Workflows/SharedWorkflows
2
0
Fork 0
Code Pull Requests Actions Packages Releases Activity

add multi arch support

Browse Source
This commit is contained in:
dresber
2026-07-25 10:46:59 +02:00
parent 49f2277ea1
commit a9f75d66fa
1 changed files with 107 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/docker-publish.yml
+107 -85
View File
@@ -1,5 +1,15 @@
name: Reusable Docker Publish
# Multi-arch (v1.9.0+): builds a manifest list for `platforms` (amd64 + arm64 by default) with
# `docker buildx`, so the same tag runs on x86 servers and on the arm64 Raspberry Pi nodes with no
# per-host changes. The Trivy gate is preserved by building the native amd64 image first with
# --load, scanning that locally, and only then building + pushing the multi-arch manifest (the
# amd64 layers are reused from cache, so only arm64 is newly built).
#
# Runner requirements (baked into the PipelineImage runner; the workflow also self-installs as a
# fallback): the `docker buildx` plugin, and a build daemon that permits `--privileged` containers
# so QEMU/binfmt can be registered for cross-building arm64 on an amd64 runner.
on:
workflow_call:
inputs:
@@ -12,6 +22,11 @@ on:
floating_tag:
type: string
default: "edge"
platforms:
# target platforms for the manifest list. Override to a single platform (e.g.
# "linux/amd64") for images that do not need to run on the arm64 nodes.
type: string
default: "linux/amd64,linux/arm64"
run_image_scan:
type: boolean
default: true
@@ -34,6 +49,17 @@ on:
NTFY_SERVER: { required: true }
PIP_EXTRA_INDEX_URL: { required: false }
# Pinned build tooling. Keep in sync with the ARGs in the PipelineImage Dockerfiles.
# buildx: verify the binary against checksums.txt from the buildx GitHub release before bumping.
# binfmt: pin by digest (tonistiigi/binfmt@sha256:...) for the strongest posture; the version tag
# below is immutable enough for CI and avoids a Docker Hub token dance in the workflow.
env:
BUILDX_VERSION: "0.35.0"
BUILDX_SHA256: "d41ece72044243b4f58b343441ae37446d9c29a7d6b5e11c61847bbcf8f7dfda"
BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.2.3"
TRIVY_VERSION: "0.71.0"
TRIVY_SHA256: "30a3d22b23f88c233f1658f562fb477cae3b3e8b4761109d515b7698daf85814"
jobs:
publish:
runs-on: docker
@@ -51,36 +77,70 @@ jobs:
id: vars
shell: bash
run: |
set -euo pipefail
SHA_SHORT="$(git rev-parse --short HEAD)"
FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
TAGS="-t ${FULL_IMAGE}:${SHA_SHORT}"
# the SHA tag is always built; it is also the target Trivy scans before any push
PUSH_TAGS="-t ${FULL_IMAGE}:${SHA_SHORT} -t ${FULL_IMAGE}:${{ inputs.floating_tag }}"
if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
VERSION="${{ gitea.ref_name }}"
VERSION="${VERSION#v}"
MAJOR="$(echo "$VERSION" | cut -d. -f1)"
MINOR="$(echo "$VERSION" | cut -d. -f1,2)"
TAGS="${TAGS} -t ${FULL_IMAGE}:latest -t ${FULL_IMAGE}:${VERSION} -t ${FULL_IMAGE}:${MINOR} -t ${FULL_IMAGE}:${MAJOR}"
PUSH_TAGS="${PUSH_TAGS} -t ${FULL_IMAGE}:latest -t ${FULL_IMAGE}:${VERSION} -t ${FULL_IMAGE}:${MINOR} -t ${FULL_IMAGE}:${MAJOR}"
fi
echo "docker_tags=${TAGS}" >> "$GITEA_OUTPUT"
echo "scan_ref=${FULL_IMAGE}:${SHA_SHORT}" >> "$GITEA_OUTPUT"
echo "push_tags=${PUSH_TAGS}" >> "$GITEA_OUTPUT"
echo "full_image=${FULL_IMAGE}" >> "$GITEA_OUTPUT"
- name: Docker Login
run: |
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ secrets.DOCKER_REGISTRY }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
- name: Build image
- name: Set up Docker Buildx and QEMU
shell: bash
env:
PLATFORMS: ${{ inputs.platforms }}
run: |
set -euo pipefail
# Ensure the buildx plugin. Baked into the runner image (PipelineImage); this fallback
# covers older runners, mirroring the Trivy fallback below. Pinned + checksum-verified.
if ! docker buildx version >/dev/null 2>&1; then
echo "=== buildx not in runner image, installing v${BUILDX_VERSION} ==="
mkdir -p /usr/libexec/docker/cli-plugins
curl -sSfLo /usr/libexec/docker/cli-plugins/docker-buildx \
"https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-amd64"
echo "${BUILDX_SHA256} /usr/libexec/docker/cli-plugins/docker-buildx" | sha256sum -c -
chmod +x /usr/libexec/docker/cli-plugins/docker-buildx
fi
docker buildx version
# Register QEMU so this amd64 runner can cross-build the non-native platforms. binfmt is
# a kernel concern, so it cannot live in the runner image and is installed here against
# the build daemon (needs --privileged).
if echo "${PLATFORMS}" | grep -q 'arm'; then
echo "=== Registering QEMU emulators (${BINFMT_IMAGE}) ==="
docker run --privileged --rm "${BINFMT_IMAGE}" --install arm64
fi
# A docker-container builder is required for multi-platform output (the default docker
# driver builds a single platform only). Idempotent across re-runs on a warm runner.
docker buildx inspect multiarch >/dev/null 2>&1 || \
docker buildx create --name multiarch --driver docker-container --bootstrap
docker buildx use multiarch
- name: Build image for vulnerability scan
if: ${{ inputs.run_image_scan }}
shell: bash
env:
PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
run: |
set -euo pipefail
SHA_SHORT="$(git rev-parse --short HEAD)"
FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
# optionally hand the private package index to the build as a BuildKit secret so the
# Dockerfile can install the in-house BB* packages without the token entering a layer
SECRET_ARGS=""
if [ "${{ inputs.use_private_index }}" = "true" ]; then
if [ -z "${PIP_EXTRA_INDEX_URL:-}" ]; then
@@ -90,28 +150,17 @@ jobs:
SECRET_ARGS="--secret id=pip_extra_index,env=PIP_EXTRA_INDEX_URL"
fi
DOCKER_BUILDKIT=1 docker build \
# native amd64 only, loaded into the local image store so Trivy can scan it before
# anything is pushed. The amd64 result is cached and reused by the multi-arch push.
# CVEs live in the base image and OS/Python packages, which are identical across arches,
# so scanning amd64 is a faithful gate for the whole manifest list.
DOCKER_BUILDKIT=1 docker buildx build \
--load \
--platform linux/amd64 \
${SECRET_ARGS} \
-t "${FULL_IMAGE}:${SHA_SHORT}" \
-t "${{ steps.vars.outputs.scan_ref }}" \
${{ inputs.dockerfile_path }}
# Floating tag points at the most recent build on any branch/tag, so
# the nightly image-security scan always has a stable target even
# before a release exists. ":latest" stays release-only (below).
docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${{ inputs.floating_tag }}"
if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
VERSION="${{ gitea.ref_name }}"
VERSION="${VERSION#v}"
MAJOR="$(echo "$VERSION" | cut -d. -f1)"
MINOR="$(echo "$VERSION" | cut -d. -f1,2)"
docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:latest"
docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${VERSION}"
docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${MINOR}"
docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${MAJOR}"
fi
- name: Image Vulnerability Scan
if: ${{ inputs.run_image_scan }}
shell: bash
@@ -122,8 +171,6 @@ jobs:
# checksum, never "latest": Trivy releases were compromised in the
# March 2026 supply-chain incident (malicious v0.69.4). Keep in sync
# with the ARGs in the PipelineImage Dockerfiles.
TRIVY_VERSION=0.71.0
TRIVY_SHA256=30a3d22b23f88c233f1658f562fb477cae3b3e8b4761109d515b7698daf85814
if ! command -v trivy >/dev/null 2>&1; then
echo "=== Trivy not in runner image, installing v${TRIVY_VERSION} ==="
curl -sSfLO "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
@@ -133,74 +180,49 @@ jobs:
fi
trivy --version
SHA_SHORT="$(git rev-parse --short HEAD)"
FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
echo "=== Scanning ${FULL_IMAGE}:${SHA_SHORT} (fail on fixable ${{ inputs.scan_severity }}) ==="
echo "=== Scanning ${{ steps.vars.outputs.scan_ref }} (fail on fixable ${{ inputs.scan_severity }}) ==="
trivy image \
--exit-code 1 \
--severity "${{ inputs.scan_severity }}" \
--ignore-unfixed \
--scanners vuln,secret \
"${FULL_IMAGE}:${SHA_SHORT}"
"${{ steps.vars.outputs.scan_ref }}"
- name: Push image
- name: Build and push multi-arch image
shell: bash
env:
PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
run: |
set -euxo pipefail
echo "=== Git / Ref Info ==="
git rev-parse HEAD
git rev-parse --short HEAD
echo "gitea.ref=${{ gitea.ref }}"
echo "gitea.ref_name=${{ gitea.ref_name }}"
echo "platforms=${{ inputs.platforms }}"
SHA_SHORT="$(git rev-parse --short HEAD)"
FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
SECRET_ARGS=""
if [ "${{ inputs.use_private_index }}" = "true" ]; then
if [ -z "${PIP_EXTRA_INDEX_URL:-}" ]; then
echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
exit 1
fi
SECRET_ARGS="--secret id=pip_extra_index,env=PIP_EXTRA_INDEX_URL"
fi
echo "=== Image Info ==="
echo "FULL_IMAGE=${FULL_IMAGE}"
echo "SHA_SHORT=${SHA_SHORT}"
echo "Expected image: ${FULL_IMAGE}:${SHA_SHORT}"
# one build produces every platform and pushes a manifest list per tag. The Trivy gate
# above already ran on the amd64 image these layers are reused from, so a scan failure
# aborts the job before this step. On a version tag this also pushes latest/major/minor.
DOCKER_BUILDKIT=1 docker buildx build \
--push \
--platform "${{ inputs.platforms }}" \
${SECRET_ARGS} \
${{ steps.vars.outputs.push_tags }} \
${{ inputs.dockerfile_path }}
echo "=== Local Docker Images ==="
docker images | grep "${{ inputs.image_name }}" || true
echo "=== Inspect Image ==="
docker image inspect "${FULL_IMAGE}:${SHA_SHORT}" >/dev/null
echo "=== Docker Auth Check ==="
docker info
echo "=== Push SHA tag ==="
docker push "${FULL_IMAGE}:${SHA_SHORT}"
echo "=== Push floating tag (${{ inputs.floating_tag }}) ==="
docker push "${FULL_IMAGE}:${{ inputs.floating_tag }}"
if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
echo "=== Version tag detected ==="
VERSION="${{ gitea.ref_name }}"
VERSION="${VERSION#v}"
MAJOR="$(echo "$VERSION" | cut -d. -f1)"
MINOR="$(echo "$VERSION" | cut -d. -f1,2)"
echo "VERSION=${VERSION}"
echo "MINOR=${MINOR}"
echo "MAJOR=${MAJOR}"
echo "=== Push latest ==="
docker push "${FULL_IMAGE}:latest"
echo "=== Push version ==="
docker push "${FULL_IMAGE}:${VERSION}"
echo "=== Push minor ==="
docker push "${FULL_IMAGE}:${MINOR}"
echo "=== Push major ==="
docker push "${FULL_IMAGE}:${MAJOR}"
else
echo "=== No version tag detected, only SHA tag pushed ==="
fi
- name: Verify pushed manifest
shell: bash
run: |
set -euo pipefail
# confirm the pushed tag really is a multi-arch manifest list
docker buildx imagetools inspect "${{ steps.vars.outputs.scan_ref }}"