feat: initial

.github/workflows/build-images.yml

@@ -0,0 +1,125 @@
+name: Build OONI Probe Docker images
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        required: true
+
+env:
+  REGISTRY_IMAGE: aaimio/miniooni
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - [linux/386, linux-386]
+          - [linux/amd64, linux-amd64]
+          - [linux/arm64, linux-arm64]
+          - [linux/arm/v6, linux-armv6]
+          - [linux/arm/v7, linux-armv7]
+
+    steps:
+      - name: Prepare env variables
+        run: |
+          platform=${{ matrix.platform[0] }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+
+      - name: Pull Docker image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY_IMAGE }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          platforms: ${{ matrix.platform[0] }}
+          labels: ${{ steps.meta.outputs.labels }}
+          outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
+          build-args: |
+            TARGET_FILE=${{ matrix.platform[1] }}
+            TARGET_VERSION=${{ inputs.version }}
+
+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ env.PLATFORM_PAIR }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    runs-on: ubuntu-latest
+    needs:
+      - build
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Generate major-minor tag
+        run: |
+          version_tag=${{ inputs.version }}
+          echo "VERSION_MAJOR_MINOR=${version_tag%.*}" >> $GITHUB_ENV
+
+      - name: Docker meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY_IMAGE }}
+          tags: |
+            type=raw,value=${{ env.VERSION_MAJOR_MINOR }}
+            type=raw,value=latest
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Create manifest list and push
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
+
+      - name: Create release
+        run: |
+          gh release create ${{ inputs.version }} \
+          -R aaimio/miniooni \
+          -t ${{ inputs.version }} \
+          -n "https://github.com/ooni/probe-cli/releases/tag/${{ inputs.version }}/" \
+          || true
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/sync.yml

@@ -0,0 +1,46 @@
+name: Sync with OONI Probe CLI repo
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 */6 * * *"
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  sync-with-ooni:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout aaimio/miniooni
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Get latest version URL
+        run: |
+          latest_version=$(curl -L \
+            -H 'Accept: application/vnd.github+json' \
+            -H 'Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' \
+            -H 'X-GitHub-Api-Version: 2022-11-28' \
+            https://api.github.com/repos/ooni/probe-cli/releases/latest | jq -r '.tag_name')
+            
+          echo "latest_version=$latest_version" >> $GITHUB_ENV
+
+      - name: Compare versions
+        run: |
+          if ! [[ "$latest_version" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Unexpected release version: $latest_version"
+          fi
+
+          current_version=$(git tag --sort=v:refname | tail -1)
+
+          if [ "$latest_version" != "$current_version" ]; then
+            gh workflow run build-images.yml -f version=$latest_version
+          else
+            echo "Already on the latest version: $latest_version"
+          fi
+        env:
+          GH_TOKEN: ${{ github.token }}

Dockerfile

@@ -0,0 +1,19 @@
+FROM alpine:3.20 AS builder
+
+ARG TARGET_VERSION  \
+    TARGET_FILE
+
+RUN mkdir -p /build && \
+    apk add --no-cache wget && \
+    wget -q -O /build/miniooni \
+    "https://github.com/ooni/probe-cli/releases/download/$TARGET_VERSION/miniooni-$TARGET_FILE" && \
+    chmod +x /build/miniooni
+
+FROM alpine:3.20
+
+COPY --from=builder /build/miniooni /.miniooni/miniooni
+COPY ./scripts/probe.sh /.miniooni/probe.sh
+
+RUN chmod +x /.miniooni/probe.sh
+
+ENTRYPOINT ["/bin/sh", "/.miniooni/probe.sh"]