harald/teepot
1
0
Fork 0
mirror of https://github.com/matter-labs/teepot.git synced 2025-07-21 15:13:56 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

ci: fix and revise docker push strategy

Browse source 
- containers are not `latest` by default anymore
- `latest` tag is only set on push to main branch
- buildid tag is only set on push to main branch, and
  changed to the infra repo soonish
- added the missing `vault-unseal` and `vault-admin` container

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
This commit is contained in:
Harald Hoyer 2024-06-12 13:50:06 +02:00
parent 4aa1f40c50
commit cfb133bca9
Signed by: harald
GPG key ID: F519A1143B3FBE32
1 changed files with 30 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

53
.github/workflows/nix.yml vendored
View file

@ -51,7 +51,6 @@ jobs:
push_to_docker: push_to_docker:
needs: build needs: build
if: ${{ github.event_name == 'push' }}
runs-on: ubuntu-latest runs-on: ubuntu-latest
concurrency: concurrency:
group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.config.nixpackage }} group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.config.nixpackage }}
@ -60,11 +59,13 @@ jobs:
fail-fast: false fail-fast: false
matrix: matrix:
config: config:
- { nixpackage: 'container-vault-sgx-azure', dockerfile: 'packages/container-vault-sgx-azure/Dockerfile', repository: 'teepot-vault' } - { nixpackage: 'container-vault-sgx-azure' }
- { nixpackage: 'container-vault-unseal-sgx-azure', dockerfile: 'packages/container-vault-unseal-sgx-azure/Dockerfile', repository: 'teepot-tvu' } - { nixpackage: 'container-vault-unseal-sgx-azure' }
- { nixpackage: 'container-vault-admin-sgx-azure', dockerfile: 'packages/container-vault-admin-sgx-azure/Dockerfile', repository: 'teepot-tva' } - { nixpackage: 'container-vault-admin-sgx-azure' }
- { nixpackage: 'container-self-attestation-test-sgx-dcap', dockerfile: 'packages/container-self-attestation-test-sgx-dcap/Dockerfile', repository: 'teepot-self-attestation-test-sgx-dcap' } - { nixpackage: 'container-vault-unseal' }
- { nixpackage: 'container-self-attestation-test-sgx-azure', dockerfile: 'packages/container-self-attestation-test-sgx-azure/Dockerfile', repository: 'teepot-self-attestation-test-sgx-azure' } - { nixpackage: 'container-vault-admin' }
- { nixpackage: 'container-self-attestation-test-sgx-dcap' }
- { nixpackage: 'container-self-attestation-test-sgx-azure' }
- { nixpackage: 'container-verify-attestation-sgx' } - { nixpackage: 'container-verify-attestation-sgx' }
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
@ -86,30 +87,36 @@ jobs:
username: ${{ secrets.DOCKERHUB_USER }} username: ${{ secrets.DOCKERHUB_USER }}
password: ${{ secrets.DOCKERHUB_TOKEN }} password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Load and Push nix container - name: Load container
id: build
run: | run: |
nix build -L .#${{ matrix.config.nixpackage }} nix build --accept-flake-config -L .#${{ matrix.config.nixpackage }}
export IMAGE_TAG=$(docker load < result | grep -Po 'Loaded image.*: \K.*') export IMAGE_TAG=$(docker load < result | grep -Po 'Loaded image.*: \K.*')
echo "Pushing image ${IMAGE_TAG} to Docker Hub" echo "IMAGE_TAG=${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
docker tag "${IMAGE_TAG}" matterlabsrobot/"${IMAGE_TAG}" echo "IMAGE_NAME=${IMAGE_TAG%:*}" >> "$GITHUB_OUTPUT"
docker push matterlabsrobot/"${IMAGE_TAG}"
docker tag matterlabsrobot/"${IMAGE_TAG}" matterlabsrobot/"${IMAGE_TAG%:*}:latest" - name: Push container
docker push matterlabsrobot/"${IMAGE_TAG%:*}:latest" run: |
echo "Pushing image ${{ steps.build.outputs.IMAGE_TAG }} to Docker Hub"
docker tag "${{ steps.build.outputs.IMAGE_TAG }}" matterlabsrobot/"${{ steps.build.outputs.IMAGE_TAG }}"
docker push matterlabsrobot/"${{ steps.build.outputs.IMAGE_TAG }}"
- name: Tag container as latest
if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
run: |
docker tag "${{ steps.build.outputs.IMAGE_TAG }}" matterlabsrobot/"${{ steps.build.outputs.IMAGE_NAME }}:latest"
docker push matterlabsrobot/"${{ steps.build.outputs.IMAGE_NAME }}:latest"
- name: Generate build ID for Flux Image Automation - name: Generate build ID for Flux Image Automation
if: ${{ matrix.config.dockerfile }} if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
id: buildid id: buildid
run: | run: |
sha=$(git rev-parse --short HEAD) sha=$(git rev-parse --short HEAD)
ts=$(date +%s%N | cut -b1-13) ts=$(date +%s%N | cut -b1-13)
echo "BUILD_ID=${sha}-${ts}" >> "$GITHUB_OUTPUT" echo "BUILD_ID=${sha}-${ts}" >> "$GITHUB_OUTPUT"
- name: Build and Push Container - name: Push Docker image to matterlabs-infra
if: ${{ matrix.config.dockerfile }} if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
uses: docker/build-push-action@v5 run: |
with: docker tag "${{ steps.build.outputs.IMAGE_TAG }}" matterlabsrobot/"${{ steps.build.outputs.IMAGE_NAME }}::${{ steps.buildid.outputs.BUILD_ID }}"
file: ${{ matrix.config.dockerfile }} docker push matterlabsrobot/"${{ steps.build.outputs.IMAGE_NAME }}::${{ steps.buildid.outputs.BUILD_ID }}"
tags: |
"matterlabsrobot/${{ matrix.config.repository }}:latest"
"matterlabsrobot/${{ matrix.config.repository }}:${{ steps.buildid.outputs.BUILD_ID }}"
push: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}