Skip to content

docker

docker #3870

Workflow file for this run

# NOTE: This name appears in GitHub's Checks API and in workflow's status badge.
name: docker
# Trigger the workflow when:
on:
# A push occurs to one of the matched branches.
push:
# XXX: ideally on master branches we would build the image only if there are changes in the
# 'docker/' directory (as we do in pull_requests). However, this doesn't work when pushing a new
# 'stable/*' branch - the build on a new branch does not trigger unless there are changes
# compared to master on the filtered path.
# If this is ever fixed, or per branch filters are possible, bring back the path filter to only
# build the image when there are changes within 'docker/' directory.
branches:
- master
- stable/*
# Or when a pull request event occurs for a pull request against one of the matched branches and at least
# one modified file matches the configured paths.
#
# NOTE: We use this to be able to easily test Docker image changes.
pull_request:
branches:
- master
- stable/*
paths:
- docker/**
# Or every day at 04:00 UTC (for the default/master branch).
schedule:
- cron: "0 4 * * *"
# Cancel in progress jobs on new pushes.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
build-images:
# NOTE: This name appears in GitHub's Checks API.
name: build-images
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
# Check out pull request's HEAD commit instead of the merge commit.
ref: ${{ github.event.pull_request.head.sha }}
- name: Determine tag name
id: determine_tag
shell: bash
run: |
if [[ -z $GITHUB_BASE_REF ]]; then
# On master/stable branches.
branch=${GITHUB_REF#refs/heads/}
else
# On pull request branches.
branch=pr-$(git describe --always --match '' --abbrev=7)
fi
branch=${branch//\//-}
echo "tag=${branch}" >> $GITHUB_OUTPUT
echo "created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to DockerHub
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: "Rebuild ghcr.io/oasisprotocol/oasis-core-dev:${{ steps.determine_tag.outputs.tag }}"
uses: docker/build-push-action@v6
with:
context: docker/oasis-core-dev
file: docker/oasis-core-dev/Dockerfile
tags: ghcr.io/oasisprotocol/oasis-core-dev:${{ steps.determine_tag.outputs.tag }}
pull: true
push: true
provenance: false
labels: |
org.opencontainers.image.source=${{ github.event.repository.html_url }}
org.opencontainers.image.created=${{ steps.determine_tag.outputs.created }}
org.opencontainers.image.revision=${{ github.sha }}
- name: "Rebuild ghcr.io/oasisprotocol/oasis-core-ci:${{ steps.determine_tag.outputs.tag }}"
uses: docker/build-push-action@v6
with:
context: docker/oasis-core-ci
file: docker/oasis-core-ci/Dockerfile
tags: ghcr.io/oasisprotocol/oasis-core-ci:${{ steps.determine_tag.outputs.tag }}
pull: true
push: true
provenance: false
build-args: OASIS_CORE_DEV_BASE_TAG=${{ steps.determine_tag.outputs.tag }}
labels: |
org.opencontainers.image.source=${{ github.event.repository.html_url }}
org.opencontainers.image.created=${{ steps.determine_tag.outputs.created }}
org.opencontainers.image.revision=${{ github.sha }}
- name: "Rebuild ghcr.io/oasisprotocol/aesmd-dcap:${{ steps.determine_tag.outputs.tag }}"
uses: docker/build-push-action@v6
with:
context: docker/aesmd
file: docker/aesmd/Dockerfile
tags: ghcr.io/oasisprotocol/aesmd-dcap:${{ steps.determine_tag.outputs.tag }}
pull: true
push: true
provenance: false
build-args: MODE=dcap
labels: |
org.opencontainers.image.source=${{ github.event.repository.html_url }}
org.opencontainers.image.created=${{ steps.determine_tag.outputs.created }}
org.opencontainers.image.revision=${{ github.sha }}
- name: "Rebuild ghcr.io/oasisprotocol/aesmd-epid:${{ steps.determine_tag.outputs.tag }}"
uses: docker/build-push-action@v6
with:
context: docker/aesmd
file: docker/aesmd/Dockerfile
tags: ghcr.io/oasisprotocol/aesmd-epid:${{ steps.determine_tag.outputs.tag }}
pull: true
push: true
provenance: false
build-args: MODE=epid
labels: |
org.opencontainers.image.source=${{ github.event.repository.html_url }}
org.opencontainers.image.created=${{ steps.determine_tag.outputs.created }}
org.opencontainers.image.revision=${{ github.sha }}
- name: Prune old ghcr.io/oasisprotocol/oasis-core-dev images
uses: vlaurin/[email protected]
with:
token: ${{ secrets.GITHUB_TOKEN }}
organization: oasisprotocol
container: oasis-core-dev
keep-younger-than: 7 # days
keep-last: 2
prune-untagged: true
prune-tags-regexes: ^pr-
- name: Prune old ghcr.io/oasisprotocol/oasis-core-ci images
uses: vlaurin/[email protected]
with:
token: ${{ secrets.GITHUB_TOKEN }}
organization: oasisprotocol
container: oasis-core-ci
keep-younger-than: 7 # days
keep-last: 2
prune-untagged: true
prune-tags-regexes: ^pr-
- name: Prune old ghcr.io/oasisprotocol/aesmd-dcap images
uses: vlaurin/[email protected]
with:
token: ${{ secrets.GITHUB_TOKEN }}
organization: oasisprotocol
container: aesmd-dcap
keep-younger-than: 7 # days
keep-last: 2
prune-untagged: true
prune-tags-regexes: ^pr-
- name: Prune old ghcr.io/oasisprotocol/aesmd-epid images
uses: vlaurin/[email protected]
with:
token: ${{ secrets.GITHUB_TOKEN }}
organization: oasisprotocol
container: aesmd-epid
keep-younger-than: 7 # days
keep-last: 2
prune-untagged: true
prune-tags-regexes: ^pr-