From 359680036cb065d82f9061808a47ffe45791c08b Mon Sep 17 00:00:00 2001 From: Swanny Date: Thu, 6 Nov 2025 16:45:01 -0500 Subject: [PATCH 1/3] feat: build images for multiple architectures --- .github/workflows/docker-ghcr.yml | 125 ++++++++++++++++++++++++++++-- Dockerfile | 3 +- 2 files changed, 120 insertions(+), 8 deletions(-) diff --git a/.github/workflows/docker-ghcr.yml b/.github/workflows/docker-ghcr.yml index 75aeb40..a731d3c 100644 --- a/.github/workflows/docker-ghcr.yml +++ b/.github/workflows/docker-ghcr.yml @@ -5,12 +5,123 @@ on: types: [published] workflow_dispatch: -# simplest example of using the rust-base action +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }} + jobs: - ghcr-release: - uses: init4tech/actions/.github/workflows/ghcr.yml@main + build-and-push: + runs-on: ${{ matrix.runner }} + permissions: + contents: read + packages: write + attestations: write + id-token: write + strategy: + matrix: + include: + - platform: linux/amd64 + runner: ubuntu-24.04-8core + - platform: linux/arm64 + runner: ubuntu-24.04-arm64-8core + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Log in to Container Registry + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata (tags, labels) for Docker + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=sha + + - name: Build and push Docker image by digest + id: build + uses: docker/build-push-action@v6 + with: + context: . + platforms: ${{ matrix.platform }} + labels: ${{ steps.meta.outputs.labels }} + outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true + cache-from: type=gha,scope=build-${{ matrix.platform }} + cache-to: type=gha,mode=max,scope=build-${{ matrix.platform }} + ssh: default + + - name: Export digest + run: | + mkdir -p /tmp/digests + digest="${{ steps.build.outputs.digest }}" + touch "/tmp/digests/${digest#sha256:}" + + - name: Upload digest + uses: actions/upload-artifact@v4 + with: + name: digests-${{ strategy.job-index }} + path: /tmp/digests/* + if-no-files-found: error + retention-days: 1 + + merge-and-push: + runs-on: ubuntu-latest + needs: build-and-push permissions: - contents: read - packages: write - attestations: write - id-token: write + contents: read + packages: write + attestations: write + id-token: write + steps: + - name: Download digests + uses: actions/download-artifact@v4 + with: + path: /tmp/digests + pattern: digests-* + merge-multiple: true + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Log in to Container Registry + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata (tags, labels) for Docker + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=sha + + - name: Create manifest list and push + working-directory: /tmp/digests + run: | + docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ + $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *) + + - name: Inspect image + run: | + docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} diff --git a/Dockerfile b/Dockerfile index a02d21f..f1f074d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,8 @@ #syntax=docker/dockerfile:1.7-labs ### STAGE 0: Create base chef image for building ### cargo chef is used to speed up the build process by caching dependencies using docker -FROM --platform=$TARGETPLATFORM lukemathwalker/cargo-chef:latest-rust-latest as chef +### Use BUILDPLATFORM to ensure we use the native platform for building +FROM --platform=$BUILDPLATFORM lukemathwalker/cargo-chef:latest-rust-latest as chef RUN cargo install cargo-chef From d0da9b92830af5985aa979c3edd3896594f88d8d Mon Sep 17 00:00:00 2001 From: Swanny Date: Thu, 6 Nov 2025 16:55:49 -0500 Subject: [PATCH 2/3] fix: better run group selection --- .github/workflows/docker-ghcr.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-ghcr.yml b/.github/workflows/docker-ghcr.yml index a731d3c..a4d60ab 100644 --- a/.github/workflows/docker-ghcr.yml +++ b/.github/workflows/docker-ghcr.yml @@ -11,7 +11,8 @@ env: jobs: build-and-push: - runs-on: ${{ matrix.runner }} + runs-on: + group: ${{ matrix.group }} permissions: contents: read packages: write @@ -21,9 +22,9 @@ jobs: matrix: include: - platform: linux/amd64 - runner: ubuntu-24.04-8core + group: amd64-large-runners - platform: linux/arm64 - runner: ubuntu-24.04-arm64-8core + group: arm64-large-runners steps: - name: Checkout repository uses: actions/checkout@v4 From dfdeecdf8f67b46d3bfdfbf37c344ee96a252df9 Mon Sep 17 00:00:00 2001 From: Swanny Date: Fri, 7 Nov 2025 08:57:48 -0500 Subject: [PATCH 3/3] fix: dont need ssh anymore --- .github/workflows/docker-ghcr.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/docker-ghcr.yml b/.github/workflows/docker-ghcr.yml index a4d60ab..a260541 100644 --- a/.github/workflows/docker-ghcr.yml +++ b/.github/workflows/docker-ghcr.yml @@ -62,8 +62,6 @@ jobs: outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true cache-from: type=gha,scope=build-${{ matrix.platform }} cache-to: type=gha,mode=max,scope=build-${{ matrix.platform }} - ssh: default - - name: Export digest run: | mkdir -p /tmp/digests