From 4d9fdec2c9562823111a5d4496e328bc51f52b3e Mon Sep 17 00:00:00 2001 From: Anton Sviridov Date: Tue, 18 Nov 2025 13:40:05 +0000 Subject: [PATCH 1/6] wip --- .dockerignore | 1 + Dockerfile | 17 +++++++++++++++++ 2 files changed, 18 insertions(+) create mode 100644 .dockerignore create mode 100644 Dockerfile diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000000..ae04b3c8c5 --- /dev/null +++ b/.dockerignore @@ -0,0 +1 @@ +./out diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000000..892a144494 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,17 @@ +FROM eclipse-temurin:17 as build +RUN apt update && apt install build-essential libz-dev clang procps -y +WORKDIR /workdir +COPY . . +RUN ./mill -i copyTo --task 'cli[]'.nativeImageStatic --dest "./docker-out/scala-cli" 1>&2 + +FROM debian:stable-slim +COPY --from=build /workdir/docker-out/scala-cli /usr/bin/scala-cli +RUN \ + echo "println(1)" | scala-cli -S 3 - -v -v -v && \ + echo "println(1)" | scala-cli -S 2.13 - -v -v -v && \ + echo "println(1)" | scala-cli -S 2.12 - -v -v -v +RUN \ + echo "println(1)" | scala-cli --power package --native _.sc --force && \ + echo "println(1)" | scala-cli --power package --native-image _.sc --force + +ENTRYPOINT ["scala-cli"] From b9b37b3aab49e918d5463364117549fa6f54d06d Mon Sep 17 00:00:00 2001 From: Anton Sviridov Date: Tue, 18 Nov 2025 13:43:59 +0000 Subject: [PATCH 2/6] WIP --- .dockerignore | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.dockerignore b/.dockerignore index ae04b3c8c5..e2e705404d 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1 +1,10 @@ ./out +.bloop +.bsp +.metals +.scala-build +.scala +gifs +.git +website +.github From 5a2da94302c761456d799db007b8f9d5bda37839 Mon Sep 17 00:00:00 2001 From: Anton Sviridov Date: Tue, 18 Nov 2025 14:02:54 +0000 Subject: [PATCH 3/6] Docker publishing workflow --- .dockerignore | 2 +- .github/workflows/publish-docker.yml | 133 +++++++++++++++++++++++++++ Dockerfile | 5 +- 3 files changed, 137 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/publish-docker.yml diff --git a/.dockerignore b/.dockerignore index e2e705404d..77848f07c9 100644 --- a/.dockerignore +++ b/.dockerignore @@ -5,6 +5,6 @@ .scala-build .scala gifs -.git website .github +Dockerfile diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml new file mode 100644 index 0000000000..ac938243e0 --- /dev/null +++ b/.github/workflows/publish-docker.yml @@ -0,0 +1,133 @@ +name: Create and publish a Docker image + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +# Configures this workflow to run every time a change is pushed to the branch called `release`. +on: + push: + branches: ["main"] + tags: ["v*"] + +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }} + DOCKERFILE: ./Dockerfile + REGISTRY_LOGIN: ${{ github.actor }} + REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }} + +jobs: + docker_build: + strategy: + fail-fast: true + matrix: + os: ["ubuntu-22.04", "ubuntu-22.04-arm"] + runs-on: ${{ matrix.os }} + # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job. + permissions: + contents: read + packages: write + attestations: write + id-token: write + # + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Log in to the Container registry + uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels. + - name: Extract metadata (tags, labels) for Docker + id: meta + uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages. + # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository. + # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step. + - name: Build and push Docker image + id: push + uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4 + with: + context: . + file: ${{ env.DOCKERFILE }} + cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-${{ matrix.os }} + cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-${{ matrix.os }},mode=max + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + + # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see "[AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)." + - name: Generate artifact attestation + uses: actions/attest-build-provenance@v1 + with: + subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}} + subject-digest: ${{ steps.push.outputs.digest }} + push-to-registry: true + + - name: Export digest + run: | + mkdir -p /tmp/digests + digest="${{ steps.push.outputs.digest }}" + touch "/tmp/digests/${digest#sha256:}" + + - name: Upload digest + uses: actions/upload-artifact@v4 + with: + name: digests-${{ matrix.os }} + path: /tmp/digests/* + if-no-files-found: error + retention-days: 1 + + docker_release_merge: + runs-on: ubuntu-22.04 + permissions: + contents: read + packages: write + attestations: write + id-token: write + needs: [docker_build] + if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main') + steps: + - name: Download digests + uses: actions/download-artifact@v4 + with: + pattern: digests-* + path: /tmp/digests + merge-multiple: true + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v2 + + - name: Log in to the Container registry + uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Docker meta + id: meta + uses: docker/metadata-action@v4 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + + - name: Create manifest list and push + working-directory: /tmp/digests + run: | + docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ + $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *) + + - name: Inspect image + run: | + docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} diff --git a/Dockerfile b/Dockerfile index 892a144494..d4ab46e31a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,10 +1,11 @@ FROM eclipse-temurin:17 as build -RUN apt update && apt install build-essential libz-dev clang procps -y +RUN apt update && apt install build-essential libz-dev clang procps git -y WORKDIR /workdir COPY . . -RUN ./mill -i copyTo --task 'cli[]'.nativeImageStatic --dest "./docker-out/scala-cli" 1>&2 +RUN ./mill -i copyTo --task 'cli[].base-image.nativeImage' --dest "./docker-out/scala-cli" 1>&2 FROM debian:stable-slim +RUN apt update && apt install build-essential libz-dev clang procps -y COPY --from=build /workdir/docker-out/scala-cli /usr/bin/scala-cli RUN \ echo "println(1)" | scala-cli -S 3 - -v -v -v && \ From 93079619648e0b475f874ee2676387b488d7a637 Mon Sep 17 00:00:00 2001 From: Anton Sviridov Date: Fri, 21 Nov 2025 09:27:06 +0000 Subject: [PATCH 4/6] Update versions --- .github/workflows/publish-docker.yml | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml index ac938243e0..f44a277538 100644 --- a/.github/workflows/publish-docker.yml +++ b/.github/workflows/publish-docker.yml @@ -4,7 +4,6 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -# Configures this workflow to run every time a change is pushed to the branch called `release`. on: push: branches: ["main"] @@ -36,16 +35,16 @@ jobs: uses: actions/checkout@v4 - name: Log in to the Container registry - uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1 + uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + username: ${{ env.REGISTRY_LOGIN }} + password: ${{ env.REGISTRY_PASSWORD }} # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels. - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7 + uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} @@ -57,7 +56,7 @@ jobs: # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step. - name: Build and push Docker image id: push - uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4 + uses: docker/build-push-action@v6 with: context: . file: ${{ env.DOCKERFILE }} @@ -69,7 +68,7 @@ jobs: # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see "[AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)." - name: Generate artifact attestation - uses: actions/attest-build-provenance@v1 + uses: actions/attest-build-provenance@v3 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}} subject-digest: ${{ steps.push.outputs.digest }} @@ -82,7 +81,7 @@ jobs: touch "/tmp/digests/${digest#sha256:}" - name: Upload digest - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v5 with: name: digests-${{ matrix.os }} path: /tmp/digests/* @@ -100,17 +99,17 @@ jobs: if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main') steps: - name: Download digests - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v6 with: pattern: digests-* path: /tmp/digests merge-multiple: true - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@v3 - name: Log in to the Container registry - uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1 + uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -118,7 +117,7 @@ jobs: - name: Docker meta id: meta - uses: docker/metadata-action@v4 + uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} From 2d072681e514474074e1e3126a0c68b495b030c1 Mon Sep 17 00:00:00 2001 From: Anton Sviridov Date: Fri, 21 Nov 2025 10:11:11 +0000 Subject: [PATCH 5/6] use env registry creds --- .github/workflows/publish-docker.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml index f44a277538..927e582e42 100644 --- a/.github/workflows/publish-docker.yml +++ b/.github/workflows/publish-docker.yml @@ -112,8 +112,8 @@ jobs: uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + username: ${{ env.REGISTRY_LOGIN }} + password: ${{ env.REGISTRY_PASSWORD }} - name: Docker meta id: meta From 2b309655358ae48dc803f7a32da45d5b9183709e Mon Sep 17 00:00:00 2001 From: Anton Sviridov Date: Mon, 24 Nov 2025 10:16:17 +0000 Subject: [PATCH 6/6] use ubuntu 24 --- .github/workflows/publish-docker.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml index 927e582e42..83ad85c962 100644 --- a/.github/workflows/publish-docker.yml +++ b/.github/workflows/publish-docker.yml @@ -21,7 +21,7 @@ jobs: strategy: fail-fast: true matrix: - os: ["ubuntu-22.04", "ubuntu-22.04-arm"] + os: ["ubuntu-24.04", "ubuntu-24.04-arm"] runs-on: ${{ matrix.os }} # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job. permissions: @@ -89,7 +89,7 @@ jobs: retention-days: 1 docker_release_merge: - runs-on: ubuntu-22.04 + runs-on: ubuntu-24.04 permissions: contents: read packages: write