Skip to content

Commit 93c89ba

Browse files
author
Akash Satheesan
authored
fix(ci): build+push image in release flow (#3838)
1 parent 0283c35 commit 93c89ba

File tree

8 files changed

+74
-166
lines changed

8 files changed

+74
-166
lines changed

‎.github/workflows/ci.yaml

-67
Original file line numberDiff line numberDiff line change
@@ -402,73 +402,6 @@ jobs:
402402
- name: Remove release packages and test artifacts
403403
run: rm -rf ./release-packages ./test/test-results
404404

405-
# Builds both amd64 and arm64 images
406-
docker-images:
407-
runs-on: ubuntu-latest
408-
needs: [package-linux-amd64, package-linux-arm64]
409-
steps:
410-
- uses: actions/checkout@v2
411-
412-
- name: Download release package
413-
uses: actions/download-artifact@v2
414-
with:
415-
name: release-packages
416-
path: ./release-packages
417-
418-
- name: Set up QEMU
419-
uses: docker/setup-qemu-action@v1
420-
421-
- name: Set up Docker Buildx
422-
uses: docker/setup-buildx-action@v1
423-
424-
- name: Run ./ci/steps/build-docker-image.sh
425-
run: ./ci/steps/build-docker-image.sh
426-
427-
- name: Upload release images
428-
uses: actions/upload-artifact@v2
429-
with:
430-
name: release-images
431-
path: ./release-images
432-
433-
trivy-scan-image:
434-
runs-on: ubuntu-20.04
435-
needs: docker-images
436-
# NOTE@jsjoeio: disabling due to a memory issue upstream
437-
# See: https://github.com/github/codeql-action/issues/528
438-
if: 1 == 2
439-
steps:
440-
- name: Checkout code
441-
uses: actions/checkout@v2
442-
443-
- name: Download release images
444-
uses: actions/download-artifact@v2
445-
with:
446-
name: release-images
447-
path: ./release-images
448-
449-
- name: Run Trivy vulnerability scanner in image mode
450-
# Commit SHA for v0.0.17
451-
uses: aquasecurity/trivy-action@9438b49cc3156b2e8c77c1ba8ffbaa3bae24e3c2
452-
with:
453-
input: "./release-images/code-server-amd64-*.tar"
454-
scan-type: "image"
455-
ignore-unfixed: true
456-
format: "template"
457-
template: "@/contrib/sarif.tpl"
458-
output: "trivy-image-results.sarif"
459-
severity: "HIGH,CRITICAL"
460-
461-
- name: Debug Trivy SARIF file
462-
run: cat trivy-image-results.sarif && ls -l trivy-image-results.sarif
463-
464-
- name: Upload Trivy scan results to GitHub Security tab
465-
uses: github/codeql-action/upload-sarif@v1
466-
with:
467-
sarif_file: "trivy-image-results.sarif"
468-
469-
# We have to use two trivy jobs
470-
# because GitHub only allows
471-
# codeql/upload-sarif action per job
472405
trivy-scan-repo:
473406
runs-on: ubuntu-20.04
474407
steps:

‎.github/workflows/docker.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Publish on Docker
2+
3+
on:
4+
# Shows the manual trigger in GitHub UI
5+
# helpful as a back-up in case the GitHub Actions Workflow fails
6+
workflow_dispatch:
7+
8+
release:
9+
types: [published]
10+
11+
jobs:
12+
docker-images:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v2
16+
17+
- name: Set up QEMU
18+
uses: docker/setup-qemu-action@v1
19+
20+
- name: Set up Docker Buildx
21+
uses: docker/setup-buildx-action@v1
22+
23+
- name: Run ./ci/steps/docker-buildx-push.sh
24+
run: ./ci/steps/docker-buildx-push.sh
25+
env:
26+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
27+
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
28+
DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

‎.github/workflows/publish.yaml renamed to ‎.github/workflows/npm-brew.yaml

+1-15
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: publish
1+
name: Publish on npm and brew
22

33
on:
44
# Shows the manual trigger in GitHub UI
@@ -22,20 +22,6 @@ jobs:
2222
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2323
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
2424

25-
# NOTE: this job requires curl, jq and docker
26-
# All of them are included in ubuntu-latest.
27-
docker:
28-
runs-on: ubuntu-latest
29-
steps:
30-
- uses: actions/checkout@v2
31-
32-
- name: Run ./ci/steps/push-docker-manifest.sh
33-
run: ./ci/steps/push-docker-manifest.sh
34-
env:
35-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36-
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
37-
DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
38-
3925
homebrew:
4026
# The newest version of code-server needs to be available on npm when this runs
4127
# otherwise, it will 404 and won't open a PR to bump version on homebrew/homebrew-core

‎ci/README.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,8 @@ You can disable minification by setting `MINIFY=`.
7878

7979
This directory contains the release docker container image.
8080

81-
- [./ci/steps/build-docker-image.sh](./ci/steps/build-docker-image.sh)
82-
- Builds the release containers with tags `codercom/code-server-$ARCH:$VERSION` for amd64 and arm64 with `docker buildx`.
81+
- [./ci/steps/build-docker-buildx-push.sh](./ci/steps/docker-buildx-push.sh)
82+
- Builds the release containers with tags `codercom/code-server-$ARCH:$VERSION` for amd64 and arm64 with `docker buildx` and pushes them.
8383
- Assumes debian releases are ready in `./release-packages`.
8484

8585
## images
@@ -107,8 +107,8 @@ Helps avoid clobbering the CI configuration.
107107
release packages into `./release-packages`.
108108
- [./steps/publish-npm.sh](./steps/publish-npm.sh)
109109
- Grabs the `npm-package` release artifact for the current commit and publishes it on npm.
110-
- [./steps/build-docker-image.sh](./steps/build-docker-image.sh)
111-
- Builds the docker image and then saves it into `./release-images/code-server-$ARCH-$VERSION.tar`.
110+
- [./steps/docker-buildx-push.sh](./steps/docker-buildx-push.sh)
111+
- Builds the docker image and then pushes it.
112112
- [./steps/push-docker-manifest.sh](./steps/push-docker-manifest.sh)
113113
- Loads all images in `./release-images` and then builds and pushes a multi architecture
114114
docker manifest for the amd64 and arm64 images to `codercom/code-server:$VERSION` and

‎ci/release-image/docker-bake.hcl

+4-12
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,11 @@ variable "VERSION" {
77
}
88

99
group "default" {
10-
targets = ["code-server-amd64", "code-server-arm64"]
10+
targets = ["code-server"]
1111
}
1212

13-
target "code-server-amd64" {
13+
target "code-server" {
1414
dockerfile = "ci/release-image/Dockerfile"
15-
tags = ["docker.io/codercom/code-server-amd64:${VERSION}"]
16-
platforms = ["linux/amd64"]
17-
output = ["type=tar,dest=./release-images/code-server-amd64-${VERSION}.tar"]
18-
}
19-
20-
target "code-server-arm64" {
21-
dockerfile = "ci/release-image/Dockerfile"
22-
tags = ["docker.io/codercom/code-server-arm64:${VERSION}"]
23-
platforms = ["linux/arm64"]
24-
output = ["type=tar,dest=./release-images/code-server-arm64-${VERSION}.tar"]
15+
tags = ["docker.io/codercom/code-server:${VERSION}"]
16+
platforms = ["linux/amd64", "linux/arm64"]
2517
}

‎ci/steps/build-docker-image.sh

-12
This file was deleted.

‎ci/steps/docker-buildx-push.sh

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# See if this version already exists on Docker Hub.
5+
function version_exists() {
6+
local output
7+
output=$(curl --silent "https://index.docker.io/v1/repositories/codercom/code-server/tags/$VERSION")
8+
if [[ $output == "Tag not found" ]]; then
9+
return 1
10+
else
11+
return 0
12+
fi
13+
}
14+
15+
main() {
16+
cd "$(dirname "$0")/../.."
17+
18+
# ci/lib.sh sets VERSION and provides download_artifact here
19+
source ./ci/lib.sh
20+
21+
if version_exists; then
22+
echo "$VERSION is already pushed"
23+
return
24+
fi
25+
26+
# Download the release-packages artifact
27+
download_artifact release-packages ./release-packages
28+
29+
# Login to Docker
30+
if [[ ${CI-} ]]; then
31+
echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
32+
fi
33+
34+
docker buildx bake -f ci/release-image/docker-bake.hcl --push
35+
}
36+
37+
main "$@"

‎ci/steps/push-docker-manifest.sh

-56
This file was deleted.

0 commit comments

Comments
 (0)