Skip to content

Commit 8733a20

Browse files
mermoldymermoldy
committed
SCALRCORE-38392 add workflow to publish gar images
1 parent 3df580d commit 8733a20

3 files changed

Lines changed: 142 additions & 1 deletion

File tree

‎.github/workflows/build_and_release_gar.yaml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
name: Build and Release Runner Image (GAR only)
2+
3+
# Triggered when a PR carries the `build-gar-images` label. Pushes test
4+
# builds of all three variants to the internal GAR mirror only — Docker
5+
# Hub is not touched. Each new push to the PR rebuilds while the label
6+
# is applied. Images are tagged by branch name (lower-cased) so
7+
# collaborators can pull a stable reference (e.g. scalr/runner:my-branch).
8+
# Each image is pushed to two regional GAR repos: europe-west4 and us-central1.
9+
10+
on:
11+
pull_request:
12+
types: [labeled, synchronize, reopened]
13+
14+
permissions:
15+
contents: read
16+
# Required by google-github-actions/auth for workload identity federation.
17+
id-token: write
18+
19+
jobs:
20+
build:
21+
name: Build and Push to GAR
22+
if: contains(github.event.pull_request.labels.*.name, 'build-gar-images')
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: Checkout
26+
uses: actions/checkout@v4
27+
28+
- name: Authenticate to Google Cloud
29+
uses: google-github-actions/auth@v3
30+
with:
31+
workload_identity_provider: ${{vars.GOOGLE_WORKLOAD_IDENTITY_POOL_PROVIDER}}
32+
service_account: ${{vars.GOOGLE_SERVICE_ACCOUNT_EMAIL}}
33+
token_format: access_token
34+
35+
- name: Configure Docker for GAR
36+
run: |
37+
gcloud auth configure-docker ${{ vars.EU_DEV_MIRROR_LOCATION }}-docker.pkg.dev --quiet
38+
gcloud auth configure-docker ${{ vars.US_PROD_MIRROR_LOCATION }}-docker.pkg.dev --quiet
39+
40+
- name: Set up QEMU
41+
uses: docker/setup-qemu-action@v3
42+
43+
- name: Set up Docker Buildx
44+
uses: docker/setup-buildx-action@v3
45+
46+
# PR source branch, lower-cased and sanitized for use as a Docker tag
47+
# (Docker tags are case-sensitive but downstream agents lower-case
48+
# image refs; slashes are illegal and become dashes).
49+
- name: Resolve branch tag
50+
id: branch
51+
run: |
52+
raw='${{ github.head_ref }}'
53+
sanitized="${raw,,}"
54+
sanitized="${sanitized//\//-}"
55+
echo "tag=${sanitized}" | tee -a $GITHUB_OUTPUT
56+
57+
# Two regional GAR mirrors — EU dev and US production.
58+
- name: Compose GAR image paths
59+
id: gar
60+
run: |
61+
echo "image_eu=${{ vars.EU_DEV_MIRROR_LOCATION }}-docker.pkg.dev/${{ vars.EU_DEV_GOOGLE_PROJECT }}/main/scalr/runner" | tee -a $GITHUB_OUTPUT
62+
echo "image_us=${{ vars.US_PROD_MIRROR_LOCATION }}-docker.pkg.dev/${{ vars.US_PROD_GOOGLE_PROJECT }}/main/scalr/runner" | tee -a $GITHUB_OUTPUT
63+
64+
- name: Build and push images
65+
uses: docker/bake-action@v5
66+
env:
67+
VERSION: ${{ steps.branch.outputs.tag }}
68+
with:
69+
files: |
70+
docker-bake.hcl
71+
versions.json
72+
push: true
73+
# Replace each target's tag list (first `tags=` removes the Docker
74+
# Hub default from docker-bake.hcl; subsequent lines add to the
75+
# list) so a single build pushes to both regional GAR repos.
76+
# The europe-west4 mirror also holds the per-branch buildcache.
77+
set: |
78+
full.tags=${{ steps.gar.outputs.image_eu }}:${{ steps.branch.outputs.tag }}
79+
full.tags=${{ steps.gar.outputs.image_us }}:${{ steps.branch.outputs.tag }}
80+
python39.tags=${{ steps.gar.outputs.image_eu }}:${{ steps.branch.outputs.tag }}-python39
81+
python39.tags=${{ steps.gar.outputs.image_us }}:${{ steps.branch.outputs.tag }}-python39
82+
slim.tags=${{ steps.gar.outputs.image_eu }}:${{ steps.branch.outputs.tag }}-slim
83+
slim.tags=${{ steps.gar.outputs.image_us }}:${{ steps.branch.outputs.tag }}-slim
84+
full.cache-from=type=registry,ref=${{ steps.gar.outputs.image_eu }}:buildcache-${{ steps.branch.outputs.tag }}
85+
python39.cache-from=type=registry,ref=${{ steps.gar.outputs.image_eu }}:buildcache-${{ steps.branch.outputs.tag }}-python39
86+
slim.cache-from=type=registry,ref=${{ steps.gar.outputs.image_eu }}:buildcache-${{ steps.branch.outputs.tag }}-slim
87+
full.cache-to=type=registry,ref=${{ steps.gar.outputs.image_eu }}:buildcache-${{ steps.branch.outputs.tag }},mode=max
88+
python39.cache-to=type=registry,ref=${{ steps.gar.outputs.image_eu }}:buildcache-${{ steps.branch.outputs.tag }}-python39,mode=max
89+
slim.cache-to=type=registry,ref=${{ steps.gar.outputs.image_eu }}:buildcache-${{ steps.branch.outputs.tag }}-slim,mode=max
90+
91+
- name: Summary
92+
run: |
93+
cat <<EOF >> $GITHUB_STEP_SUMMARY
94+
Pushed GAR test images for branch \`${{ steps.branch.outputs.tag }}\`:
95+
96+
europe-west4:
97+
- \`${{ steps.gar.outputs.image_eu }}:${{ steps.branch.outputs.tag }}\`
98+
- \`${{ steps.gar.outputs.image_eu }}:${{ steps.branch.outputs.tag }}-python39\`
99+
- \`${{ steps.gar.outputs.image_eu }}:${{ steps.branch.outputs.tag }}-slim\`
100+
101+
us-central1:
102+
- \`${{ steps.gar.outputs.image_us }}:${{ steps.branch.outputs.tag }}\`
103+
- \`${{ steps.gar.outputs.image_us }}:${{ steps.branch.outputs.tag }}-python39\`
104+
- \`${{ steps.gar.outputs.image_us }}:${{ steps.branch.outputs.tag }}-slim\`
105+
EOF

‎.github/workflows/release.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@ on:
55
tags:
66
- "*.*.*"
77

8+
permissions:
9+
# Needed by the update_changelog job to git-push CHANGELOG.md back to main.
10+
contents: write
11+
# Required by google-github-actions/auth for workload identity federation.
12+
id-token: write
13+
814
jobs:
915
build:
1016
name: Build and Push
@@ -19,6 +25,20 @@ jobs:
1925
username: ${{ vars.DOCKERHUB_USERNAME }}
2026
password: ${{ secrets.DOCKERHUB_PASSWORD }}
2127

28+
# Authenticate to Google Artifact Registry (GAR) so the same build can be
29+
# mirrored to the internal Scalr registry alongside Docker Hub.
30+
- name: Authenticate to Google Cloud
31+
uses: google-github-actions/auth@v3
32+
with:
33+
workload_identity_provider: ${{vars.GOOGLE_WORKLOAD_IDENTITY_POOL_PROVIDER}}
34+
service_account: ${{vars.GOOGLE_SERVICE_ACCOUNT_EMAIL}}
35+
token_format: access_token
36+
37+
- name: Configure Docker for GAR
38+
run: |
39+
gcloud auth configure-docker ${{ vars.EU_DEV_MIRROR_LOCATION }}-docker.pkg.dev --quiet
40+
gcloud auth configure-docker ${{ vars.US_PROD_MIRROR_LOCATION }}-docker.pkg.dev --quiet
41+
2242
- name: Set up QEMU
2343
uses: docker/setup-qemu-action@v3
2444

@@ -30,6 +50,13 @@ jobs:
3050
run: |
3151
echo "tag=${GITHUB_REF#refs/tags/}" | tee -a $GITHUB_OUTPUT
3252
53+
# Two regional GAR mirrors — EU dev and US production.
54+
- name: Compose GAR image paths
55+
id: gar
56+
run: |
57+
echo "image_eu=${{ vars.EU_DEV_MIRROR_LOCATION }}-docker.pkg.dev/${{ vars.EU_DEV_GOOGLE_PROJECT }}/main/scalr/runner" | tee -a $GITHUB_OUTPUT
58+
echo "image_us=${{ vars.US_PROD_MIRROR_LOCATION }}-docker.pkg.dev/${{ vars.US_PROD_GOOGLE_PROJECT }}/main/scalr/runner" | tee -a $GITHUB_OUTPUT
59+
3360
- name: Build and push images
3461
uses: docker/bake-action@v5
3562
env:
@@ -39,7 +66,17 @@ jobs:
3966
docker-bake.hcl
4067
versions.json
4168
push: true
69+
# Append both GAR region tags to each target so a single push writes
70+
# to Docker Hub (declared in docker-bake.hcl) and both regional GAR
71+
# mirrors. Cache-to is injected here because the docker-container
72+
# driver supports it, while the bake file stays local-driver-friendly.
4273
set: |
74+
full.tags+=${{ steps.gar.outputs.image_eu }}:${{ steps.image_tag.outputs.tag }}
75+
full.tags+=${{ steps.gar.outputs.image_us }}:${{ steps.image_tag.outputs.tag }}
76+
python39.tags+=${{ steps.gar.outputs.image_eu }}:${{ steps.image_tag.outputs.tag }}-python39
77+
python39.tags+=${{ steps.gar.outputs.image_us }}:${{ steps.image_tag.outputs.tag }}-python39
78+
slim.tags+=${{ steps.gar.outputs.image_eu }}:${{ steps.image_tag.outputs.tag }}-slim
79+
slim.tags+=${{ steps.gar.outputs.image_us }}:${{ steps.image_tag.outputs.tag }}-slim
4380
full.cache-to=type=registry,ref=scalr/runner:buildcache,mode=max
4481
python39.cache-to=type=registry,ref=scalr/runner:buildcache-python39,mode=max
4582
slim.cache-to=type=registry,ref=scalr/runner:buildcache-slim,mode=max

‎README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ remote operations backend of the Scalr platform and [on-prem Scalr Agents](https
1111
- [Added in the full image](#added-in-the-full-image)
1212
- [Added in the `-python39` image](#added-in-the--python39-image)
1313
- [Runtime user](#runtime-user)
14-
- [Security hardening](#security-hardening)
1514
- [Building the Image](#building-the-image)
1615
- [Bumping Versions](#bumping-versions)
1716

0 commit comments

Comments
 (0)