ci: publish multi-arch images to ghcr.io - #56
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
Same callout as previous one related to goreleaser version depending on the upstream decision
goreleaser's dockers_v2 assembles the manifest from the binaries it already built, so the image is a COPY of a static binary and the repo keeps one version-stamping path. The final stage runs nothing: a RUN would need QEMU to execute a non-native arch under buildx, so the cert bundle is copied out of a BUILDPLATFORM stage instead. Alpine over distroless keeps a shell, which the image needs to serve as a CI job image. Beta releases take :latest — nothing stabler is published yet. beep boop
3 participants
Closes #45.
Verified locally
goreleaser release --snapshot --clean --skip=publishbuilt both per-arch images.flagsmith version v1.1.0, cert bundle present at/etc/ssl/certs/ca-certificates.crt, and a request reachededge.api.flagsmith.comover TLS — so the trust store works.Important
:maintag yet:dockers_v2only runs on a tag.docker_digestwritesdigests.txtso the images get attested too. That step is the one thing here I could not verify locally — snapshot mode publishes nothing, so no digest file exists until a real tag.