ci: publish multi-arch images to ghcr.io - #56
Conversation
📝 WalkthroughWalkthroughThe release process now builds multi-platform Docker images for the Flagsmith CLI, publishes them to GHCR, and attests their digests. A multi-stage Dockerfile supplies CA certificates and selects platform-specific binaries. The README adds Docker usage instructions and documents credential configuration through environment variables. Estimated code review effort: 3 (Moderate) | ~20 minutes Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
513c2fc to
96727e9
Compare
96727e9 to
7dc04a1
Compare
f816b57 to
20db097
Compare
e0524b2 to
ab10f29
Compare
goreleaser's dockers_v2 assembles the manifest from the binaries it already built, so the image is a COPY of a static binary and the repo keeps one version-stamping path. The final stage runs nothing: a RUN would need QEMU to execute a non-native arch under buildx, so the cert bundle is copied out of a BUILDPLATFORM stage instead. Alpine over distroless keeps a shell, which the image needs to serve as a CI job image. Beta releases take :latest — nothing stabler is published yet. beep boop
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 87f14019-981a-4ffc-860b-c3d1e200bbf7
📒 Files selected for processing (4)
.github/workflows/release.yml.goreleaser.yamlDockerfileREADME.md
matthewelwell
left a comment
matthewelwell
left a comment
There was a problem hiding this comment.
Blindly stamping based on previous approval which was dismissed by a rebase 🙈
4 participants
Closes #45.
Verified locally
goreleaser release --snapshot --clean --skip=publishbuilt both per-arch images.flagsmith version v1.1.0, cert bundle present at/etc/ssl/certs/ca-certificates.crt, and a request reachededge.api.flagsmith.comover TLS — so the trust store works.Important
:maintag yet:dockers_v2only runs on a tag.docker_digestwritesdigests.txtso the images get attested too. That step is the one thing here I could not verify locally — snapshot mode publishes nothing, so no digest file exists until a real tag.