mirror of
https://github.com/fluxerapp/fluxer.git
synced 2026-09-02 21:04:06 +03:00
fix(docker): emit consistent OCI metadata on every image (#2321)
This commit is contained in:
Hampus
@@ -104,6 +104,9 @@ jobs:
|
||||
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
||||
env:
|
||||
GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
|
||||
- name: resolve source date
|
||||
id: source
|
||||
run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
|
||||
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
|
||||
- uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
|
||||
with:
|
||||
@@ -115,11 +118,13 @@ jobs:
|
||||
context: ${{ inputs.context }}
|
||||
file: ${{ inputs.dockerfile }}
|
||||
push: true
|
||||
provenance: false
|
||||
provenance: mode=min
|
||||
platforms: linux/${{ matrix.platform }}
|
||||
tags: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
|
||||
build-args: |
|
||||
BUILD_VERSION=${{ needs.meta.outputs.build_version }}
|
||||
SOURCE_SHA=${{ github.sha }}
|
||||
SOURCE_DATE=${{ steps.source.outputs.date }}
|
||||
${{ inputs.extra-build-args }}
|
||||
cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }}
|
||||
cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
|
||||
|
||||
@@ -59,6 +59,20 @@ RUN test "$(ls target/release/build/fluxer_admin-*/out/static/fonts/*.woff2 | wc
|
||||
FROM debian:bookworm-slim AS runtime
|
||||
|
||||
ARG BUILD_VERSION=""
|
||||
ARG SOURCE_SHA=""
|
||||
ARG SOURCE_DATE=""
|
||||
|
||||
LABEL org.opencontainers.image.title="fluxer-admin"
|
||||
LABEL org.opencontainers.image.description="Fluxer admin console"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
WORKDIR /usr/local/bin
|
||||
|
||||
|
||||
@@ -29,6 +29,20 @@ RUN pnpm deploy --legacy --filter=fluxer_api --prod --config.allowUnusedPatches=
|
||||
FROM node:24-bookworm-slim
|
||||
|
||||
ARG BUILD_VERSION
|
||||
ARG SOURCE_SHA
|
||||
ARG SOURCE_DATE
|
||||
|
||||
LABEL org.opencontainers.image.title="fluxer-api"
|
||||
LABEL org.opencontainers.image.description="Fluxer HTTP API and background workers"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
WORKDIR /usr/src/app/fluxer_api
|
||||
|
||||
|
||||
@@ -145,6 +145,20 @@ RUN if [ "${FLUXER_APP_PROXY_TIME_FREEZE_ENABLED}" = "false" ]; then \
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
ARG BUILD_VERSION=""
|
||||
ARG SOURCE_SHA=""
|
||||
ARG SOURCE_DATE=""
|
||||
|
||||
LABEL org.opencontainers.image.title="fluxer-app-proxy"
|
||||
LABEL org.opencontainers.image.description="Fluxer web app and edge proxy"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
WORKDIR /srv/app
|
||||
|
||||
|
||||
@@ -16,6 +16,23 @@ RUN zensical build --clean \
|
||||
|
||||
FROM nginxinc/nginx-unprivileged:1.29-alpine AS runtime
|
||||
|
||||
ARG BUILD_VERSION=""
|
||||
ARG SOURCE_SHA=""
|
||||
ARG SOURCE_DATE=""
|
||||
|
||||
LABEL maintainer="Fluxer"
|
||||
LABEL org.opencontainers.image.title="fluxer-docs"
|
||||
LABEL org.opencontainers.image.description="Fluxer documentation site"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
||||
COPY --from=builder /tmp/security-headers.conf /etc/nginx/conf.d/security-headers.conf
|
||||
COPY --from=builder /src/fluxer_docs/site /usr/share/nginx/html
|
||||
|
||||
@@ -35,6 +35,20 @@ RUN LOGGER_LEVEL=${LOGGER_LEVEL} envsubst < config/sys.config.template > config/
|
||||
FROM erlang:28-slim
|
||||
|
||||
ARG BUILD_VERSION=""
|
||||
ARG SOURCE_SHA=""
|
||||
ARG SOURCE_DATE=""
|
||||
|
||||
LABEL org.opencontainers.image.title="fluxer-gateway"
|
||||
LABEL org.opencontainers.image.description="Fluxer realtime gateway"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
WORKDIR /opt/fluxer_gateway
|
||||
|
||||
|
||||
@@ -11,6 +11,20 @@ RUN cargo build --release -p fluxer-gifs
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
ARG BUILD_VERSION=""
|
||||
ARG SOURCE_SHA=""
|
||||
ARG SOURCE_DATE=""
|
||||
|
||||
LABEL org.opencontainers.image.title="fluxer-gifs"
|
||||
LABEL org.opencontainers.image.description="Fluxer GIF search and proxy service"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
WORKDIR /usr/local/bin
|
||||
|
||||
|
||||
@@ -27,13 +27,19 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
||||
|
||||
FROM ${DEBIAN_BASE} AS runtime
|
||||
ARG BUILD_VERSION=""
|
||||
ARG SOURCE_SHA=""
|
||||
ARG SOURCE_DATE=""
|
||||
|
||||
LABEL org.opencontainers.image.title="fluxer-media-proxy"
|
||||
LABEL org.opencontainers.image.description="High-throughput media transcoding proxy: libvips + libavformat + libcurl"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxer/fluxer/tree/main/fluxer_media_proxy"
|
||||
LABEL org.opencontainers.image.documentation="https://github.com/fluxer/fluxer/blob/main/fluxer_media_proxy/README.md"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
||||
|
||||
@@ -11,6 +11,20 @@ RUN cargo build --release -p fluxer-messages --features scylla
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
ARG BUILD_VERSION=""
|
||||
ARG SOURCE_SHA=""
|
||||
ARG SOURCE_DATE=""
|
||||
|
||||
LABEL org.opencontainers.image.title="fluxer-messages"
|
||||
LABEL org.opencontainers.image.description="Fluxer message storage service"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
WORKDIR /usr/local/bin
|
||||
|
||||
|
||||
@@ -11,6 +11,20 @@ RUN cargo build --release -p fluxer-snowflakes
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
ARG BUILD_VERSION=""
|
||||
ARG SOURCE_SHA=""
|
||||
ARG SOURCE_DATE=""
|
||||
|
||||
LABEL org.opencontainers.image.title="fluxer-snowflakes"
|
||||
LABEL org.opencontainers.image.description="Fluxer snowflake ID service"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
WORKDIR /usr/local/bin
|
||||
|
||||
|
||||
@@ -4,12 +4,19 @@
|
||||
FROM caddy:2.10-alpine
|
||||
|
||||
ARG BUILD_VERSION=""
|
||||
ARG SOURCE_SHA=""
|
||||
ARG SOURCE_DATE=""
|
||||
|
||||
LABEL org.opencontainers.image.title="fluxer-static"
|
||||
LABEL org.opencontainers.image.description="Self-hostable static asset bundle for Fluxer"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer/tree/main/fluxer_static"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
COPY fluxer_static/Caddyfile /etc/caddy/Caddyfile
|
||||
|
||||
@@ -11,6 +11,20 @@ RUN cargo build --release -p fluxer-unfurl
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
ARG BUILD_VERSION=""
|
||||
ARG SOURCE_SHA=""
|
||||
ARG SOURCE_DATE=""
|
||||
|
||||
LABEL org.opencontainers.image.title="fluxer-unfurl"
|
||||
LABEL org.opencontainers.image.description="Fluxer link unfurl and embed service"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
WORKDIR /usr/local/bin
|
||||
|
||||
|
||||
@@ -11,6 +11,20 @@ RUN cargo build --release -p fluxer-users --features scylla
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
ARG BUILD_VERSION=""
|
||||
ARG SOURCE_SHA=""
|
||||
ARG SOURCE_DATE=""
|
||||
|
||||
LABEL org.opencontainers.image.title="fluxer-users"
|
||||
LABEL org.opencontainers.image.description="Fluxer user storage service"
|
||||
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
||||
LABEL org.opencontainers.image.vendor="Fluxer"
|
||||
LABEL org.opencontainers.image.url="https://fluxer.app"
|
||||
LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
|
||||
LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
|
||||
LABEL org.opencontainers.image.version="${BUILD_VERSION}"
|
||||
LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
|
||||
LABEL org.opencontainers.image.created="${SOURCE_DATE}"
|
||||
LABEL app.fluxer.build-version="${BUILD_VERSION}"
|
||||
|
||||
WORKDIR /usr/local/bin
|
||||
|
||||
|
||||
@@ -324,4 +324,101 @@ mod tests {
|
||||
|
||||
assert_eq!(missing_app_wasm_artifact(root), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn image_dockerfiles_carry_the_release_label_block() {
|
||||
const REQUIRED: [&str; 9] = [
|
||||
"LABEL org.opencontainers.image.licenses=\"AGPL-3.0-or-later\"",
|
||||
"LABEL org.opencontainers.image.vendor=\"Fluxer\"",
|
||||
"LABEL org.opencontainers.image.url=\"https://fluxer.app\"",
|
||||
"LABEL org.opencontainers.image.documentation=\"https://docs.fluxer.app\"",
|
||||
"LABEL org.opencontainers.image.source=\"https://github.com/fluxerapp/fluxer\"",
|
||||
"LABEL org.opencontainers.image.version=\"${BUILD_VERSION}\"",
|
||||
"LABEL org.opencontainers.image.revision=\"${SOURCE_SHA}\"",
|
||||
"LABEL org.opencontainers.image.created=\"${SOURCE_DATE}\"",
|
||||
"LABEL app.fluxer.build-version=\"${BUILD_VERSION}\"",
|
||||
];
|
||||
|
||||
for (name, title, dockerfile) in [
|
||||
(
|
||||
"fluxer_admin",
|
||||
"fluxer-admin",
|
||||
include_str!("../../../fluxer_admin/Dockerfile"),
|
||||
),
|
||||
(
|
||||
"fluxer_api",
|
||||
"fluxer-api",
|
||||
include_str!("../../../fluxer_api/Dockerfile"),
|
||||
),
|
||||
(
|
||||
"fluxer_app_proxy",
|
||||
"fluxer-app-proxy",
|
||||
include_str!("../../../fluxer_app_proxy/Dockerfile"),
|
||||
),
|
||||
(
|
||||
"fluxer_docs",
|
||||
"fluxer-docs",
|
||||
include_str!("../../../fluxer_docs/Dockerfile"),
|
||||
),
|
||||
(
|
||||
"fluxer_gateway",
|
||||
"fluxer-gateway",
|
||||
include_str!("../../../fluxer_gateway/Dockerfile"),
|
||||
),
|
||||
(
|
||||
"fluxer_gifs",
|
||||
"fluxer-gifs",
|
||||
include_str!("../../../fluxer_gifs/Dockerfile"),
|
||||
),
|
||||
(
|
||||
"fluxer_media_proxy",
|
||||
"fluxer-media-proxy",
|
||||
include_str!("../../../fluxer_media_proxy/Dockerfile"),
|
||||
),
|
||||
(
|
||||
"fluxer_messages",
|
||||
"fluxer-messages",
|
||||
include_str!("../../../fluxer_messages/Dockerfile"),
|
||||
),
|
||||
(
|
||||
"fluxer_snowflakes",
|
||||
"fluxer-snowflakes",
|
||||
include_str!("../../../fluxer_snowflakes/Dockerfile"),
|
||||
),
|
||||
(
|
||||
"fluxer_static",
|
||||
"fluxer-static",
|
||||
include_str!("../../../fluxer_static/Dockerfile"),
|
||||
),
|
||||
(
|
||||
"fluxer_unfurl",
|
||||
"fluxer-unfurl",
|
||||
include_str!("../../../fluxer_unfurl/Dockerfile"),
|
||||
),
|
||||
(
|
||||
"fluxer_users",
|
||||
"fluxer-users",
|
||||
include_str!("../../../fluxer_users/Dockerfile"),
|
||||
),
|
||||
] {
|
||||
assert!(
|
||||
dockerfile.contains("ARG SOURCE_SHA"),
|
||||
"{name}/Dockerfile must declare ARG SOURCE_SHA"
|
||||
);
|
||||
assert!(
|
||||
dockerfile.contains("ARG SOURCE_DATE"),
|
||||
"{name}/Dockerfile must declare ARG SOURCE_DATE"
|
||||
);
|
||||
assert!(
|
||||
dockerfile.contains(&format!("LABEL org.opencontainers.image.title=\"{title}\"")),
|
||||
"{name}/Dockerfile must declare the title {title}"
|
||||
);
|
||||
for label in REQUIRED {
|
||||
assert!(
|
||||
dockerfile.contains(label),
|
||||
"{name}/Dockerfile must declare {label}"
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user