diff --git a/.github/workflows/publish-baseline.yml b/.github/workflows/publish-baseline.yml index 767f60a..fea2a66 100644 --- a/.github/workflows/publish-baseline.yml +++ b/.github/workflows/publish-baseline.yml @@ -7,9 +7,14 @@ name: Publish Baseline # Triggers: # - workflow_dispatch: run manually from any branch; pick a tag via the input # (default: "baseline") e.g. "baseline", "1.0.0-baseline" -# - push of `v*` tags (e.g., `v1.0.1`) -> docker tag derived as `1.0.1-baseline` -# (so cutting a release builds both `:1.0.1` and `:1.0.1-baseline` in one push) -# - push of `*-baseline` tags (e.g. `1.0.0-baseline`) → docker tag mirrors git tag +# - push of `v*` tags (e.g., `v1.0.1`) -> docker tag derived as `1.0.1-baseline`. +# publish.yml handles `:1.0.1`/`:latest` for the same push (it excludes +# `v*-baseline` so this workflow owns the baseline half of every release). +# This workflow also moves the rolling `:baseline` pointer. +# - push of `v*-baseline` or `*-baseline` tags (e.g., `v1.0.1-baseline`, +# `1.0.1-baseline`) -> docker tag mirrors the git tag (v stripped). +# publish.yml explicitly excludes `v*-baseline` so a baseline-only release +# does not also push `:X.Y.Z` or `:latest`. Rolling `:baseline` is moved. on: workflow_dispatch: @@ -112,15 +117,18 @@ jobs: if [[ "${{ github.event_name }}" == "push" ]]; then REF="${GITHUB_REF_NAME}" if [[ "${REF}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then - # Versioned release tag (e.g., v1.0.1) -> derive `1.0.1-baseline` + # Versioned release tag (e.g., v1.0.1) -> derive `1.0.1-baseline`. + # publish.yml handles `:1.0.1`/`:latest` for the same push. TAG="${REF#v}-baseline" elif [[ "${REF}" =~ ^v.*-baseline$ ]]; then - # Should never happen given trigger patterns, but guard so we - # never produce a literal `v1.0.1-baseline-baseline` docker tag. - echo "::error::Tag '${REF}' mixes both conventions. Push the bare vX.Y.Z tag - publish.yml handles :1.0.1, this workflow handles :1.0.1-baseline." - exit 1 + # v-prefixed baseline tag (e.g., v1.0.1-baseline) -> strip the `v`, + # use the bare form. This is a baseline-only release: push ONLY + # `:X.Y.Z-baseline` + `:baseline`, never `:X.Y.Z`/`:latest` + # (publish.yml explicitly excludes `v*-baseline` so it never fires + # for this case, leaving the baseline path exclusive to this workflow). + TAG="${REF#v}" else - # Explicit baseline tag push (e.g., `1.0.1-baseline`) -> use as-is + # Bare baseline tag push (e.g., `1.0.1-baseline`) -> use as-is TAG="${REF}" fi else diff --git a/.github/workflows/publish-nightly.yml b/.github/workflows/publish-nightly.yml new file mode 100644 index 0000000..97d7d6e --- /dev/null +++ b/.github/workflows/publish-nightly.yml @@ -0,0 +1,136 @@ +name: Publish Nightly + +# Builds the disposable `:nightly` and `:nightly-` tags of +# `ghcr.io/.../trawl` from `apps/api/Dockerfile` on every push to `main`. +# +# Lives separately from publish.yml (release builds on `v*` tags) and +# publish-baseline.yml (baseline runtime builds on `v*`/`*-baseline` tags) +# so: +# - `v*` tag pushes never trigger a nightly rebuild (release is exclusive) +# - main pushes never trigger a release/baseline rebuild +# - each workflow has its own GHA cache scope (no cross-pollution) +# +# Tag contract: +# - push to `main` -> :nightly- + :nightly +# - `:latest` is intentionally NOT touched here — that's owned by +# publish.yml and only moves on `v*` release pushes. + +on: + push: + branches: [main] + +env: + IMAGE: ghcr.io/${{ github.repository_owner }}/trawl + +jobs: + build: + strategy: + matrix: + include: + - platform: linux/amd64 + runner: ubuntu-latest + - platform: linux/arm64 + runner: ubuntu-24.04-arm + + runs-on: ${{ matrix.runner }} + permissions: + contents: read + packages: write + + steps: + - uses: actions/checkout@v4 + + - uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - uses: docker/setup-buildx-action@v3 + + - uses: docker/metadata-action@v5 + id: meta + with: + images: ${{ env.IMAGE }} + + - name: Sanitize platform name + run: | + platform=${{ matrix.platform }} + echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV + + - uses: docker/build-push-action@v6 + id: build + with: + context: . + file: apps/api/Dockerfile + platforms: ${{ matrix.platform }} + push: true + labels: ${{ steps.meta.outputs.labels }} + outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true + cache-from: type=gha,scope=trawl-nightly-${{ matrix.platform }} + cache-to: type=gha,scope=trawl-nightly-${{ matrix.platform }},mode=max + secrets: | + GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} + + - name: Export digest + run: | + mkdir -p /tmp/digests + digest="${{ steps.build.outputs.digest }}" + touch "/tmp/digests/${digest#sha256:}" + + - uses: actions/upload-artifact@v4 + with: + name: digests-nightly-${{ env.PLATFORM_PAIR }} + path: /tmp/digests/* + if-no-files-found: error + retention-days: 1 + + merge: + runs-on: ubuntu-latest + needs: build + permissions: + contents: read + packages: write + + steps: + - uses: actions/download-artifact@v4 + with: + path: /tmp/digests + pattern: digests-nightly-* + merge-multiple: true + + - uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - uses: docker/setup-buildx-action@v3 + + - uses: docker/metadata-action@v5 + id: meta + with: + images: ${{ env.IMAGE }} + tags: | + # main branch push → :nightly (disposable test build). + type=raw,value=nightly + # main branch push → :nightly- for traceability. + type=sha,prefix=nightly- + + - name: Create and push multi-arch manifest + working-directory: /tmp/digests + run: | + docker buildx imagetools create \ + $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ + $(printf '${{ env.IMAGE }}@sha256:%s ' *) + + - name: Inspect manifest + run: | + # Pull the first tag actually pushed by docker/metadata-action in the + # previous step. DOCKER_METADATA_OUTPUT_JSON.tags[] is already + # fully-qualified ("ghcr.io/germondai/trawl:nightly-…") so no $IMAGE + # prefix needed — the legacy logic re-derived from github.ref / + # github.sha which disagreed with what got pushed (type=sha writes + # short 7-char SHA but github.sha is the full 40-char hash). + tag=$(jq -r '.tags[0]' <<< "$DOCKER_METADATA_OUTPUT_JSON") + docker buildx imagetools inspect "$tag" \ No newline at end of file diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index b2db780..b58392c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,9 +1,28 @@ name: Publish +# Builds `:X.Y.Z` and `:latest` tags of `ghcr.io/.../trawl` from +# `apps/api/Dockerfile` on `v*` release tag pushes. The `v` prefix is stripped +# per Docker convention (git tag `v1.0.0` -> docker tag `1.0.0`); `:latest` +# auto-attaches via the default `latest=auto` flavor of `type=semver`. +# +# Lives separately from publish-nightly.yml (main branch pushes) and +# publish-baseline.yml (baseline runtime pushes). `v*-baseline` is +# intentionally excluded so a baseline-only release doesn't also push +# `:X.Y.Z`/`:latest` — publish-baseline.yml owns that path. +# +# Tag contract: +# - push `v*` -> :X.Y.Z + :latest +# - push `v*-baseline` -> nothing here (excluded) +# - push `main` -> nothing here (handled by publish-nightly.yml) + on: push: - branches: [main] - tags: ["v*"] + tags: + # Release tags — pure semver only. `v*-baseline` is intentionally excluded + # so a baseline-only release (e.g., `v1.0.0-baseline`) does NOT push `:X.Y.Z` + # or `:latest` from this workflow; publish-baseline.yml owns that path. + - "v*" + - "!v*-baseline" env: IMAGE: ghcr.io/${{ github.repository_owner }}/trawl @@ -53,8 +72,8 @@ jobs: push: true labels: ${{ steps.meta.outputs.labels }} outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true - cache-from: type=gha,scope=${{ env.PLATFORM_PAIR }} - cache-to: type=gha,scope=${{ env.PLATFORM_PAIR }},mode=max + cache-from: type=gha,scope=trawl-release-${{ matrix.platform }} + cache-to: type=gha,scope=trawl-release-${{ matrix.platform }},mode=max secrets: | GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} @@ -66,7 +85,7 @@ jobs: - uses: actions/upload-artifact@v4 with: - name: digests-${{ env.PLATFORM_PAIR }} + name: digests-release-${{ env.PLATFORM_PAIR }} path: /tmp/digests/* if-no-files-found: error retention-days: 1 @@ -82,7 +101,7 @@ jobs: - uses: actions/download-artifact@v4 with: path: /tmp/digests - pattern: digests-* + pattern: digests-release-* merge-multiple: true - uses: docker/login-action@v3 @@ -102,11 +121,6 @@ jobs: # per Docker convention; type=ref would mirror the v through). type=semver also # auto-attaches :latest via the default latest=auto flavor. type=semver,pattern={{version}} - # main branch push → :nightly (disposable test build). - type=raw,value=nightly,enable=${{ github.ref == 'refs/heads/main' }} - # main branch push → :nightly- for traceability. Gated so a vX.Y.Z - # tag push does NOT also inherit a nightly- tag (only main builds are nightly). - type=sha,prefix=nightly-,enable=${{ github.ref == 'refs/heads/main' }} - name: Create and push multi-arch manifest working-directory: /tmp/digests @@ -119,10 +133,7 @@ jobs: run: | # Pull the first tag actually pushed by docker/metadata-action in the previous # step. DOCKER_METADATA_OUTPUT_JSON.tags[] is already fully-qualified - # ("ghcr.io/germondai/trawl:nightly-…") so no $IMAGE prefix needed — the legacy - # logic re-derived from ${{ github.ref }} / ${{ github.sha }} which disagreed - # with what got pushed (type=sha,prefix=nightly- writes short 7-char SHA but - # github.sha is the full 40-char hash). + # ("ghcr.io/germondai/trawl:1.0.0" / ":latest") so no $IMAGE prefix needed. tag=$(jq -r '.tags[0]' <<< "$DOCKER_METADATA_OUTPUT_JSON") docker buildx imagetools inspect "$tag"