From 533c0d2645eebc8153bb39c393e9605cdf099a82 Mon Sep 17 00:00:00 2001 From: James Titcumb Date: Wed, 3 Sep 2025 20:39:03 +0100 Subject: [PATCH 1/3] De-duplicate docker image build for nightly and release tags --- .../workflows/build-and-push-docker-image.yml | 92 +++++++++++++++++++ .../workflows/docker-nightly-image-push.yml | 34 +++++++ .github/workflows/release.yml | 82 +++-------------- 3 files changed, 139 insertions(+), 69 deletions(-) create mode 100644 .github/workflows/build-and-push-docker-image.yml create mode 100644 .github/workflows/docker-nightly-image-push.yml diff --git a/.github/workflows/build-and-push-docker-image.yml b/.github/workflows/build-and-push-docker-image.yml new file mode 100644 index 00000000..3a84a959 --- /dev/null +++ b/.github/workflows/build-and-push-docker-image.yml @@ -0,0 +1,92 @@ +# Invoking this pipeline requires additional permissions, so must be invoked +# in a way to pass those permissions on, e.g.: +# +# build-phar: +# permissions: +# contents: read +# id-token: write +# attestations: write +# packages: write +# uses: ./.github/workflows/build-and-push-docker-image.yml + +name: "Build and push the PIE Docker Image" + +on: + workflow_call: + inputs: + tags: + description: Tag definition - see docker/metadata-action + type: string + required: true + +permissions: + contents: read + +jobs: + docker-binary-only-image: + name: Docker binary-only image + runs-on: ubuntu-latest + + permissions: + # attestations:write is required for build provenance attestation. + attestations: write + # id-token:write is required for build provenance attestation. + id-token: write + # packages:write is required to publish Docker images to GitHub's registry. + packages: write + + steps: + - name: Checkout repository + uses: actions/checkout@v5 + + - name: Fetch built PHAR from artifacts + uses: actions/download-artifact@v5 + with: + name: pie-${{ github.sha }}.phar + + - name: Verify the PHAR + env: + GH_TOKEN: ${{ github.token }} + run: gh attestation verify pie.phar --repo ${{ github.repository }} + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Log in to the Container registry + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata (tags, labels) for Docker + id: meta + uses: docker/metadata-action@v5 + with: + flavor: | + latest=false + images: ghcr.io/${{ github.repository }} + tags: | + ${{ inputs.tags }} + + - name: Build and push Docker image + id: build-and-push + uses: docker/build-push-action@v6 + with: + context: . + platforms: linux/amd64,linux/arm64 + file: Dockerfile + target: standalone-binary + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + + - name: Generate artifact attestation + uses: actions/attest-build-provenance@v3 + with: + subject-name: ghcr.io/${{ github.repository }} + subject-digest: ${{ steps.build-and-push.outputs.digest }} + push-to-registry: true diff --git a/.github/workflows/docker-nightly-image-push.yml b/.github/workflows/docker-nightly-image-push.yml new file mode 100644 index 00000000..192f5eb3 --- /dev/null +++ b/.github/workflows/docker-nightly-image-push.yml @@ -0,0 +1,34 @@ +name: "Nightly Docker Image Build" + +on: + # Runs on pushes targeting the default branch + push: + branches: ["main"] + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +permissions: + contents: read + +jobs: + build-phar: + # See build-phar.yml for a list of the permissions and why they are needed + permissions: + contents: read + id-token: write + attestations: write + uses: ./.github/workflows/build-phar.yml + + build-and-push-docker-image: + needs: build-phar + # See build-and-push-docker-image.yml for a list of the permissions and why they are needed + permissions: + contents: read + id-token: write + attestations: write + packages: write + uses: ./.github/workflows/build-and-push-docker-image.yml + with: + tags: | + type=raw,value=nightly-bin diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 787410bd..ec5246af 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,76 +39,20 @@ jobs: with: files: pie.phar - docker-binary-only-image: - needs: build-phar - name: Docker binary-only image - runs-on: ubuntu-latest + build-and-push-docker-image: if: ${{ startsWith(github.ref, 'refs/tags/') }} - + needs: build-phar + # See build-and-push-docker-image.yml for a list of the permissions and why they are needed permissions: - # attestations:write is required for build provenance attestation. - attestations: write - # id-token:write is required for build provenance attestation. + contents: read id-token: write - # packages:write is required to publish Docker images to GitHub's registry. + attestations: write packages: write - - steps: - - name: Checkout repository - uses: actions/checkout@v5 - - - name: Fetch built PHAR from artifacts - uses: actions/download-artifact@v5 - with: - name: pie-${{ github.sha }}.phar - - - name: Verify the PHAR - env: - GH_TOKEN: ${{ github.token }} - run: gh attestation verify pie.phar --repo ${{ github.repository }} - - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Log in to the Container registry - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Extract metadata (tags, labels) for Docker - id: meta - uses: docker/metadata-action@v5 - with: - flavor: | - latest=false - images: ghcr.io/${{ github.repository }} - # @TODO v1.0 Consider introducing more granular tags (major and major.minor) - # @see https://github.com/php/pie/pull/122#pullrequestreview-2477496308 - # @see https://github.com/php/pie/pull/122#discussion_r1867331273 - tags: | - type=raw,value=bin - type=semver,pattern={{version}}-bin - - - name: Build and push Docker image - id: build-and-push - uses: docker/build-push-action@v6 - with: - context: . - platforms: linux/amd64,linux/arm64 - file: Dockerfile - target: standalone-binary - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - - - name: Generate artifact attestation - uses: actions/attest-build-provenance@v3 - with: - subject-name: ghcr.io/${{ github.repository }} - subject-digest: ${{ steps.build-and-push.outputs.digest }} - push-to-registry: true + uses: ./.github/workflows/build-and-push-docker-image.yml + with: + # @TODO v1.0 Consider introducing more granular tags (major and major.minor) + # @see https://github.com/php/pie/pull/122#pullrequestreview-2477496308 + # @see https://github.com/php/pie/pull/122#discussion_r1867331273 + tags: | + type=raw,value=bin + type=semver,pattern={{version}}-bin From bd66f7d63b1256ea6d4798eabc8fa166b4469b8a Mon Sep 17 00:00:00 2001 From: James Titcumb Date: Wed, 3 Sep 2025 21:17:09 +0100 Subject: [PATCH 2/3] Only tag bin Docker image when tagging stable --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ec5246af..4cbee8ba 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -54,5 +54,5 @@ jobs: # @see https://github.com/php/pie/pull/122#pullrequestreview-2477496308 # @see https://github.com/php/pie/pull/122#discussion_r1867331273 tags: | - type=raw,value=bin + ${{ ((!contains(github.ref, 'alpha') && !contains(github.ref, 'beta') && !contains(github.ref, 'rc')) && 'type=raw,value=bin') || '' }} type=semver,pattern={{version}}-bin From 70fcaa605c32f60ac5a687a01260db705e6f4aba Mon Sep 17 00:00:00 2001 From: James Titcumb Date: Wed, 3 Sep 2025 21:49:11 +0100 Subject: [PATCH 3/3] Fixed build-and-push-docker-image example --- .github/workflows/build-and-push-docker-image.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-and-push-docker-image.yml b/.github/workflows/build-and-push-docker-image.yml index 3a84a959..be338df9 100644 --- a/.github/workflows/build-and-push-docker-image.yml +++ b/.github/workflows/build-and-push-docker-image.yml @@ -1,13 +1,18 @@ # Invoking this pipeline requires additional permissions, so must be invoked # in a way to pass those permissions on, e.g.: # -# build-phar: +# build-and-push-docker-image: +# needs: build-phar # permissions: # contents: read # id-token: write # attestations: write # packages: write # uses: ./.github/workflows/build-and-push-docker-image.yml +# with: +# tags: | +# type=raw,value=bin +# type=semver,pattern={{version}}-bin name: "Build and push the PIE Docker Image"