summaryrefslogtreecommitdiff
path: root/.github/workflows/multi-arch-build.yaml
blob: 9bd98078b4797deb40c3f102616c385d72b514a3 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
---

# Please see contrib/podmanimage/README.md for details on the intentions
# of this workflow.
#
# BIG FAT WARNING:  This workflow is duplicated across containers/skopeo,
#                   containers/buildah, and containers/podman.  ANY AND
#                   ALL CHANGES MADE HERE MUST BE MANUALLY DUPLICATED
#                   TO THE OTHER REPOS.

name: build multi-arch images

on:
  # Upstream podman tends to be very active, with many merges per day.
  # Only run this daily via cron schedule, or manually, not by branch push.
  schedule:
    - cron:  '0 8 * * *'
  # allows to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  multi:
    name: multi-arch Podman build
    env:
      PODMAN_QUAY_REGISTRY: quay.io/podman
      CONTAINERS_QUAY_REGISTRY: quay.io/containers
      # list of architectures for build
      PLATFORMS: linux/amd64,linux/s390x,linux/ppc64le,linux/arm64

    # build several images (upstream, testing, stable) in parallel
    strategy:
      # By default, failure of one matrix item cancels all others
      fail-fast: false
      matrix:
        # Builds are located under contrib/podmanimage/<source> directory
        source:
          - upstream
          - testing
          - stable
    runs-on: ubuntu-latest
    # internal registry caches build for inspection before push
    services:
      registry:
        image: quay.io/libpod/registry:2
        ports:
          - 5000:5000
    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
        with:
          driver-opts: network=host
          install: true

      - name: Build and locally push Podman
        uses: docker/build-push-action@v2
        with:
          context: contrib/podmanimage/${{ matrix.source }}
          file: ./contrib/podmanimage/${{ matrix.source }}/Dockerfile
          platforms: ${{ env.PLATFORMS }}
          push: true
          tags: localhost:5000/podman/${{ matrix.source }}

      # Simple verification that stable images work, and
      # also grab version number use in forming the FQIN.
      - name: amd64 container sniff test
        if: matrix.source == 'stable'
        id: sniff_test
        run: |
          podman pull --tls-verify=false \
                            localhost:5000/podman/${{ matrix.source }}
          VERSION_OUTPUT="$(podman run \
                            localhost:5000/podman/${{ matrix.source }} \
                            podman --storage-driver=vfs version)"
          echo "$VERSION_OUTPUT"
          VERSION=$(grep -Em1 '^Version: ' <<<"$VERSION_OUTPUT" | awk '{print $2}')
          test -n "$VERSION"
          echo "::set-output name=version::${VERSION}"

      - name: Generate podman reg. image FQIN(s)
        id: podman_reg
        run: |
          if [[ "${{ matrix.source }}" == 'stable' ]]; then
            # The `podman version` in image just built
            VERSION='v${{ steps.sniff_test.outputs.version }}'
            # workaround vim syntax-highlight bug: '
            # Image tags previously pushed to quay
            ALLTAGS=$(skopeo list-tags \
                      docker://$PODMAN_QUAY_REGISTRY/stable | \
                      jq -r '.Tags[]')

            # New version? Push quay.io/podman/stable:vX.X.X and :latest
            if ! fgrep -qx "$VERSION" <<<"$ALLTAGS"; then
              # Assume version-tag is also the most up to date (i.e. "latest")
              FQIN="$PODMAN_QUAY_REGISTRY/stable:$VERSION,$PODMAN_QUAY_REGISTRY/stable:latest"
            else # Not a new version-tagged image
              # Assume other contents changed, so this is the "new" latest.
              FQIN="$PODMAN_QUAY_REGISTRY/stable:latest"
            fi
          elif [[ "${{ matrix.source }}" == 'testing' ]]; then
            # Assume some contents changed, always push latest testing.
            FQIN="$PODMAN_QUAY_REGISTRY/testing:latest"
          elif [[ "${{ matrix.source }}" == 'upstream' ]]; then
            # Assume some contents changed, always push latest upstream.
            FQIN="$PODMAN_QUAY_REGISTRY/upstream:latest"
          else
            echo "::error::Unknown matrix item '${{ matrix.source }}'"
            exit 1
          fi
          echo "::warning::Pushing $FQIN"
          echo "::set-output name=fqin::${FQIN}"
          echo '::set-output name=push::true'

      # This is substantially similar to the above logic,
      # but only handles $CONTAINERS_QUAY_REGISTRY for
      # the stable "latest" and named-version tagged images.
      - name: Generate containers reg. image FQIN(s)
        if: matrix.source == 'stable'
        id: containers_reg
        run: |
          VERSION='v${{ steps.sniff_test.outputs.version }}'
          # workaround vim syntax-highlight bug: '
          ALLTAGS=$(skopeo list-tags \
                    docker://$CONTAINERS_QUAY_REGISTRY/podman | \
                    jq -r '.Tags[]')

          # New version? Push quay.io/containers/podman:vX.X.X and latest
          if ! fgrep -qx "$VERSION" <<<"$ALLTAGS"; then
            FQIN="$CONTAINERS_QUAY_REGISTRY/podman:$VERSION,$CONTAINERS_QUAY_REGISTRY/podman:latest"
          else # Not a new version-tagged image, only update latest.
            FQIN="$CONTAINERS_QUAY_REGISTRY/podman:latest"
          fi
          echo "::warning::Pushing $FQIN"
          echo "::set-output name=fqin::${FQIN}"
          echo '::set-output name=push::true'

      - name: Define LABELS multi-line env. var. value
        run: |
          # This is a really hacky/strange workflow idiom, required
          # for setting multi-line $LABELS value for consumption in
          # a future step.
          # https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#multiline-strings
          cat << EOF | tee -a $GITHUB_ENV
          LABELS<<DELIMITER
          org.opencontainers.image.source=https://github.com/${{ github.repository }}.git
          org.opencontainers.image.revision=${{ github.sha }}
          org.opencontainers.image.created=$(date -u --iso-8601=seconds)
          DELIMITER
          EOF

      # Separate steps to login and push for podman and containers quay
      # repositories are required, because 2 sets of credentials are used and `docker
      # login` as well as `podman login` do not support having 2 different
      # credential sets for 1 registry.
      # At the same time reuse of non-shell steps is not supported by Github Actions
      # via anchors or composite actions

      # Push to 'podman' Quay repo for stable, testing. and upstream
      - name: Login to 'podman' Quay registry
        uses: docker/login-action@v1
        if: steps.podman_reg.outputs.push == 'true'
        with:
          registry: ${{ env.PODMAN_QUAY_REGISTRY }}
          # N/B: Secrets are not passed to workflows that are triggered
          #      by a pull request from a fork
          username: ${{ secrets.PODMAN_QUAY_USERNAME }}
          password: ${{ secrets.PODMAN_QUAY_PASSWORD }}

      - name: Push images to 'podman' Quay
        uses: docker/build-push-action@v2
        if: steps.podman_reg.outputs.push == 'true'
        with:
          cache-from: type=registry,ref=localhost:5000/podman/${{ matrix.source }}
          cache-to: type=inline
          context: contrib/podmanimage/${{ matrix.source }}
          file: ./contrib/podmanimage/${{ matrix.source }}/Dockerfile
          platforms: ${{ env.PLATFORMS }}
          push: true
          tags: ${{ steps.podman_reg.outputs.fqin }}
          labels: |
            ${{ env.LABELS }}

      # Push to 'containers' Quay repo only stable podman
      - name: Login to 'containers' Quay registry
        if: steps.containers_reg.outputs.push == 'true'
        uses: docker/login-action@v1
        with:
          registry: ${{ env.CONTAINERS_QUAY_REGISTRY}}
          username: ${{ secrets.CONTAINERS_QUAY_USERNAME }}
          password: ${{ secrets.CONTAINERS_QUAY_PASSWORD }}

      - name: Push images to 'containers' Quay
        if: steps.containers_reg.outputs.push == 'true'
        uses: docker/build-push-action@v2
        with:
          cache-from: type=registry,ref=localhost:5000/podman/${{ matrix.source }}
          cache-to: type=inline
          context: contrib/podmanimage/${{ matrix.source }}
          file: ./contrib/podmanimage/${{ matrix.source }}/Dockerfile
          platforms: ${{ env.PLATFORMS }}
          push: true
          tags: ${{ steps.containers_reg.outputs.fqin }}
          labels: |
            ${{ env.LABELS }}