Workflows: add build and push to Dockerhub workflow

Since now we are using the new docker build infra, the old image building and publishing workflow, based on dockerhub runners, is broken. Replace it with a new one, this time fully based on Github to standardize the image publishing process. `DOCKER_USERNAME` and `DOCKER_PASSWORD` of the registry must be added to repo secrets for this to work. In order to separate the flow of tagged and untagged builds, workflows are splitted: one works only on tags, the other on everyday push events. Sorry, dockerhub CI. New kid in town. Signed-off-by: Arnaldo Cesco <[email protected]>
astarte-platform · Jul 18, 2024 · 9fd3898 · 9fd3898
1 parent 1a5ee19
commit 9fd3898
Show file tree

Hide file tree

Showing 4 changed files with 257 additions and 0 deletions.
diff --git a/.github/workflows/publish-release-to-dockerhub-workflow.yaml b/.github/workflows/publish-release-to-dockerhub-workflow.yaml
@@ -0,0 +1,61 @@
+# GitHub recommends pinning actions to a commit SHA.
+# To get a newer version, you will need to update the SHA.
+# You can also reference a tag or branch, but the action may change without warning.
+
+name: Publish Docker images
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  push_release_to_registry:
+    name: Push Docker images to Docker Hub
+    runs-on: ubuntu-22.04
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
+    strategy:
+      fail-fast: true
+      matrix:
+        app:
+        - astarte_appengine_api
+        - astarte_data_updater_plant
+        - astarte_housekeeping
+        - astarte_housekeeping_api
+        - astarte_pairing
+        - astarte_pairing_api
+        - astarte_realm_management
+        - astarte_realm_management_api
+        - astarte_trigger_engine
+    needs: [test-coverage, end-to-end-test]
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: |
+            astarte/${{ matrix.app }}
+          tags: |
+            type=semver,pattern={{version}}
+
+      - name: Build and push tagged Docker image
+        id: push
+        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+        with:
+          context: apps/${{ matrix.app }}
+          file: Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/publish-snapshot-to-dockerhub-workflow.yaml b/.github/workflows/publish-snapshot-to-dockerhub-workflow.yaml
@@ -0,0 +1,74 @@
+# GitHub recommends pinning actions to a commit SHA.
+# To get a newer version, you will need to update the SHA.
+# You can also reference a tag or branch, but the action may change without warning.
+
+name: Publish snapshot Docker images
+
+on:
+  push:
+    paths:
+    - 'apps/**'
+    - '.github/workflows/publish-snapshot-to-dockerhub-workflow.yaml'
+    - 'Dockerfile'
+    branches:
+    - 'master'
+    - 'release-*'
+
+jobs:
+  push_snapshot_to_registry:
+    name: Push Docker images to Docker Hub
+    runs-on: ubuntu-22.04
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
+    strategy:
+      fail-fast: true
+      matrix:
+        app:
+        - astarte_appengine_api
+        - astarte_data_updater_plant
+        - astarte_housekeeping
+        - astarte_housekeeping_api
+        - astarte_pairing
+        - astarte_pairing_api
+        - astarte_realm_management
+        - astarte_realm_management_api
+        - astarte_trigger_engine
+    needs: [test-coverage, end-to-end-test]
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Compute tag name for snapshot images
+        id: compute-tag
+        run: |
+          export TAG="$(echo ${{ github.ref }} | sed 's,refs/heads/,,' | sed 's/master/snapshot/g' | sed 's/release-\(.*\)/\1-snapshot/g' )"
+          echo "TAG=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: |
+            astarte/${{ matrix.app }}
+          tags: |
+            # TODO we probably want something smarter, but the 'pattern' type runs only on tags at the moment
+            type=raw,value=${{ steps.compute-tag.outputs.TAG }}
+
+      - name: Build and push tagged Docker image
+        id: push
+        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+        with:
+          context: apps/${{ matrix.app }}
+          file: Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/publish-tool-release-to-dockerhub-workflow.yaml b/.github/workflows/publish-tool-release-to-dockerhub-workflow.yaml
@@ -0,0 +1,55 @@
+# GitHub recommends pinning actions to a commit SHA.
+# To get a newer version, you will need to update the SHA.
+# You can also reference a tag or branch, but the action may change without warning.
+
+name: Publish Docker images of Astarte tools
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  push_tool_release_to_registry:
+    name: Push Docker images of Astarte tools to Docker Hub 
+    runs-on: ubuntu-22.04
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
+    strategy:
+      fail-fast: true
+      matrix:
+        app:
+        - astarte_device_fleet_simulator
+        - astarte_e2e
+        - astarte_export
+        - astarte_import
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Extract metadata (tags, labels) of Astarte tools for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: |
+            astarte/${{ matrix.app }}
+          tags: |
+            type=semver,pattern={{version}}
+
+      - name: Build and push tagged Docker image of Astarte tools
+        id: push
+        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+        with:
+          context: tools/${{ matrix.app }}
+          file: tools/${{ matrix.app }}/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/publish-tool-snapshot-to-dockerhub-workflow.yaml b/.github/workflows/publish-tool-snapshot-to-dockerhub-workflow.yaml
@@ -0,0 +1,67 @@
+# GitHub recommends pinning actions to a commit SHA.
+# To get a newer version, you will need to update the SHA.
+# You can also reference a tag or branch, but the action may change without warning.
+
+name: Publish snapshot Docker images of Astarte tools
+
+on:
+  push:
+    paths:
+    - 'tools/**'
+    - '.github/workflows/publish-tool-snapshot-to-dockerhub-workflow.yaml'
+    branches:
+    - 'master'
+    - 'release-*'
+
+jobs:
+  push_tool_snapshot_to_registry:
+    name: Push Docker images of Astarte tools to Docker Hub
+    runs-on: ubuntu-22.04
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
+    strategy:
+      fail-fast: true
+      matrix:
+        app:
+        - astarte_device_fleet_simulator
+        - astarte_e2e
+        - astarte_export
+        - astarte_import
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Compute tag name for snapshot images of Astarte tools
+        id: compute-tag
+        run: |
+          export TAG="$(echo ${{ github.ref }} | sed 's,refs/heads/,,' | sed 's/master/snapshot/g' | sed 's/release-\(.*\)/\1-snapshot/g' )"
+          echo "TAG=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Extract metadata (tags, labels) of Astarte tools for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: |
+            astarte/${{ matrix.app }}
+          tags: |
+            # TODO we probably want something smarter, but the 'pattern' type runs only on tags at the moment
+            type=raw,value=${{ steps.compute-tag.outputs.TAG }}
+
+      - name: Build and push tagged Docker image of Astarte tools
+        id: push
+        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+        with:
+          context: tools/${{ matrix.app }}
+          file: tools/${{ matrix.app }}/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}