Skip to content

Commit 07f0e0e

Browse files
giom-lHaarolean
giom-l
and
Haarolean
authored
Infra: Add actions to publish to ECR & Docker Hub (#347)
Co-authored-by: Roman Zabaluev <gpg@haarolean.dev>
1 parent 941358d commit 07f0e0e

File tree

4 files changed

+235
-77
lines changed

4 files changed

+235
-77
lines changed

‎.github/workflows/docker_build.yml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
name: "Docker build"
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
sha:
7+
required: true
8+
type: string
9+
version:
10+
required: true
11+
type: string
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
build:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v4
22+
with:
23+
ref: ${{ github.event.pull_request.head.sha }}
24+
token: ${{ github.token }}
25+
26+
- name: Download maven artifacts
27+
uses: actions/download-artifact@v4
28+
with:
29+
name: kafbat-ui-${{ inputs.version }}
30+
path: api/target
31+
32+
- name: Set up QEMU
33+
uses: docker/setup-qemu-action@v3
34+
35+
- name: Set up Docker Buildx
36+
id: buildx
37+
uses: docker/setup-buildx-action@v3
38+
39+
- name: Cache Docker layers
40+
uses: actions/cache@v4
41+
with:
42+
path: /tmp/.buildx-cache
43+
key: ${{ runner.os }}-buildx-${{ inputs.sha }}
44+
restore-keys: |
45+
${{ runner.os }}-buildx-
46+
47+
# Build multi platform images and loading them at the same time is not possible with default container runtime : https://github.com/docker/buildx/issues/59
48+
# So let's use containerd instead as it supports this option
49+
# Also containerd is one of the option to allow preserving provenance attestations :https://docs.docker.com/build/attestations/#creating-attestations
50+
- name: Setup docker with containerd
51+
uses: crazy-max/ghaction-setup-docker@v3
52+
with:
53+
daemon-config: |
54+
{
55+
"features": {
56+
"containerd-snapshotter": true
57+
}
58+
}
59+
60+
- name: Build docker image
61+
id: docker_build
62+
uses: docker/build-push-action@v5
63+
with:
64+
builder: ${{ steps.buildx.outputs.name }}
65+
context: api
66+
platforms: linux/amd64,linux/arm64
67+
provenance: mode=min
68+
sbom: true
69+
push: false
70+
load: true
71+
tags: |
72+
kafka-ui:temp
73+
build-args: |
74+
JAR_FILE=api-${{ inputs.version }}.jar
75+
cache-from: type=local,src=/tmp/.buildx-cache
76+
cache-to: type=local,dest=/tmp/.buildx-cache
77+
78+
- name: Dump docker image
79+
run: |
80+
docker image save kafka-ui:temp > /tmp/image.tar
81+
82+
- name: Upload docker image
83+
uses: actions/upload-artifact@v4
84+
with:
85+
name: image
86+
path: /tmp/image.tar
87+
retention-days: 1

‎.github/workflows/docker_publish.yml

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
name: "Docker publish"
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
version:
7+
required: true
8+
type: string
9+
generic_tag:
10+
required: true
11+
type: string
12+
13+
permissions:
14+
packages: write
15+
id-token: write # Required to authenticate with OIDC for AWS
16+
17+
jobs:
18+
deploy:
19+
continue-on-error: true
20+
strategy:
21+
fail-fast: false
22+
matrix:
23+
registry: [ 'docker.io', 'ghcr.io', 'ecr' ]
24+
25+
runs-on: ubuntu-latest
26+
steps:
27+
28+
- name: Download docker image
29+
uses: actions/download-artifact@v4
30+
with:
31+
name: image
32+
path: /tmp
33+
34+
# setup containerd to preserve provenance attestations :https://docs.docker.com/build/attestations/#creating-attestations
35+
- name: Setup docker with containerd
36+
uses: crazy-max/ghaction-setup-docker@v3
37+
with:
38+
daemon-config: |
39+
{
40+
"features": {
41+
"containerd-snapshotter": true
42+
}
43+
}
44+
45+
- name: Load docker image into daemon
46+
run: |
47+
docker load --input /tmp/image.tar
48+
49+
- name: Login to docker.io
50+
if: matrix.registry == 'docker.io'
51+
uses: docker/login-action@v3
52+
with:
53+
registry: ${{ matrix.registry }}
54+
username: ${{ secrets.DOCKERHUB_USERNAME }}
55+
password: ${{ secrets.DOCKERHUB_TOKEN }}
56+
57+
- name: Login to ghcr.io
58+
if: matrix.registry == 'ghcr.io'
59+
uses: docker/login-action@v3
60+
with:
61+
registry: ${{ matrix.registry }}
62+
username: ${{ github.actor }}
63+
password: ${{ secrets.GITHUB_TOKEN }}
64+
65+
- name: Configure AWS credentials
66+
if: matrix.registry == 'ecr'
67+
uses: aws-actions/configure-aws-credentials@v4
68+
with:
69+
aws-region: us-east-1 # This region only for public ECR
70+
role-to-assume: ${{ secrets.AWS_ROLE }}
71+
72+
- name: Login to public ECR
73+
if: matrix.registry == 'ecr'
74+
id: login-ecr-public
75+
uses: aws-actions/amazon-ecr-login@v2
76+
with:
77+
registry-type: public
78+
79+
- name: define env vars
80+
run: |
81+
if [ ${{matrix.registry }} == 'docker.io' ]; then
82+
echo "REGISTRY=${{ matrix.registry }}" >> $GITHUB_ENV
83+
echo "REPOSITORY=${{ github.repository }}" >> $GITHUB_ENV
84+
elif [ ${{ matrix.registry }} == 'ghcr.io' ]; then
85+
echo "REGISTRY=${{ matrix.registry }}" >> $GITHUB_ENV
86+
echo "REPOSITORY=${{ github.repository }}" >> $GITHUB_ENV
87+
elif [ ${{ matrix.registry }} == 'ecr' ]; then
88+
echo "REGISTRY=${{ steps.login-ecr-public.outputs.registry }}" >> $GITHUB_ENV
89+
echo "REPOSITORY=${{ github.repository }}" >> $GITHUB_ENV
90+
else
91+
echo "REGISTRY=" >> $GITHUB_ENV
92+
echo "REPOSITORY=notworking" >> $GITHUB_ENV
93+
fi
94+
95+
- name: Push images to ${{ matrix.registry }}
96+
run: |
97+
docker tag kafka-ui:temp ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:${{ inputs.generic_tag }}
98+
docker tag kafka-ui:temp ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:${{ inputs.version }}
99+
docker push ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:${{ inputs.generic_tag }}
100+
docker push ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:${{ inputs.version }}

‎.github/workflows/main.yml

Lines changed: 29 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,14 @@ permissions:
99
contents: read
1010

1111
jobs:
12-
build:
12+
jar-build:
1313
runs-on: ubuntu-latest
14+
1415
permissions:
1516
contents: read
16-
packages: write
17+
18+
outputs:
19+
version: ${{steps.build.outputs.version}}
1720

1821
steps:
1922
- name: Checkout
@@ -37,42 +40,30 @@ jobs:
3740
export VERSION=$(./mvnw -q -Dexec.executable=echo -Dexec.args='${project.version}' --non-recursive exec:exec)
3841
echo "version=${VERSION}" >> $GITHUB_OUTPUT
3942
40-
# docker images
41-
42-
- name: Set up QEMU
43-
uses: docker/setup-qemu-action@v3
44-
45-
- name: Set up Docker Buildx
46-
uses: docker/setup-buildx-action@v3
47-
48-
- name: Cache Docker layers
49-
uses: actions/cache@v4
43+
- name: Upload jar
44+
uses: actions/upload-artifact@v4
5045
with:
51-
path: /tmp/.buildx-cache
52-
key: ${{ runner.os }}-buildx-${{ github.sha }}
53-
restore-keys: |
54-
${{ runner.os }}-buildx-
46+
name: kafbat-ui-${{ steps.build.outputs.version }}
47+
path: api/target/api-${{ steps.build.outputs.version }}.jar
48+
retention-days: 1
5549

56-
- name: Login to GitHub Container Registry
57-
uses: docker/login-action@v3
58-
with:
59-
registry: ghcr.io
60-
username: ${{ github.actor }}
61-
password: ${{ secrets.GITHUB_TOKEN }}
50+
docker-build:
51+
needs: jar-build
52+
permissions:
53+
contents: read
54+
uses: ./.github/workflows/docker_build.yml
55+
secrets: inherit
56+
with:
57+
sha: ${{ github.sha }}
58+
version: ${{ needs.jar-build.outputs.version }}
6259

63-
- name: Build & push docker image
64-
id: docker_build_and_push
65-
uses: docker/build-push-action@v5
66-
with:
67-
builder: ${{ steps.buildx.outputs.name }}
68-
context: api
69-
platforms: linux/amd64,linux/arm64
70-
provenance: false
71-
push: true
72-
tags: |
73-
ghcr.io/kafbat/kafka-ui:${{ steps.build.outputs.version }}
74-
ghcr.io/kafbat/kafka-ui:main
75-
build-args: |
76-
JAR_FILE=api-${{ steps.build.outputs.version }}.jar
77-
cache-from: type=local,src=/tmp/.buildx-cache
78-
cache-to: type=local,dest=/tmp/.buildx-cache
60+
docker-deploy:
61+
needs: [ jar-build, docker-build ]
62+
permissions:
63+
packages: write
64+
id-token: write # Required to authenticate with OIDC for AWS
65+
uses: ./.github/workflows/docker_publish.yml
66+
secrets: inherit
67+
with:
68+
version: ${{ needs.jar-build.outputs.version }}
69+
generic_tag: main

‎.github/workflows/release.yml

Lines changed: 19 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -52,47 +52,27 @@ jobs:
5252
with:
5353
name: kafbat-ui-${{ steps.build.outputs.version }}
5454
path: api/target/api-${{ steps.build.outputs.version }}.jar
55-
#################
56-
# #
57-
# Docker images #
58-
# #
59-
#################
60-
- name: Set up QEMU
61-
uses: docker/setup-qemu-action@v3
6255

63-
- name: Set up Docker Buildx
64-
uses: docker/setup-buildx-action@v3
65-
66-
- name: Cache Docker layers
67-
uses: actions/cache@v4
68-
with:
69-
path: /tmp/.buildx-cache
70-
key: ${{ runner.os }}-buildx-${{ github.sha }}
71-
restore-keys: |
72-
${{ runner.os }}-buildx-
56+
docker-build:
57+
needs: release
58+
permissions:
59+
contents: read
60+
uses: ./.github/workflows/docker_build.yml
61+
secrets: inherit
62+
with:
63+
sha: ${{ github.sha }}
64+
version: ${{ needs.release.outputs.version }}
7365

74-
- name: Login to GitHub Container Registry
75-
uses: docker/login-action@v3
76-
with:
77-
registry: ghcr.io
78-
username: ${{ github.actor }}
79-
password: ${{ secrets.GITHUB_TOKEN }}
80-
- name: Build and push
81-
id: docker_build_and_push
82-
uses: docker/build-push-action@v5
83-
with:
84-
builder: ${{ steps.buildx.outputs.name }}
85-
context: api
86-
platforms: linux/amd64,linux/arm64
87-
provenance: false
88-
push: true
89-
tags: |
90-
ghcr.io/kafbat/kafka-ui:${{ steps.build.outputs.version }}
91-
ghcr.io/kafbat/kafka-ui:latest
92-
build-args: |
93-
JAR_FILE=api-${{ steps.build.outputs.version }}.jar
94-
cache-from: type=local,src=/tmp/.buildx-cache
95-
cache-to: type=local,dest=/tmp/.buildx-cache
66+
docker-deploy:
67+
needs: [release, docker-build]
68+
permissions:
69+
packages: write
70+
id-token: write # Required to authenticate with OIDC for AWS
71+
uses: ./.github/workflows/docker_publish.yml
72+
secrets: inherit
73+
with:
74+
version: ${{ needs.release.outputs.version }}
75+
generic_tag: latest
9676

9777
charts:
9878
runs-on: ubuntu-latest

0 commit comments

Comments
 (0)