diff --git a/.github/workflow/multi-arch-build.yaml b/.github/workflow/multi-arch-build.yaml new file mode 100644 index 00000000..f8d83285 --- /dev/null +++ b/.github/workflow/multi-arch-build.yaml @@ -0,0 +1,206 @@ +--- + +# Please see contrib/skopeoimage/README.md for details on the intentions +# of this workflow. +# +# BIG FAT WARNING: This workflow is duplicated across containers/skopeo, +# containers/buildah, and containers/podman. ANY AND +# ALL CHANGES MADE HERE MUST BE MANUALLY DUPLICATED +# TO THE OTHER REPOS. + +name: build multi-arch images + +on: + # Upstream skopeo tends to be very active, with many merges per day. + # Only run this daily via cron schedule, or manually, not by branch push. + schedule: + - cron: '0 8 * * *' + # allows to run this workflow manually from the Actions tab + workflow_dispatch: + +jobs: + multi: + name: multi-arch Skopeo build + env: + SKOPEO_QUAY_REGISTRY: quay.io/skopeo + CONTAINERS_QUAY_REGISTRY: quay.io/containers + # list of architectures for build + PLATFORMS: linux/amd64,linux/s390x,linux/ppc64le,linux/arm64 + + # build several images (upstream, testing, stable) in parallel + strategy: + # By default, failure of one matrix item cancels all others + fail-fast: false + matrix: + # Builds are located under contrib/skopeoimage/ directory + source: + - upstream + - testing + - stable + runs-on: ubuntu-latest + # internal registry caches build for inspection before push + services: + registry: + image: quay.io/libpod/registry:2 + ports: + - 5000:5000 + steps: + - name: Checkout + uses: actions/checkout@v2 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v1 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v1 + with: + driver-opts: network=host + install: true + + - name: Build and locally push Skopeo + uses: docker/build-push-action@v2 + with: + context: contrib/skopeoimage/${{ matrix.source }} + file: ./contrib/skopeoimage/${{ matrix.source }}/Dockerfile + platforms: ${{ env.PLATFORMS }} + push: true + tags: localhost:5000/skopeo/${{ matrix.source }} + + # Simple verification that stable images work, and + # also grab version number use in forming the FQIN. + - name: amd64 container sniff test + if: matrix.source == 'stable' + id: sniff_test + run: | + VERSION_OUTPUT="$(docker run localhost:5000/skopeo/${{ matrix.source }} \ + skopeo --storage-driver=vfs version)" + echo "$VERSION_OUTPUT" + VERSION=$(grep -Em1 '^Version: ' <<<"$VERSION_OUTPUT" | awk '{print $2}') + test -n "$VERSION" + echo "::set-output name=version::${VERSION}" + + - name: Generate skopeo reg. image FQIN(s) + id: skopeo_reg + run: | + if [[ "${{ matrix.source }}" == 'stable' ]]; then + # The `skopeo version` in image just built + VERSION='v${{ steps.sniff_test.outputs.version }}' + # workaround vim syntax-highlight bug: ' + # Image tags previously pushed to quay + ALLTAGS=$(skopeo list-tags \ + docker://$SKOPEO_QUAY_REGISTRY/stable | \ + jq -r '.Tags[]') + + # New version? Push quay.io/skopeo/stable:vX.X.X and :latest + if ! fgrep -qx "$VERSION" <<<"$ALLTAGS"; then + # Assume version-tag is also the most up to date (i.e. "latest") + FQIN="$SKOPEO_QUAY_REGISTRY/stable:$VERSION,$SKOPEO_QUAY_REGISTRY/stable:latest" + else # Not a new version-tagged image + # Assume other contents changed, so this is the "new" latest. + FQIN="$SKOPEO_QUAY_REGISTRY/stable:latest" + fi + elif [[ "${{ matrix.source }}" == 'testing' ]]; then + # Assume some contents changed, always push latest testing. + FQIN="$SKOPEO_QUAY_REGISTRY/testing:latest" + elif [[ "${{ matrix.source }}" == 'upstream' ]]; then + # Assume some contents changed, always push latest upstream. + FQIN="$SKOPEO_QUAY_REGISTRY/upstream:latest" + else + echo "::error::Unknown matrix item '${{ matrix.source }}'" + exit 1 + fi + echo "::warning::Pushing $FQIN" + echo "::set-output name=fqin::${FQIN}" + echo '::set-output name=push::true' + + # This is substantially similar to the above logic, + # but only handles $CONTAINERS_QUAY_REGISTRY for + # the stable "latest" and named-version tagged images. + - name: Generate containers reg. image FQIN(s) + if: matrix.source == 'stable' + id: containers_reg + run: | + VERSION='v${{ steps.sniff_test.outputs.version }}' + # workaround vim syntax-highlight bug: ' + ALLTAGS=$(skopeo list-tags \ + docker://$CONTAINERS_QUAY_REGISTRY/skopeo | \ + jq -r '.Tags[]') + + # New version? Push quay.io/containers/skopeo:vX.X.X and latest + if ! fgrep -qx "$VERSION" <<<"$ALLTAGS"; then + FQIN="$CONTAINERS_QUAY_REGISTRY/skopeo:$VERSION,$CONTAINERS_QUAY_REGISTRY/skopeo:latest" + else # Not a new version-tagged image, only update latest. + FQIN="$CONTAINERS_QUAY_REGISTRY/skopeo:latest" + fi + echo "::warning::Pushing $FQIN" + echo "::set-output name=fqin::${FQIN}" + echo '::set-output name=push::true' + + - name: Define LABELS multi-line env. var. value + run: | + # This is a really hacky/strange workflow idiom, required + # for setting multi-line $LABELS value for consumption in + # a future step. + # https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#multiline-strings + cat << EOF | tee -a $GITHUB_ENV + LABELS<` and `quay.io/skopeo/stable:` - + These images are built when a new Skopeo version becomes available in + Fedora. These images are intended to be unchanging and stable, they will + never be updated by automation once they've been pushed. For build details, + please [see the configuration file](stable/Dockerfile). + * `quay.io/containers/skopeo:latest` and `quay.io/skopeo/stable:latest` - + Built daily using the same Dockerfile as above. The skopeo version + will remain the "latest" available in Fedora, however the image + contents may vary compared to the version-tagged images. + * `quay.io/skopeo/testing:latest` - This image is built daily, using the + latest version of Skopeo that was in the Fedora `updates-testing` repository. + The image is Built with [the testing Dockerfile](testing/Dockerfile). + * `quay.io/skopeo/upstream:latest` - This image is built daily using the latest + code found in this GitHub repository. Due to the image changing frequently, + it's not guaranteed to be stable or even executable. The image is built with + [the upstream Dockerfile](upstream/Dockerfile). -Images can be used the same way as in a single architecture case, no extra setup is required. For samples see next chapter. ## Sample Usage diff --git a/release/Makefile b/release/Makefile deleted file mode 100644 index 15b019c1..00000000 --- a/release/Makefile +++ /dev/null @@ -1,51 +0,0 @@ -## This Makefile is used to publish skopeo container images with Travis CI ## -## Environment variables, used in this Makefile are specified in .travis.yml - -export DOCKER_CLI_EXPERIMENTAL=enabled -GOARCH ?= $(shell go env GOARCH) - -# Dereference variable $(1), return value if non-empty, otherwise raise an error. -err_if_empty = $(if $(strip $($(1))),$(strip $($(1))),$(error Required $(1) variable is undefined or empty)) - -# Requires two arguments: Names of the username and the password env. vars. -define quay_login - @echo "$(call err_if_empty,$(2))" | \ - docker login quay.io -u "$(call err_if_empty,$(1))" --password-stdin -endef - -# Build container image of skopeo upstream based on host architecture -build-image/upstream: - docker build -t "${UPSTREAM_IMAGE}-${GOARCH}" contrib/skopeoimage/upstream - -# Build container image of skopeo stable based on host architecture -build-image/stable: - docker build -t "${STABLE_IMAGE}-${GOARCH}" contrib/skopeoimage/stable - -# Push container image of skopeo upstream (based on host architecture) to image repository -push-image/upstream: - $(call quay_login,SKOPEO_QUAY_USERNAME,SKOPEO_QUAY_PASSWORD) - docker push "${UPSTREAM_IMAGE}-${GOARCH}" - -# Push container image of skopeo stable (based on host architecture) to image default and extra repositories -push-image/stable: - $(call quay_login,SKOPEO_QUAY_USERNAME,SKOPEO_QUAY_PASSWORD) - docker push "${STABLE_IMAGE}-${GOARCH}" - docker tag "${STABLE_IMAGE}-${GOARCH}" "${EXTRA_STABLE_IMAGE}-${GOARCH}" - $(call quay_login,CONTAINERS_QUAY_USERNAME,CONTAINERS_QUAY_PASSWORD) - docker push "${EXTRA_STABLE_IMAGE}-${GOARCH}" - -# Create and push multiarch image manifest of skopeo upstream -push-manifest-multiarch/upstream: - docker manifest create "${UPSTREAM_IMAGE}" $(foreach arch,${MULTIARCH_MANIFEST_ARCHITECTURES}, ${UPSTREAM_IMAGE}-${arch}) - $(call quay_login,SKOPEO_QUAY_USERNAME,SKOPEO_QUAY_PASSWORD) - docker manifest push --purge "${UPSTREAM_IMAGE}" - -# Create and push multiarch image manifest of skopeo stable -push-manifest-multiarch/stable: - docker manifest create "${STABLE_IMAGE}" $(foreach arch,${MULTIARCH_MANIFEST_ARCHITECTURES}, ${STABLE_IMAGE}-${arch}) - $(call quay_login,SKOPEO_QUAY_USERNAME,SKOPEO_QUAY_PASSWORD) - docker manifest push --purge "${STABLE_IMAGE}" - # Push to extra repository - docker manifest create "${EXTRA_STABLE_IMAGE}" $(foreach arch,${MULTIARCH_MANIFEST_ARCHITECTURES}, ${EXTRA_STABLE_IMAGE}-${arch}) - $(call quay_login,CONTAINERS_QUAY_USERNAME,CONTAINERS_QUAY_PASSWORD) - docker manifest push --purge "${EXTRA_STABLE_IMAGE}" diff --git a/release/README.md b/release/README.md deleted file mode 100644 index 627afc45..00000000 --- a/release/README.md +++ /dev/null @@ -1,40 +0,0 @@ -# skopeo container image build with Travis - -This document describes the details and requirements to build and publish skopeo container images. The images are published as several architecture specific images and multiarch images on top for upstream and stable versions. - -The Travis configuration is available at `.travis.yml`. - -The code to build and publish images is available at `release/Makefile` and should be used only via Travis. - -Travis workflow has 3 major pieces: -- `local-build` - build and test source code locally on osx and linux/amd64 environments, 2 jobs are running in parallel -- `image-build-push` - build and push container images with several Travis jobs running in parallel to build images for several architectures (linux/amd64, linux/s390x, linux/ppc64le). Build part is done for each PR, push part is executed only in case of cron job or master branch update. -- `manifest-multiarch-push` - create and push image manifests, which consists of architecture specific images from previous step. Executed only in case of cron job or master branch update. - -## Ways to have full workflow run -- [cron job](https://docs.travis-ci.com/user/cron-jobs/#adding-cron-jobs) -- Trigger build from Travis CI -- Update code in master branch - -## Environment variables - -Several environment variables are used to customize image names and keep private credentials to push to quay.io repositories. - -**Image tags** are specified in environment variable and should be manually updated in case of new release. - -- `SKOPEO_QUAY_USERNAME` and `SKOPEO_QUAY_PASSWORD` are credentials to push images to `quay.io/skopeo/stable` and `quay.io/skopeo/upstream` repos, and require the credentials to have write permissions. These variables should be specified in [Travis](https://docs.travis-ci.com/user/environment-variables/#defining-variables-in-repository-settings). -- `CONTAINERS_QUAY_USERNAME` and `CONTAINERS_QUAY_PASSWORD` are credentials to push images to `quay.io/containers/skopeo` repos, and require the credentials to have write permissions. These variables should be specified in [Travis](https://docs.travis-ci.com/user/environment-variables/#defining-variables-in-repository-settings). - -Variables in .travis.yml -- `MULTIARCH_MANIFEST_ARCHITECTURES` is a list with architecture shortnames, to appear in final multiarch manifest. The values should fit to architectures used in the `image-build-push` Travis step. -- `STABLE_IMAGE`, `EXTRA_STABLE_IMAGE` are image names to publish stable Skopeo. -- `UPSTREAM_IMAGE` is an image name to publish upstream Skopeo. - -### Values for environment variables - -| Env variable | Value | -| -------------------------------- |----------------------------------| -| MULTIARCH_MANIFEST_ARCHITECTURES | "amd64 s390x ppc64le" | -| STABLE_IMAGE | quay.io/skopeo/stable:v1.2.0 | -| EXTRA_STABLE_IMAGE | quay.io/containers/skopeo:v1.2.0 | -| UPSTREAM_IMAGE | quay.io/skopeo/upstream:master |