moleapi/.github/workflows/docker.yml at main · ca-x/moleapi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
name: Docker multi-platform build
on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
  workflow_dispatch:
permissions:
  contents: read
jobs:
  source:
    runs-on: ubuntu-latest
    outputs:
      available: ${{ steps.detect.outputs.available }}
    steps:
      - uses: actions/checkout@v4
      - id: detect
        run: |
          if [ -f Dockerfile ] && [ -f crates/server/Cargo.toml ] && [ -f Cargo.lock ]; then
            echo 'available=true' >> "$GITHUB_OUTPUT"
          else
            echo 'available=false' >> "$GITHUB_OUTPUT"
            echo 'Docker runtime sources are pending; no image was built or published.' >> "$GITHUB_STEP_SUMMARY"
          fi
  image:
    needs: source
    if: needs.source.outputs.available == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            platform: linux/amd64
            arch: amd64
          - runner: ubuntu-24.04-arm
            platform: linux/arm64
            arch: arm64
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        if: github.event_name != 'pull_request'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        id: build
        with:
          context: .
          platforms: ${{ matrix.platform }}
          load: true
          tags: moleapi:smoke
          cache-from: type=gha,scope=${{ matrix.arch }}
          cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
      - name: Smoke test native container and embedded frontend
        shell: bash
        run: |
          docker run -d --name moleapi-smoke -p 127.0.0.1:8787:8787 moleapi:smoke --database /data/smoke.db --setup-token ci-smoke-token
          trap 'docker logs moleapi-smoke; docker rm -f moleapi-smoke' EXIT
          ready=false
          for attempt in $(seq 1 30); do
            if curl --fail --silent http://127.0.0.1:8787/api/health; then ready=true; break; fi
            sleep 1
          done
          test "$ready" = true
          curl --fail --silent http://127.0.0.1:8787/ | grep -q '<div id="root"'
          python scripts/check-script-worker.py --container moleapi-smoke
      - uses: docker/build-push-action@v6
        id: publish
        if: github.event_name != 'pull_request'
        with:
          context: .
          platforms: ${{ matrix.platform }}
          outputs: type=image,name=ghcr.io/ca-x/moleapi,push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=${{ matrix.arch }}
      - name: Record image digest
        if: github.event_name != 'pull_request'
        env:
          DIGEST: ${{ steps.publish.outputs.digest }}
        run: |
          mkdir -p /tmp/digests
          touch "/tmp/digests/${DIGEST#sha256:}"
      - uses: actions/upload-artifact@v4
        if: github.event_name != 'pull_request'
        with:
          name: image-digest-${{ matrix.arch }}
          path: /tmp/digests/*
          retention-days: 1
  manifest:
    needs: image
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: image-digest-*
          merge-multiple: true
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/ca-x/moleapi
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=sha
      - name: Publish multi-platform manifest
        working-directory: /tmp/digests
        env:
          META_JSON: ${{ steps.meta.outputs.json }}
        shell: bash
        run: |
          mapfile -t tags < <(jq -r '.tags[]' <<< "$META_JSON")
          args=()
          for tag in "${tags[@]}"; do args+=(--tag "$tag"); done
          images=()
          for digest in *; do images+=("ghcr.io/ca-x/moleapi@sha256:$digest"); done
          test "${#images[@]}" -eq 2
          docker buildx imagetools create "${args[@]}" "${images[@]}"
          docker buildx imagetools inspect "${tags[0]}"