Skip to content

Commit 13b18ab

Browse files
karubonirukaruboniru
committed
Try building different images
1 parent 536680a commit 13b18ab

4 files changed

Lines changed: 162 additions & 36 deletions

File tree

‎.github/workflows/docker-publish-full.yml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
name: Publish on ghcr.io
2+
3+
# This workflow uses actions that are not certified by GitHub.
4+
# They are provided by a third-party and are governed by
5+
# separate terms of service, privacy policy, and support
6+
# documentation.
7+
8+
on:
9+
push:
10+
branches: [ '*' ]
11+
# Publish semver tags as releases.
12+
tags: [ 'v*.*.*' ]
13+
pull_request:
14+
branches: [ "master" ]
15+
16+
env:
17+
# Use docker.io for Docker Hub if empty
18+
REGISTRY: ghcr.io
19+
# github.repository as <account>/<repo>
20+
IMAGE_NAME: ${{ github.repository }}-full
21+
# docker.io/<account>/<repo>
22+
DOCKERHUB_IMAGE: ${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}-full
23+
24+
25+
jobs:
26+
build:
27+
28+
runs-on: ubuntu-latest
29+
permissions:
30+
contents: read
31+
packages: write
32+
# This is used to complete the identity challenge
33+
# with sigstore/fulcio when running outside of PRs.
34+
id-token: write
35+
36+
steps:
37+
- name: Checkout repository
38+
uses: actions/checkout@v3
39+
40+
# Install the cosign tool except on PR
41+
# https://github.com/sigstore/cosign-installer
42+
- name: Install cosign
43+
if: github.event_name != 'pull_request'
44+
uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
45+
with:
46+
cosign-release: 'v2.1.1'
47+
48+
# Set up BuildKit Docker container builder to be able to build
49+
# multi-platform images and export cache
50+
# https://github.com/docker/setup-buildx-action
51+
- name: Set up Docker Buildx
52+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
53+
54+
# Login against a Docker registry except on PR
55+
# https://github.com/docker/login-action
56+
- name: Log into registry ${{ env.REGISTRY }}
57+
if: github.event_name != 'pull_request'
58+
uses: docker/login-action@v3 # v3.0.0
59+
with:
60+
registry: ${{ env.REGISTRY }}
61+
username: ${{ github.actor }}
62+
password: ${{ secrets.GITHUB_TOKEN }}
63+
-
64+
name: Login to Docker Hub
65+
uses: docker/login-action@v3
66+
with:
67+
username: ${{ secrets.DOCKERHUB_USERNAME }}
68+
password: ${{ secrets.DOCKERHUB_TOKEN }}
69+
70+
# Extract metadata (tags, labels) for Docker
71+
# https://github.com/docker/metadata-action
72+
- name: Extract Docker metadata from ${{ env.REGISTRY }}
73+
id: meta
74+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
75+
with:
76+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
77+
78+
- name: Extract Docker metadata from Docker Hub
79+
id: meta_dockerhub
80+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
81+
with:
82+
images: docker.io/${{ env.DOCKERHUB_IMAGE }}
83+
84+
# Build and push Docker image with Buildx (don't push on PR)
85+
# https://github.com/docker/build-push-action
86+
- name: Build and push Docker image
87+
id: build-and-push
88+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
89+
with:
90+
context: .
91+
push: ${{ github.event_name != 'pull_request' }}
92+
build-args: |
93+
BUILDTYPE=full
94+
tags: |
95+
${{ steps.meta.outputs.tags }}
96+
${{ steps.meta_dockerhub.outputs.tags }}
97+
labels: ${{ steps.meta.outputs.labels }}
98+
cache-from: type=gha
99+
cache-to: type=gha,mode=max
100+
101+
# Sign the resulting Docker image digest except on PRs.
102+
# This will only write to the public Rekor transparency log when the Docker
103+
# repository is public to avoid leaking data. If you would like to publish
104+
# transparency data even for private images, pass --force to cosign below.
105+
# https://github.com/sigstore/cosign
106+
- name: Sign the published Docker image
107+
if: ${{ github.event_name != 'pull_request' }}
108+
env:
109+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
110+
TAGS: |
111+
${{ steps.meta.outputs.tags }}
112+
${{ steps.meta_dockerhub.outputs.tags }}
113+
DIGEST: |
114+
${{ steps.build-and-push.outputs.digest }}
115+
# This step uses the identity token to provision an ephemeral certificate
116+
# against the sigstore community Fulcio instance.
117+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

.github/workflows/docker-publish.yml renamed to .github/workflows/docker-publish-minimal.yml

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,11 @@ env:
1818
REGISTRY: ghcr.io
1919
# github.repository as <account>/<repo>
2020
IMAGE_NAME: ${{ github.repository }}
21+
# docker.io/<account>/<repo>
22+
DOCKERHUB_IMAGE: ${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}
2123

2224

23-
jobs:
25+
jobs:
2426
build:
2527

2628
runs-on: ubuntu-latest
@@ -53,20 +55,32 @@ jobs:
5355
# https://github.com/docker/login-action
5456
- name: Log into registry ${{ env.REGISTRY }}
5557
if: github.event_name != 'pull_request'
56-
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
58+
uses: docker/login-action@v3 # v3.0.0
5759
with:
5860
registry: ${{ env.REGISTRY }}
5961
username: ${{ github.actor }}
6062
password: ${{ secrets.GITHUB_TOKEN }}
63+
-
64+
name: Login to Docker Hub
65+
uses: docker/login-action@v3
66+
with:
67+
username: ${{ secrets.DOCKERHUB_USERNAME }}
68+
password: ${{ secrets.DOCKERHUB_TOKEN }}
6169

6270
# Extract metadata (tags, labels) for Docker
6371
# https://github.com/docker/metadata-action
64-
- name: Extract Docker metadata
72+
- name: Extract Docker metadata from ${{ env.REGISTRY }}
6573
id: meta
6674
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
6775
with:
6876
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
6977

78+
- name: Extract Docker metadata from Docker Hub
79+
id: meta_dockerhub
80+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
81+
with:
82+
images: docker.io/${{ env.DOCKERHUB_IMAGE }}
83+
7084
# Build and push Docker image with Buildx (don't push on PR)
7185
# https://github.com/docker/build-push-action
7286
- name: Build and push Docker image
@@ -75,8 +89,12 @@ jobs:
7589
with:
7690
context: .
7791
push: ${{ github.event_name != 'pull_request' }}
78-
tags: ${{ steps.meta.outputs.tags }}
92+
tags: |
93+
${{ steps.meta.outputs.tags }}
94+
${{ steps.meta_dockerhub.outputs.tags }}
7995
labels: ${{ steps.meta.outputs.labels }}
96+
build-args: |
97+
BUILDTYPE=minimal
8098
cache-from: type=gha
8199
cache-to: type=gha,mode=max
82100

@@ -89,8 +107,11 @@ jobs:
89107
if: ${{ github.event_name != 'pull_request' }}
90108
env:
91109
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
92-
TAGS: ${{ steps.meta.outputs.tags }}
93-
DIGEST: ${{ steps.build-and-push.outputs.digest }}
110+
TAGS: |
111+
${{ steps.meta.outputs.tags }}
112+
${{ steps.meta_dockerhub.outputs.tags }}
113+
DIGEST: |
114+
${{ steps.build-and-push.outputs.digest }}
94115
# This step uses the identity token to provision an ephemeral certificate
95116
# against the sigstore community Fulcio instance.
96117
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/docker.yml‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎Dockerfile‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
ARG BUILDTYPE=minimal
2+
13
FROM debian:12-slim AS build-venv
24

35
RUN apt-get update && \
@@ -14,7 +16,22 @@ RUN /venv/bin/pip install --no-cache-dir -U "/tmp/comiclib[full]"
1416
RUN /venv/bin/pip install --no-cache-dir -U gunicorn
1517
RUN mkdir /userdata
1618

17-
FROM gcr.io/distroless/python3-debian12
19+
FROM debian:12-slim AS data
20+
ADD https://files.niconi.org/api_dump.sqlite.7z /tmp
21+
COPY --from=build-venv /usr/bin/7zz /usr/bin
22+
RUN mkdir /exract
23+
WORKDIR /extract
24+
RUN 7zz x /tmp/api_dump.sqlite.7z
25+
26+
FROM gcr.io/distroless/python3-debian12 AS product-env-full
27+
ENV importEHdb_database_URI=file:/data/api_dump.sqlite?mode=rw
28+
COPY --from=data /extract/api_dump.sqlite /data/api_dump.sqlite
29+
30+
FROM gcr.io/distroless/python3-debian12 AS product-env-minimal
31+
ENV importEHdb_database_URI=file:api_dump.sqlite?mode=rw
32+
33+
34+
FROM product-env-${BUILDTYPE}
1835
COPY --from=build-venv /venv /venv
1936
COPY --from=build-venv /usr/bin/7zz /usr/bin
2037
COPY --from=build-venv /usr/bin/ffmpeg /usr/bin

0 commit comments

Comments
 (0)