Skip to content

Commit 175bd61

Browse files
auricomgithub-advanced-security[bot]
authored and
alpe
committed
chore: docker workflow refactor (#2820)
## 🎯 Summary This PR refactors the Docker build and release workflows to improve maintainability, security, and separation of concerns. The changes reorganize Dockerfiles into a consistent `apps/` directory structure and split monolithic workflows into focused, reusable components. --- ## 📋 Changes ### Workflow Refactoring - __Separated workflows__ for better modularity: - `ci.yml` - Main CI orchestrator with image tag determination - `docker.yml` - Reusable Docker build workflow - `docker-tests.yml` - Docker image testing workflow - `release.yml` - Tag-based release workflow for app publishing - __Removed__ `ci_release.yml` (deprecated/consolidated into new structure) - __Enhanced__ `test.yml` - Simplified by removing Docker build logic (134 lines removed) ### Docker Organization - __Moved Dockerfiles__ to standardized locations: - `Dockerfile` → `apps/testapp/Dockerfile` - `da/cmd/local-da/Dockerfile` → `apps/local-da/Dockerfile` - Updated `apps/grpc/single/Dockerfile` and `docker-compose.yml` - __Removed__ `Dockerfile.da` (consolidated) ### Documentation - __Added__ `.github/RELEASE_QUICK_START.md` (231 lines) - Quick reference guide for Docker and Go module releases ## 🔄 Workflow Architecture ```javascript ┌─────────────┐ │ ci.yml │ (Main orchestrator) └──────┬──────┘ │ ├──► lint.yml ├──► docker.yml ──► Build images ├──► test.yml ├──► docker-tests.yml ──► Test images └──► proto.yml ┌─────────────────┐ │ release.yml │ (Tag-based releases) └─────────────────┘ │ └──► Build & push versioned images to GHCR ``` --- ## 📝 Release Process ### Docker App Releases (Automated) ```bash git tag evm/single/v0.2.0 git push origin evm/single/v0.2.0 # Workflow automatically builds and publishes to GHCR ``` ### Tag Format `{app-path}/v{major}.{minor}.{patch}` Examples: - `evm/single/v0.2.0` → `ghcr.io/evstack/ev-node-evm-single:v0.2.0` - `testapp/v1.0.0` → `ghcr.io/evstack/ev-node-testapp:v1.0.0` See [RELEASE_QUICK_START.md](.github/RELEASE_QUICK_START.md) for complete guide. --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent 071ede0 commit 175bd61

File tree

17 files changed

+652
-388
lines changed

17 files changed

+652
-388
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
---
2+
name: CI
3+
"on":
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
merge_group:
9+
10+
permissions: {}
11+
jobs:
12+
determine-image-tag:
13+
name: Determine Image Tag
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
17+
outputs:
18+
tag: ${{ steps.set-tag.outputs.tag }}
19+
steps:
20+
- name: Set image tag
21+
id: set-tag
22+
run: |
23+
if [ -n "${{ github.event.pull_request.number }}" ]; then
24+
TAG="pr-${{ github.event.pull_request.number }}"
25+
echo "::notice::Using PR-based tag: $TAG"
26+
else
27+
# Sanitize ref_name by replacing / with -
28+
TAG="${{ github.ref_name }}"
29+
TAG="${TAG//\//-}"
30+
echo "::notice::Using branch/tag-based tag: $TAG"
31+
fi
32+
33+
# Validate tag format
34+
if [[ ! "$TAG" =~ ^[a-zA-Z0-9._-]+$ ]]; then
35+
echo "::error::Invalid image tag format: $TAG"
36+
exit 1
37+
fi
38+
39+
echo "tag=$TAG" >> $GITHUB_OUTPUT
40+
41+
lint:
42+
permissions:
43+
contents: read
44+
uses: ./.github/workflows/lint.yml
45+
46+
docker:
47+
needs: determine-image-tag
48+
uses: ./.github/workflows/docker-build-push.yml
49+
secrets: inherit
50+
permissions:
51+
contents: read
52+
packages: write
53+
with:
54+
image-tag: ${{ needs.determine-image-tag.outputs.tag }}
55+
apps: |
56+
[
57+
{"name": "ev-node-evm-single", "dockerfile": "apps/evm/single/Dockerfile"},
58+
{"name": "ev-node-testapp", "dockerfile": "apps/testapp/Dockerfile"}
59+
]
60+
61+
test:
62+
permissions:
63+
actions: read
64+
contents: read
65+
uses: ./.github/workflows/test.yml
66+
secrets: inherit
67+
68+
docker-tests:
69+
needs: [determine-image-tag, docker]
70+
uses: ./.github/workflows/docker-tests.yml
71+
secrets: inherit
72+
permissions:
73+
contents: read
74+
with:
75+
image-tag: ${{ needs.determine-image-tag.outputs.tag }}
76+
77+
proto:
78+
permissions:
79+
contents: read
80+
pull-requests: write
81+
uses: ./.github/workflows/proto.yml

‎.github/workflows/ci_release.yml‎

Lines changed: 0 additions & 66 deletions
This file was deleted.

‎.github/workflows/docker-build-push.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
# This workflow builds and pushes Docker images to GHCR
3+
name: Build Docker Images
4+
permissions: {}
5+
"on":
6+
workflow_call:
7+
inputs:
8+
image-tag:
9+
required: true
10+
type: string
11+
description: 'Docker image tag (e.g., v1.2.3, pr-123, sha-abc123)'
12+
apps:
13+
required: true
14+
type: string
15+
description: 'JSON array of apps to build (e.g., [{"name": "testapp", "dockerfile": "apps/testapp/Dockerfile"}])'
16+
17+
jobs:
18+
build-images:
19+
name: Build ${{ matrix.app.name }}
20+
# skip building images for merge groups as they are already built on PRs and main
21+
if: github.event_name != 'merge_group'
22+
runs-on: ubuntu-latest
23+
permissions:
24+
contents: read
25+
packages: write
26+
strategy:
27+
matrix:
28+
app: ${{ fromJson(inputs.apps) }}
29+
steps:
30+
- name: Checkout code
31+
uses: actions/checkout@v5
32+
33+
- name: Set up Docker Buildx
34+
uses: docker/setup-buildx-action@v3
35+
36+
- name: Log in to GHCR
37+
uses: docker/login-action@v3
38+
with:
39+
registry: ghcr.io
40+
username: ${{ github.actor }}
41+
password: ${{ secrets.GITHUB_TOKEN }}
42+
43+
- name: Build and push ${{ matrix.app.name }} Docker image
44+
uses: docker/build-push-action@v6
45+
with:
46+
context: .
47+
file: ${{ matrix.app.dockerfile }}
48+
push: true
49+
platforms: linux/amd64,linux/arm64
50+
tags: ghcr.io/${{ github.repository_owner }}/${{ matrix.app.name }}:${{ inputs.image-tag }}

‎.github/workflows/docker-tests.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
# This workflow runs tests that require Docker images to be built first
3+
name: Docker E2E Tests
4+
permissions: {}
5+
"on":
6+
workflow_call:
7+
inputs:
8+
image-tag:
9+
required: true
10+
type: string
11+
workflow_dispatch:
12+
inputs:
13+
image-tag:
14+
description: 'Docker image tag to use for tests (e.g., v1.2.3, pr-123, sha-abc123)'
15+
required: true
16+
type: string
17+
18+
jobs:
19+
docker-tests:
20+
permissions:
21+
contents: read
22+
name: Docker E2E Tests
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@v5
26+
- name: set up go
27+
uses: actions/setup-go@v6
28+
with:
29+
go-version-file: ./test/docker-e2e/go.mod
30+
- name: Run Docker E2E Tests
31+
run: make test-docker-e2e
32+
env:
33+
EV_NODE_IMAGE_REPO: ghcr.io/${{ github.repository_owner }}/ev-node-testapp
34+
EV_NODE_IMAGE_TAG: ${{ inputs.image-tag }}
35+
36+
docker-upgrade-tests:
37+
name: Docker Upgrade E2E Tests
38+
permissions:
39+
contents: read
40+
runs-on: ubuntu-latest
41+
steps:
42+
- uses: actions/checkout@v5
43+
- name: set up go
44+
uses: actions/setup-go@v6
45+
with:
46+
go-version-file: ./test/docker-e2e/go.mod
47+
- name: Run Docker Upgrade E2E Tests
48+
run: make test-docker-upgrade-e2e
49+
env:
50+
EVM_SINGLE_IMAGE_REPO: ghcr.io/${{ github.repository_owner }}/ev-node-evm-single
51+
EVM_SINGLE_NODE_IMAGE_TAG: ${{ inputs.image-tag }}

‎.github/workflows/lint.yml‎

Lines changed: 37 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
1+
---
12
# lint runs all linters in this repository
2-
# This workflow is triggered by ci_release.yml workflow
3+
# This workflow is triggered by ci.yml workflow
34
name: lint
4-
on:
5+
permissions:
6+
contents: read
7+
"on":
58
workflow_call:
69

710
jobs:
@@ -13,8 +16,8 @@ jobs:
1316
- uses: actions/setup-go@v6
1417
with:
1518
go-version-file: ./go.mod
16-
# This steps sets the GIT_DIFF environment variable to true
17-
# if files defined in PATTERS changed
19+
# This steps sets the GIT_DIFF environment variable to true
20+
# if files defined in PATTERS changed
1821
- uses: technote-space/[email protected]
1922
with:
2023
# This job will pass without running if go.mod, go.sum, and *.go
@@ -30,32 +33,57 @@ jobs:
3033
github-token: ${{ secrets.github_token }}
3134
if: env.GIT_DIFF
3235

33-
# hadolint lints the Dockerfile
3436
hadolint:
35-
uses: evstack/.github/.github/workflows/[email protected] # yamllint disable-line rule:line-length
36-
with:
37-
dockerfile: Dockerfile
38-
failure-threshold: error
37+
runs-on: ubuntu-latest
38+
steps:
39+
- uses: actions/checkout@v5
40+
- uses: hadolint/[email protected]
41+
with:
42+
recursive: true
43+
failure-threshold: error
3944

4045
yamllint:
4146
runs-on: ubuntu-latest
4247
steps:
4348
- uses: actions/checkout@v5
49+
with:
50+
fetch-depth: 0
51+
- uses: technote-space/[email protected]
52+
with:
53+
PATTERNS: |
54+
**/*.yml
55+
**/*.yaml
4456
- uses: evstack/.github/.github/actions/[email protected]
57+
if: env.GIT_DIFF
4558

4659
markdown-lint:
4760
runs-on: ubuntu-latest
4861
steps:
4962
- uses: actions/checkout@v5
63+
with:
64+
fetch-depth: 0
65+
- uses: technote-space/[email protected]
66+
with:
67+
PATTERNS: |
68+
**/*.md
5069
- uses: evstack/.github/.github/actions/[email protected]
70+
if: env.GIT_DIFF
5171

5272
# Checks that the .goreleaser.yaml file is valid
5373
goreleaser-check:
5474
runs-on: ubuntu-latest
5575
steps:
5676
- name: checkout
5777
uses: actions/checkout@v5
78+
with:
79+
fetch-depth: 0
80+
- uses: technote-space/[email protected]
81+
with:
82+
PATTERNS: |
83+
.goreleaser.yaml
84+
.goreleaser.yml
5885
- uses: goreleaser/goreleaser-action@v6
5986
with:
6087
version: latest
6188
args: check
89+
if: env.GIT_DIFF

0 commit comments

Comments
 (0)