Push Images to GHCR.io #1071
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,19 +8,28 @@ on: | |
| - 'v*' | ||
| paths: | ||
| - ".github/workflows/build-fb-image.yaml" | ||
| - ".github/workflows/scan-docker-image-action.yaml" | ||
| - "cmd/fluent-watcher/fluentbit/**" | ||
| - "cmd/fluent-watcher/hooks/**" | ||
| - "pkg/filenotify/**" | ||
|
|
||
| env: | ||
| FB_IMG: "kubesphere/fluent-bit:${{ github.ref_name }}" # kubesphere/fluent-bit:v2.2.2 | ||
| FB_IMG_DEBUG: "kubesphere/fluent-bit:${{ github.ref_name }}-debug" # kubesphere/fluent-bit:v2.2.2-debug | ||
|
|
||
| FB_IMG_GHCR: "${{ github.repository }}/fluent-bit:${{ github.ref_name }}" # fluent/fluent-operator/fluent-bit:v2.2.2 | ||
|
There was a problem hiding this comment. We have fluent-bit image built by other https://github.com/fluent/fluent-bit/ to differentiate between the images built by both, I am pushing the image to current repository only. |
||
| FB_IMG_DEBUG_GHCR: "${{ github.repository }}/fluent-bit:${{ github.ref_name }}-debug" # fluent/fluent-operator/fluent-bit:v2.2.2-debug | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 30 | ||
| name: Build Image for Fluent Bit | ||
| outputs: | ||
|
There was a problem hiding this comment. Outputs should come from steps really, e.g. the metadata action would give you a way to get this. That way if we modify something (or for PRs, non-main branch, etc.) it will carry on working. |
||
| FB_IMG: ${{ env.FB_IMG }} | ||
| FB_IMG_DEBUG: ${{ env.FB_IMG_DEBUG }} | ||
| FB_IMG_GHCR: ${{env.FB_IMG_GHCR}} | ||
| FB_IMG_DEBUG_GHCR: ${{ env.FB_IMG_DEBUG_GHCR }} | ||
| steps: | ||
| - name: Install Go | ||
| uses: actions/setup-go@v4 | ||
|
|
@@ -36,18 +45,100 @@ jobs: | |
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v1 | ||
|
|
||
| - name: Login to Docker Hub | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: docker.io | ||
|
There was a problem hiding this comment. Are we pushing to docker.io now instead? I would keep things in ghcr.io if you can particularly for PRs otherwise we have to start dealing with rate limiting. |
||
| username: ${{ secrets.REGISTRY_USER }} | ||
| password: ${{ secrets.REGISTRY_PASSWORD }} | ||
|
|
||
| - name: Set up Docker Buildx | ||
| id: buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| - name: Build and Push Image for Fluent Bit | ||
| id: docker-build | ||
| uses: docker/build-push-action@v2 | ||
| with: | ||
| context: . | ||
| file: ./cmd/fluent-watcher/fluentbit/Dockerfile | ||
| push: true | ||
| platforms: linux/amd64,linux/arm64 | ||
|
There was a problem hiding this comment. This will be pretty slow btw, it may not be worthwhile to do ARM builds for PRs. There was a problem hiding this comment. We are currently building in our existing approach, so I have added. https://github.com/fluent/fluent-operator/blob/master/Makefile#L99-L103 |
||
| tags: ${{ env.FB_IMG}} | ||
|
|
||
| - name: Build and Push Debug Image for Fluent Bit | ||
| id: docker-build-debug | ||
| uses: docker/build-push-action@v2 | ||
| with: | ||
| context: . | ||
| file: ./cmd/fluent-watcher/fluentbit/Dockerfile.debug | ||
| push: true | ||
| platforms: linux/amd64,linux/arm64 | ||
| tags: ${{ env.FB_IMG_DEBUG }} | ||
|
|
||
| scan-docker-image: | ||
| name: Scan Docker Image | ||
| needs: | ||
| - build | ||
| uses: ./.github/workflows/scan-docker-image-action.yaml | ||
| with: | ||
| source_image: ${{ needs.build.outputs.FB_IMG }} | ||
| source_registry: docker.io | ||
| platforms: '["linux/arm64", "linux/amd64"]' | ||
| secrets: | ||
| registry_username: ${{ secrets.REGISTRY_USER }} | ||
| registry_password: ${{ secrets.REGISTRY_PASSWORD }} | ||
|
|
||
| release-image-to-gchr: | ||
|
There was a problem hiding this comment. I think this is the wrong way round, all images should start in ghcr.io as it'll be public and not rate limited. We then push to the others only release images (not all the PR images or whatever too). |
||
| name: Release Image to GitHub Container Registry | ||
| uses: ./.github/workflows/clone-docker-image-action.yaml | ||
| needs: | ||
| - scan-docker-image | ||
| - build | ||
| with: | ||
| source_image: ${{ needs.build.outputs.FB_IMG }} | ||
| source_registry: docker.io | ||
| target_image: ${{ needs.build.outputs.FB_IMG_GHCR }} | ||
| target_registry: ghcr.io | ||
| platforms: "['linux/arm64', 'linux/amd64']" | ||
| secrets: | ||
| source_registry_username: ${{ secrets.REGISTRY_USER }} | ||
| target_registry_username: ${{ github.actor }} | ||
| source_registry_token: ${{ secrets.REGISTRY_PASSWORD }} | ||
| target_registry_token: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| scan-debug-image: | ||
|
There was a problem hiding this comment. The debug image should not be scanned, it should trigger notifications as it'll have a load of extra dependencies and is not intended for production. Any complaints about CVEs on debug images should be ignored. |
||
| name: Scan Debug Image | ||
| needs: | ||
| - build | ||
| uses: ./.github/workflows/scan-docker-image-action.yaml | ||
| with: | ||
| source_image: ${{ needs.build.outputs.FB_IMG_DEBUG }} | ||
| source_registry: docker.io | ||
| platforms: '["linux/arm64", "linux/amd64"]' | ||
| secrets: | ||
| registry_username: ${{ secrets.REGISTRY_USER }} | ||
| registry_password: ${{ secrets.REGISTRY_PASSWORD }} | ||
|
|
||
|
|
||
| release-debug-image-to-gchr: | ||
| name: Release Debug Image to GitHub Container Registry | ||
| uses: ./.github/workflows/clone-docker-image-action.yaml | ||
| needs: | ||
| - scan-debug-image | ||
| - build | ||
| with: | ||
| source_image: ${{ needs.build.outputs.FB_IMG_DEBUG }} | ||
| source_registry: docker.io | ||
| target_image: ${{ needs.build.outputs.FB_IMG_DEBUG_GHCR }} | ||
| target_registry: ghcr.io | ||
| platforms: "['linux/arm64', 'linux/amd64']" | ||
| secrets: | ||
| source_registry_username: ${{ secrets.REGISTRY_USER }} | ||
| target_registry_username: ${{ github.actor }} | ||
| source_registry_token: ${{ secrets.REGISTRY_PASSWORD }} | ||
| target_registry_token: ${{ secrets.GITHUB_TOKEN }} | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would like to recommend using GitHub action variables here, something like vars.FB_IMG. While testing actions on contributors side, it makes hard as they don't have permissions to push to this repo and it takes 1 or 2 commits to rollback to desired changes.
This follows to other env's as well.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Be careful with ref_name though as it won't be what's expected for PRs.
None of this should be done by variables like this really, we should use the docker/metadata-action for this as it properly supports multiple tags and configuring them (e.g. for default branch, tags, etc.).