build: publish docker images to artifact registry #1832
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: image | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, labeled] | |
| push: | |
| branches: | |
| - master | |
| - release/** | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-setup: | |
| name: Setup build metadata | |
| runs-on: ubuntu-latest | |
| env: | |
| FULL_CI: "${{ | |
| github.event_name != 'pull_request' | |
| || contains(github.event.pull_request.labels.*.name, 'Trigger: Full-CI') | |
| }}" | |
| steps: | |
| - id: set-outputs | |
| run: | | |
| echo "full_ci=$FULL_CI" >> $GITHUB_OUTPUT | |
| if [[ "$FULL_CI" == "true" ]]; then | |
| echo "Running full CI" | |
| echo 'archs=["amd64", "arm64"]' >> $GITHUB_OUTPUT | |
| else | |
| echo "Skipping some CI steps" | |
| echo 'archs=["amd64"]' >> $GITHUB_OUTPUT | |
| fi | |
| outputs: | |
| archs: "${{ steps.set-outputs.outputs.archs }}" | |
| full_ci: "${{ steps.set-outputs.outputs.full_ci }}" | |
| build-image: | |
| needs: build-setup | |
| strategy: | |
| matrix: | |
| arch: ${{ fromJson(needs.build-setup.outputs.archs) }} | |
| runs-on: |- | |
| ${{fromJson('{ | |
| "amd64": "ubuntu-20.04", | |
| "arm64": "ubuntu-22.04-arm64-relay" | |
| }')[matrix.arch] }} | |
| env: | |
| IMG_VERSIONED: ghcr.io/getsentry/symbolicator:${{ matrix.arch }}-${{ github.sha }} | |
| NIGHTLY_IMG_CACHE: ghcr.io/getsentry/symbolicator:${{ matrix.arch }}-nightly | |
| BUILDER_IMG_CACHE: ghcr.io/getsentry/symbolicator:${{ matrix.arch }}-builder | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| - name: Docker Login | |
| run: docker login --username '${{ github.actor }}' --password '${{ secrets.GITHUB_TOKEN }}' ghcr.io | |
| - name: build builder img | |
| run: | | |
| set -euxo pipefail | |
| args=() | |
| if docker pull -q "$BUILDER_IMG_CACHE"; then | |
| args+=(--cache-from "$BUILDER_IMG_CACHE") | |
| fi | |
| docker buildx build \ | |
| "${args[@]}" \ | |
| --build-arg BUILDKIT_INLINE_CACHE=1 \ | |
| --platform linux/${{ matrix.arch }} \ | |
| --tag "$BUILDER_IMG_CACHE" \ | |
| --target symbolicator-build \ | |
| . | |
| - name: build nightly img | |
| run: | | |
| set -euxo pipefail | |
| args=() | |
| if docker pull -q "$NIGHTLY_IMG_CACHE"; then | |
| args+=(--cache-from "$NIGHTLY_IMG_CACHE") | |
| fi | |
| docker buildx build \ | |
| "${args[@]}" \ | |
| --build-arg BUILDKIT_INLINE_CACHE=1 \ | |
| --platform linux/${{ matrix.arch }} \ | |
| --tag "$NIGHTLY_IMG_CACHE" \ | |
| --tag "$IMG_VERSIONED" \ | |
| --cache-from "${BUILDER_IMG_CACHE}" \ | |
| --cache-from "${NIGHTLY_IMG_CACHE}" \ | |
| . | |
| - name: push all images | |
| if: "needs.build-setup.outputs.full_ci == 'true'" | |
| run: | | |
| docker push "$BUILDER_IMG_CACHE" | |
| docker push "$NIGHTLY_IMG_CACHE" | |
| docker push "$IMG_VERSIONED" | |
| assemble: | |
| needs: [build-setup, build-image] | |
| if: "needs.build-setup.outputs.full_ci == 'true'" | |
| name: Assemble for Github Container Registry | |
| runs-on: ubuntu-20.04 | |
| env: | |
| TARGET_IMAGE: ghcr.io/getsentry/symbolicator | |
| steps: | |
| - name: Docker Login | |
| run: docker login --username '${{ github.actor }}' --password '${{ secrets.GITHUB_TOKEN }}' ghcr.io | |
| - name: Assemble Sha Image | |
| run: | | |
| docker manifest create "${TARGET_IMAGE}:${{ github.sha }}" \ | |
| "${TARGET_IMAGE}:arm64-${{ github.sha }}" \ | |
| "${TARGET_IMAGE}:amd64-${{ github.sha }}" | |
| docker manifest push "${TARGET_IMAGE}:${{ github.sha }}" | |
| - name: Assemble Latest Image | |
| if: github.ref_name == 'master' | |
| run: | | |
| docker manifest create "${TARGET_IMAGE}:latest" \ | |
| "${TARGET_IMAGE}:arm64-${{ github.sha }}" \ | |
| "${TARGET_IMAGE}:amd64-${{ github.sha }}" | |
| docker manifest push "${TARGET_IMAGE}:latest" | |
| assemble-ar: | |
| needs: [build-setup, build-image] | |
| if: "needs.build-setup.outputs.full_ci == 'true'" | |
| name: Assemble for Google Artifact Registry | |
| runs-on: ubuntu-latest | |
| # required for google auth | |
| permissions: | |
| contents: read | |
| id-token: write | |
| env: | |
| GHCR_IMAGE: ghcr.io/getsentry/symbolicator | |
| TARGET_IMAGE: us-central1-docker.pkg.dev/sentryio/symbolicator/image | |
| steps: | |
| - name: Google Auth | |
| id: auth | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool | |
| service_account: [email protected] | |
| - name: Set up Cloud SDK | |
| uses: google-github-actions/setup-gcloud@v2 | |
| with: | |
| # https://github.com/google-github-actions/auth#authenticating-via-workload-identity-federation | |
| # You must use the Cloud SDK version 390.0.0 or later to authenticate the bq and gsutil tools. | |
| version: ">= 390.0.0" | |
| - name: Configure Docker | |
| run: | | |
| gcloud auth configure-docker us-central1-docker.pkg.dev | |
| - name: Push Images | |
| run: | | |
| docker buildx imagetools create \ | |
| --tag "${TARGET_IMAGE}:arm64-${{ github.sha }}" "${GHCR_IMAGE}:arm64-${{ github.sha }}" | |
| docker buildx imagetools create \ | |
| --tag "${TARGET_IMAGE}:amd64-${{ github.sha }}" "${GHCR_IMAGE}:amd64-${{ github.sha }}" | |
| - name: Assemble Sha Image | |
| run: | | |
| docker manifest create "${TARGET_IMAGE}:${{ github.sha }}" \ | |
| "${TARGET_IMAGE}:arm64-${{ github.sha }}" \ | |
| "${TARGET_IMAGE}:amd64-${{ github.sha }}" | |
| docker manifest push "${TARGET_IMAGE}:${{ github.sha }}" | |
| - name: Assemble Latest Image | |
| if: github.ref_name == 'master' | |
| run: | | |
| docker manifest create "${TARGET_IMAGE}:latest" \ | |
| "${TARGET_IMAGE}:arm64-${{ github.sha }}" \ | |
| "${TARGET_IMAGE}:amd64-${{ github.sha }}" | |
| docker manifest push "${TARGET_IMAGE}:latest" |