coder/.github/workflows/docker-base.yaml at main · coder/coder · GitHub

View runs

History

113 lines (98 loc) · 3.68 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

name: docker-base

on:

push:

branches:

- main

paths:

- scripts/Dockerfile.base

- scripts/Dockerfile

pull_request:

# Self-reference on `pull_request` is intentional: a PR that edits this

# workflow runs the build to verify the YAML is well-formed and the

# base image still builds. Pushes are gated separately by

# `push: ${{ github.event_name != 'pull_request' }}` on the

# depot/build-push-action below, so a PR builds the image but never

# publishes it. See DOCS-129 for the broader workflow-self-reference

# audit.

paths:

- scripts/Dockerfile.base

- .github/workflows/docker-base.yaml

schedule:

# Run every week at 09:43 on Monday, Wednesday and Friday. We build this

# frequently to ensure that packages are up-to-date.

- cron: "43 9 * * 1,3,5"

workflow_dispatch:

permissions:

contents: read

# Avoid running multiple jobs for the same commit.

concurrency:

group: ${{ github.workflow }}-${{ github.ref }}-docker-base

jobs:

build:

permissions:

# Necessary for depot.dev authentication.

id-token: write

# Necessary to push docker images to ghcr.io.

packages: write

runs-on: ubuntu-latest

if: github.repository_owner == 'coder'

steps:

- name: Harden Runner

uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0

with:

egress-policy: audit

- name: Checkout

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

- name: Docker login

uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

with:

registry: ghcr.io

username: ${{ github.actor }}

password: ${{ secrets.GITHUB_TOKEN }}

- name: Create empty base-build-context directory

run: mkdir base-build-context

- name: Install depot.dev CLI

uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1

# This uses OIDC authentication, so no auth variables are required.

- name: Build base Docker image via depot.dev

uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0

with:

project: wl5hnrrkns

context: base-build-context

file: scripts/Dockerfile.base

platforms: linux/amd64,linux/arm64,linux/arm/v7

provenance: true

pull: true

no-cache: true

push: ${{ github.event_name != 'pull_request' }}

tags: |

ghcr.io/coder/coder-base:latest

- name: Verify that images are pushed properly

if: github.event_name != 'pull_request'

run: |

# retry 10 times with a 5 second delay as the images may not be

# available immediately

for i in {1..10}; do

rc=0

raw_manifests=$(docker buildx imagetools inspect --raw ghcr.io/coder/coder-base:latest) || rc=$?

if [[ "$rc" -eq 0 ]]; then

break

if [[ "$i" -eq 10 ]]; then

echo "Failed to pull manifests after 10 retries"

exit 1

echo "Failed to pull manifests, retrying in 5 seconds"

sleep 5

done

manifests=$(

echo "$raw_manifests" | \

jq -r '.manifests[].platform | .os + "/" + .architecture + (if .variant then "/" + .variant else "" end)'

)

# Verify all 3 platforms are present.

set -euxo pipefail

echo "$manifests" | grep -q linux/amd64

echo "$manifests" | grep -q linux/arm64

echo "$manifests" | grep -q linux/arm/v7

coder/.github/workflows/docker-base.yaml at main · coder/coder · GitHub

Uh oh!

Expand file tree

Breadcrumbs

docker-base.yaml

Latest commit

History

Breadcrumbs

docker-base.yaml

File metadata and controls