mirror of
https://github.com/fluxerapp/fluxer.git
synced 2026-09-03 05:10:25 +03:00
291 lines
11 KiB
YAML
291 lines
11 KiB
YAML
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
name: build app-proxy
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
build-version:
|
|
description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
|
|
type: string
|
|
required: false
|
|
default: ""
|
|
|
|
permissions:
|
|
actions: read
|
|
contents: write
|
|
packages: write
|
|
|
|
concurrency:
|
|
group: publish-fluxer-app-proxy
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
GHCR_OWNER: ${{ github.repository_owner }}
|
|
|
|
jobs:
|
|
approve:
|
|
name: approve build release
|
|
permissions: {}
|
|
runs-on: ubuntu-24.04
|
|
environment: builds
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: approved
|
|
run: echo "Build release approved."
|
|
|
|
meta:
|
|
name: resolve metadata
|
|
needs: approve
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
build_version: ${{ steps.vars.outputs.build_version }}
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
|
env:
|
|
GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
|
|
- name: Set up Rust toolchain (CI helpers)
|
|
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
|
|
with:
|
|
toolchain: "1.93.0"
|
|
- name: set variables
|
|
id: vars
|
|
run: >-
|
|
tools/ci/run.sh build-app-proxy
|
|
--step set_metadata
|
|
--build-version "${{ inputs['build-version'] }}"
|
|
|
|
dist:
|
|
name: build and publish the canonical asset tree
|
|
needs: meta
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 60
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
|
env:
|
|
GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
|
|
- name: Set up Rust toolchain (CI helpers)
|
|
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
|
|
with:
|
|
toolchain: "1.93.0"
|
|
- name: prepare docker config
|
|
run: >-
|
|
tools/ci/run.sh build-app-proxy
|
|
--step prepare_docker_config
|
|
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
|
|
- name: configure ghcr auth
|
|
env:
|
|
GHCR_USERNAME: ${{ github.actor }}
|
|
GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: >-
|
|
tools/ci/run.sh build-app-proxy
|
|
--step configure_ghcr_auth
|
|
|
|
- name: build the dist once and publish it as the canonical asset image
|
|
env:
|
|
BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
|
|
PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
|
|
CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist
|
|
CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
|
|
DOCKER_BUILD_SUMMARY: false
|
|
DOCKER_BUILD_RECORD_UPLOAD: false
|
|
run: >-
|
|
tools/ci/run.sh build-app-proxy
|
|
--step build_dist
|
|
|
|
- name: generate asset manifest
|
|
run: >-
|
|
tools/ci/run.sh build-app-proxy
|
|
--step generate_asset_manifest
|
|
|
|
- name: upload assets to S3 static bucket
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
|
|
S3_ENDPOINT: ${{ vars.STATIC_S3_ENDPOINT }}
|
|
STATIC_BUCKET: ${{ vars.STATIC_S3_BUCKET }}
|
|
run: >-
|
|
tools/ci/run.sh build-app-proxy
|
|
--step upload_assets
|
|
|
|
- name: verify every uploaded asset is readable
|
|
env:
|
|
PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
|
|
run: >-
|
|
tools/ci/run.sh build-app-proxy
|
|
--step verify_published_assets
|
|
|
|
build:
|
|
name: build app-proxy (amd64)
|
|
needs: [meta, dist]
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 45
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
|
env:
|
|
GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
|
|
- name: Set up Rust toolchain (CI helpers)
|
|
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
|
|
with:
|
|
toolchain: "1.93.0"
|
|
- name: resolve source date
|
|
id: source
|
|
run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
|
|
- name: prepare docker config
|
|
run: >-
|
|
tools/ci/run.sh build-app-proxy
|
|
--step prepare_docker_config
|
|
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
|
|
- name: configure ghcr auth
|
|
env:
|
|
GHCR_USERNAME: ${{ github.actor }}
|
|
GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: >-
|
|
tools/ci/run.sh build-app-proxy
|
|
--step configure_ghcr_auth
|
|
|
|
- name: build and push image
|
|
env:
|
|
BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
|
|
SOURCE_SHA: ${{ github.sha }}
|
|
SOURCE_DATE: ${{ steps.source.outputs.date }}
|
|
PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
|
|
CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64
|
|
CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
|
|
DOCKER_BUILD_SUMMARY: false
|
|
DOCKER_BUILD_RECORD_UPLOAD: false
|
|
run: >-
|
|
tools/ci/run.sh build-app-proxy
|
|
--step build_image
|
|
|
|
build-arm64:
|
|
name: build app-proxy (arm64)
|
|
needs: [meta, dist]
|
|
runs-on: ubuntu-24.04-arm
|
|
timeout-minutes: 60
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
|
env:
|
|
GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
|
|
- name: resolve source date
|
|
id: source
|
|
run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
|
|
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
|
|
- uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
|
|
with:
|
|
context: .
|
|
file: fluxer_app_proxy/Dockerfile
|
|
push: true
|
|
provenance: false
|
|
platforms: linux/arm64
|
|
tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
|
|
build-args: |
|
|
BUILD_VERSION=${{ needs.meta.outputs.build_version }}
|
|
SOURCE_SHA=${{ github.sha }}
|
|
SOURCE_DATE=${{ steps.source.outputs.date }}
|
|
APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
|
|
APP_ASSETS_PLATFORM=linux/amd64
|
|
cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64
|
|
cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
|
|
env:
|
|
DOCKER_BUILD_SUMMARY: false
|
|
DOCKER_BUILD_RECORD_UPLOAD: false
|
|
|
|
merge:
|
|
name: merge multi-arch manifest
|
|
needs: [meta, build, build-arm64]
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 20
|
|
permissions:
|
|
contents: write
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
|
env:
|
|
GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
|
|
- name: Set up Rust toolchain (CI helpers)
|
|
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
|
|
with:
|
|
toolchain: "1.93.0"
|
|
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
|
|
- uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: verify cross-architecture asset parity
|
|
env:
|
|
APP_PROXY_ASSETS_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
|
|
APP_PROXY_AMD64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}
|
|
APP_PROXY_ARM64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
|
|
run: >-
|
|
tools/ci/run.sh build-app-proxy
|
|
--step verify_asset_parity
|
|
|
|
- name: fuse amd64 + arm64 into a multi-arch manifest
|
|
env:
|
|
IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy
|
|
VERSION: ${{ needs.meta.outputs.build_version }}
|
|
run: |
|
|
set -euo pipefail
|
|
amd64_digest="$(docker buildx imagetools inspect "${IMAGE}:${VERSION}" --format '{{json .Manifest}}' | jq -r '.digest')"
|
|
echo "amd64 digest: ${amd64_digest}"
|
|
docker buildx imagetools create \
|
|
-t "${IMAGE}:${VERSION}" \
|
|
"${IMAGE}@${amd64_digest}" \
|
|
"${IMAGE}:${VERSION}-arm64"
|
|
docker buildx imagetools inspect "${IMAGE}:${VERSION}"
|
|
|
|
- name: Create token
|
|
id: create-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
|
|
with:
|
|
client-id: ${{ vars.FLUXER_CI_APP_ID }}
|
|
private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
|
|
owner: fluxerapp
|
|
repositories: fluxer
|
|
permission-contents: write
|
|
- name: Publish GitHub release
|
|
env:
|
|
GH_TOKEN: ${{ steps.create-token.outputs.token }}
|
|
SOURCE_SHA: ${{ github.sha }}
|
|
VERSION: ${{ needs.meta.outputs.build_version }}
|
|
RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
|
|
run: >-
|
|
tools/ci/run.sh release
|
|
publish
|
|
--component fluxer-app-proxy
|
|
--build-version "${VERSION}"
|
|
--source-sha "${SOURCE_SHA}"
|
|
--previous-sha "${RELEASE_BASELINE_SHA}"
|
|
|
|
- name: Advance moving image tags
|
|
env:
|
|
VERSION: ${{ needs.meta.outputs.build_version }}
|
|
run: >-
|
|
tools/ci/run.sh image-set
|
|
promote
|
|
--component fluxer-app-proxy
|
|
--build-version "${VERSION}"
|
|
--registry "ghcr.io/${{ env.GHCR_OWNER }}"
|
|
--moving-tags v1,latest
|