
|
|
|
- name: Export base image
|
|
run: docker save stirling-pdf-base:pr-test | gzip -1 > stirling-pdf-base-pr-test.tar.gz
|
|
|
|
- name: Upload base image
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: docker-base-pr-test
|
|
path: stirling-pdf-base-pr-test.tar.gz
|
|
retention-days: 1
|
|
if-no-files-found: error
|
|
|
|
test-build-docker-images:
|
|
if: always() && (needs.prepare-base-image.result == 'success' || needs.prepare-base-image.result == 'skipped')
|
|
needs: [prepare-base-image]
|
|
environment:
|
|
name: ci-unsigned
|
|
deployment: false
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- docker-rev: docker/embedded/Dockerfile
|
|
artifact-suffix: Dockerfile
|
|
cache-scope: stirling-pdf-latest
|
|
- docker-rev: docker/embedded/Dockerfile.ultra-lite
|
|
artifact-suffix: Dockerfile.ultra-lite
|
|
cache-scope: stirling-pdf-ultra-lite
|
|
- docker-rev: docker/embedded/Dockerfile.fat
|
|
artifact-suffix: Dockerfile.fat
|
|
cache-scope: stirling-pdf-fat
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ github.token }}
|
|
|
|
- name: Convert repository owner to lowercase
|
|
id: repoowner
|
|
run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
|
|
|
|
- name: Free disk space on runner
|
|
run: |
|
|
echo "Disk space before cleanup:" && df -h
|
|
sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
|
|
docker system prune -af || true
|
|
echo "Disk space after cleanup:" && df -h
|
|
|
|
- name: Download prepared base image
|
|
if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: docker-base-pr-test
|
|
|
|
- name: Load prepared base image
|
|
if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
|
|
run: gzip -dc stirling-pdf-base-pr-test.tar.gz | docker load
|
|
|
|
- name: Restore cache Gradle User Home
|
|
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
|
|
|
|
- name: Set up JDK 25
|
|
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
|
|
with:
|
|
java-version: "25"
|
|
distribution: "temurin"
|
|
|
|
- name: Install Task
|
|
uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
|
|
- name: Build application
|
|
run: task backend:build
|
|
env:
|
|
MAVEN_USER: ${{ secrets.MAVEN_USER }}
|
|
MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
|
|
MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
|
|
DISABLE_ADDITIONAL_FEATURES: true
|
|
STIRLING_PDF_DESKTOP_UI: false
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
|
|
|
|
- name: Set up Docker Buildx
|
|
id: buildx
|
|
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
|
|
|
- name: Set base image and platform for this build
|
|
id: build-params
|
|
# Pass workflow inputs through env vars rather than expanding `${{ }}`
|
|
# directly into the shell — defense-in-depth against template injection
|
|
# if any upstream provider of these values ever becomes less trusted.
|
|
# GITHUB_EVENT_NAME is already provided by the runner.
|
|
env:
|
|
DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
|
|
DOCKERFILES_CHANGED: ${{ inputs.dockerfiles-changed }}
|
|
run: |
|
|
if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "$DOCKER_BASE_CHANGED" = "true" ]; then
|
|
# Base Dockerfile changed: build against the locally-built base,
|
|
# which only exists for amd64.
|
|
echo "base_image=stirling-pdf-base:pr-test" >> "$GITHUB_OUTPUT"
|
|
echo "platforms=linux/amd64" >> "$GITHUB_OUTPUT"
|
|
elif [ "$DOCKERFILES_CHANGED" = "true" ]; then
|
|
# A Dockerfile changed: also verify the arm64 build (slow QEMU leg).
|
|
echo "base_image=stirlingtools/stirling-pdf-base:latest" >> "$GITHUB_OUTPUT"
|
|
echo "platforms=linux/amd64,linux/arm64/v8" >> "$GITHUB_OUTPUT"
|
|
else
|
|
# No Dockerfile change: amd64 only. arm64 is exercised on the base
|
|
# image publish and on release, not on every code PR.
|
|
echo "base_image=stirlingtools/stirling-pdf-base:latest" >> "$GITHUB_OUTPUT"
|
|
echo "platforms=linux/amd64" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
# Base-changed PRs build the embedded image with the local docker driver
|
|
# so the locally-built stirling-pdf-base:pr-test (in the daemon image
|
|
# store) resolves. A buildx container builder cannot see it and would try
|
|
# to pull it from a registry, which fails. Single-platform, no gha cache.
|
|
- name: Build ${{ matrix.docker-rev }} against local base (PR base change)
|
|
if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
|
|
run: |
|
|
DOCKER_BUILDKIT=1 docker build \
|
|
--build-arg BASE_IMAGE=${{ steps.build-params.outputs.base_image }} \
|
|
--file ./${{ matrix.docker-rev }} \
|
|
--tag stirling-pdf-embedded:pr-test \
|
|
.
|
|
|
|
# PRs that did NOT change the base use the buildx container builder
|
|
# (multi-platform + gha cache) against the published base image.
|
|
- name: Build ${{ matrix.docker-rev }}
|
|
if: inputs.docker-base-changed != 'true'
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
|
with:
|
|
builder: ${{ steps.buildx.outputs.name }}
|
|
context: .
|
|
file: ./${{ matrix.docker-rev }}
|
|
push: false
|
|
cache-from: type=gha,scope=${{ matrix.cache-scope }}
|
|
cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
|
|
platforms: ${{ steps.build-params.outputs.platforms }}
|
|
build-args: |
|
|
BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
|
|
provenance: true
|
|
sbom: true
|
|
|
|
- name: Upload Reports
|
|
if: always()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: reports-docker-${{ matrix.artifact-suffix }}
|
|
path: |
|
|
build/reports/tests/
|
|
build/test-results/
|
|
build/reports/problems/
|
|
retention-days: 3
|
|
if-no-files-found: warn
|
|
|
|
test-build-unoserver-image:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
|
|
|
|
- name: Set up Docker Buildx
|
|
id: buildx
|
|
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
|
|
|
- name: Build docker/unoserver/Dockerfile
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
|
with:
|
|
builder: ${{ steps.buildx.outputs.name }}
|
|
context: .
|
|
file: ./docker/unoserver/Dockerfile
|
|
push: false
|
|
load: true
|
|
cache-from: type=gha,scope=stirling-unoserver
|
|
cache-to: type=gha,mode=max,scope=stirling-unoserver
|
|
platforms: linux/amd64
|
|
tags: stirling-unoserver:pr-test
|
|
provenance: false
|
|
sbom: false
|
|
|
|
- name: Smoke test the built image
|
|
run: |
|
|
set -eu
|
|
docker run -d --name unoserver-smoke \
|
|
-e UNOSERVER_RECYCLE_INTERVAL_SECONDS=0 \
|
|
stirling-unoserver:pr-test
|
|
deadline=$((SECONDS + 60))
|
|
while [ $SECONDS -lt $deadline ]; do
|
|
status=$(docker inspect -f '{{.State.Health.Status}}' unoserver-smoke 2>/dev/null || echo "starting")
|
|
if [ "$status" = "healthy" ]; then
|
|
echo "unoserver became healthy"
|
|
docker logs unoserver-smoke | tail -30
|
|
docker rm -f unoserver-smoke
|
|
exit 0
|
|
fi
|
|
sleep 3
|
|
done
|
|
echo "unoserver did not become healthy in time"
|
|
docker logs unoserver-smoke || true
|
|
docker rm -f unoserver-smoke || true
|
|
exit 1
|