Skip to content

ci: docker: multi-platform image builds #363

ci: docker: multi-platform image builds

ci: docker: multi-platform image builds #363

Workflow file for this run

name: Docker
on:
push:
branches:
- master
- docker-multi-platform
tags:
- "*"
env:
WORKFLOW_BUILD_DISTROLESS: false
jobs:
docker:
strategy:
matrix:
include:
- os: ubuntu-latest
platforms: linux/amd64
- os: macos-latest-xlarge
platforms: linux/arm64
outputs:
meta-ubuntu: ${{ steps.meta-ubuntu.outputs.json }}
meta-distroless: ${{ steps.meta-distroless.outputs.json }}
runs-on: ${{ matrix.os }}
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up Docker
if: runner.os == 'macOS'
uses: crazy-max/ghaction-setup-docker@v2
env:
COLIMA_START_ARGS: --cpu 6 --memory 12 --disk 12
QEMU_SYSTEM_AARCH64: qemu-system-aarch64 -machine virt,accel=tcg,highmem=off
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
id: buildx
with:
install: true
- name: Set Docker metadata (Ubuntu & NVM variant)
id: meta-ubuntu
uses: docker/metadata-action@v5
with:
images: |
ghcr.io/${{ github.repository }}/echidna
name=trailofbits/echidna,enable=${{ github.repository == 'crytic/echidna' }}
tags: |
type=ref,event=tag
type=ref,event=branch,prefix=testing-
type=edge
- name: Set Docker metadata (Distroless variant)
id: meta-distroless
uses: docker/metadata-action@v5
if: ${{ env.WORKFLOW_BUILD_DISTROLESS == true }}
with:
images: ghcr.io/${{ github.repository }}/distroless
tags: |
type=ref,event=tag
type=ref,event=branch,prefix=testing-
type=edge
- name: GitHub Container Registry Login
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Docker Hub Login
uses: docker/login-action@v3
if: github.repository == 'crytic/echidna'
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
- name: Docker Build and Push (Ubuntu & NVM variant)
uses: docker/build-push-action@v5
id: ubuntu
with:
platforms: ${{ matrix.platforms }}
target: final-ubuntu
file: docker/Dockerfile
pull: true
push: true
tags: ${{ steps.meta-ubuntu.outputs.tags }}
labels: ${{ steps.meta-ubuntu.outputs.labels }}
outputs: type=image,name=ghcr.io/${{ github.repository }}/echidna,push-by-digest=true,name-canonical=true,push=true
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Docker Build and Push (Distroless variant)
uses: docker/build-push-action@v5
if: ${{ env.WORKFLOW_BUILD_DISTROLESS == true }}
id: distroless
with:
platforms: ${{ matrix.platforms }}
target: final-distroless
file: docker/Dockerfile
pull: true
push: true
tags: ${{ steps.meta-distroless.outputs.tags }}
labels: ${{ steps.meta-distroless.outputs.labels }}
outputs: type=image,name=ghcr.io/${{ github.repository }}/distroless,push-by-digest=true,name-canonical=true,push=true
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Export digests
run: |
mkdir -p /tmp/digests/ubuntu /tmp/digests/distroless
digest="${{ steps.ubuntu.outputs.digest }}"
touch "/tmp/digests/ubuntu/${digest#sha256:}"
if [ ! "${{ env.WORKFLOW_BUILD_DISTROLESS }}" = "" ]; then
digest="${{ steps.distroless.outputs.digest }}"
touch "/tmp/digests/distroless/${digest#sha256:}"
fi
- name: Upload digests
uses: actions/upload-artifact@v3
with:
name: digests
path: /tmp/digests/*
if-no-files-found: error
retention-days: 1
merge:
runs-on: ubuntu-latest
needs:
- docker
steps:
- name: Download digests
uses: actions/download-artifact@v3
with:
name: digests
path: /tmp/digests
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: GitHub Container Registry Login
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Docker Hub Login
uses: docker/login-action@v3
if: github.repository == 'crytic/echidna'
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
- name: Create manifest list and push (Ubuntu & NVM variant)
working-directory: /tmp/digests/ubuntu
run: |
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
$(printf 'ghcr.io/${{ github.repository }}/echidna@sha256:%s ' *)
env:
DOCKER_METADATA_OUTPUT_JSON: ${{ needs.docker.outputs.meta-ubuntu }}
- name: Create manifest list and push (Distroless variant)
if: ${{ env.WORKFLOW_BUILD_DISTROLESS == true }}
working-directory: /tmp/digests/distroless
run: |
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
$(printf 'ghcr.io/${{ github.repository }}/distroless@sha256:%s ' *)
env:
DOCKER_METADATA_OUTPUT_JSON: ${{ needs.docker.outputs.meta-distroless }}