mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 05:26:47 +00:00
Maurice
f513881c01
The manifest list was assembled from a glob over the downloaded digest files, which are named after the digest itself. The order was therefore alphabetical by hash, and it changed from one release to the next: 3.4.1 lists amd64 first, 4.0.0 lists arm64 first. That is not supposed to matter — a client is meant to pick the entry matching its own platform — but several people updating from 3.4.1 to 4.0.0 on amd64 reported that `:latest` still resolved to 3.4.1 and only a pinned `:4` or `:4.0.0` pulled the new image. Unraid came up twice. Content, format and digest of the three tags are identical, so the flipped order is the only thing that changed between the release that worked and the one that did not. The digests are now collected per platform in a fixed order, amd64 first. That needs the artifacts unmerged, since the per-platform folder name is the only thing that says which digest belongs to which architecture. Second thing the loop fixes: the glob happily built a single-platform manifest if one of the two builds had failed to upload. It now fails loudly instead of publishing a `:latest` that half the users cannot pull.
234 lines
8.1 KiB
YAML
234 lines
8.1 KiB
YAML
name: Build & Push Docker Image
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
bump:
|
|
description: 'Force bump line (auto = patch/finalize as today)'
|
|
type: choice
|
|
options: [auto, patch, minor, major]
|
|
default: auto
|
|
confirm_major:
|
|
description: "Type MAJOR (all caps) to confirm a major release"
|
|
type: string
|
|
default: ''
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: stable-build
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
version-bump:
|
|
if: github.repository == 'liketrek/TREK'
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
version: ${{ steps.bump.outputs.VERSION }}
|
|
steps:
|
|
- uses: actions/create-github-app-token@v1
|
|
id: app-token
|
|
with:
|
|
app-id: ${{ secrets.RELEASE_APP_ID }}
|
|
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
|
|
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
token: ${{ steps.app-token.outputs.token }}
|
|
|
|
- name: Determine bump type and update version
|
|
id: bump
|
|
run: |
|
|
git fetch --tags
|
|
|
|
# Derive version from git tags — no package.json dependency
|
|
STABLE_TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' | grep -v '\-pre\.' | sort -V | tail -1)
|
|
STABLE="${STABLE_TAG#v}"
|
|
STABLE="${STABLE:-0.0.0}"
|
|
|
|
PRE_TAG=$(git tag -l 'v*-pre.*' | sort -V | tail -1)
|
|
|
|
BUMP_INPUT="${{ github.event.inputs.bump || 'auto' }}"
|
|
IFS='.' read -r MAJOR MINOR PATCH <<< "$STABLE"
|
|
|
|
if [ "$BUMP_INPUT" = "major" ]; then
|
|
if [ "${{ github.event.inputs.confirm_major }}" != "MAJOR" ]; then
|
|
echo "::error::confirm_major must equal 'MAJOR' to cut a major release"
|
|
exit 1
|
|
fi
|
|
NEW_VERSION="$((MAJOR + 1)).0.0"
|
|
BUMP="major"
|
|
elif [ "$BUMP_INPUT" = "minor" ]; then
|
|
NEW_VERSION="${MAJOR}.$((MINOR + 1)).0"
|
|
BUMP="minor"
|
|
elif [ "$BUMP_INPUT" = "patch" ]; then
|
|
NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
|
|
BUMP="patch"
|
|
else
|
|
# auto: finalize in-flight prerelease if one exists, else patch
|
|
if [ -n "$PRE_TAG" ]; then
|
|
PRE_BASE="${PRE_TAG#v}"
|
|
PRE_BASE="${PRE_BASE%-pre.*}"
|
|
PRE_MAJOR="$(echo "$PRE_BASE" | cut -d. -f1)"
|
|
# Refuse to auto-finalize a major bump — it bypasses confirm_major
|
|
if [ "$PRE_MAJOR" -gt "$MAJOR" ]; then
|
|
echo "::error::In-flight prerelease $PRE_TAG is a major bump ($STABLE → $PRE_BASE). Use bump=major with confirm_major=MAJOR to finalize."
|
|
exit 1
|
|
fi
|
|
# If prerelease base is strictly greater than stable, finalize it
|
|
HIGHEST=$(printf '%s\n' "$PRE_BASE" "$STABLE" | sort -V | tail -1)
|
|
if [ "$HIGHEST" = "$PRE_BASE" ] && [ "$PRE_BASE" != "$STABLE" ]; then
|
|
NEW_VERSION="$PRE_BASE"
|
|
BUMP="finalize"
|
|
else
|
|
PATCH=$((PATCH + 1))
|
|
NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
|
|
BUMP="patch"
|
|
fi
|
|
else
|
|
PATCH=$((PATCH + 1))
|
|
NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
|
|
BUMP="patch"
|
|
fi
|
|
fi
|
|
|
|
echo "Bump type: $BUMP"
|
|
echo "VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT
|
|
echo "$STABLE → $NEW_VERSION ($BUMP)"
|
|
|
|
# Update all workspace + root package.json files and the root lockfile in one shot
|
|
npm version "$NEW_VERSION" --workspaces --include-workspace-root --no-git-tag-version
|
|
sed -i "s/^version: .*/version: $NEW_VERSION/" charts/trek/Chart.yaml
|
|
sed -i "s/^appVersion: .*/appVersion: \"$NEW_VERSION\"/" charts/trek/Chart.yaml
|
|
|
|
# Commit and tag
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
git add package.json package-lock.json server/package.json client/package.json shared/package.json charts/trek/Chart.yaml
|
|
git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
|
|
git tag -a "v$NEW_VERSION" -m "v$NEW_VERSION"
|
|
git push origin main --follow-tags
|
|
|
|
build:
|
|
runs-on: ${{ matrix.runner }}
|
|
needs: version-bump
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- platform: linux/amd64
|
|
runner: ubuntu-latest
|
|
- platform: linux/arm64
|
|
runner: ubuntu-24.04-arm
|
|
steps:
|
|
- name: Prepare platform tag-safe name
|
|
run: echo "PLATFORM_PAIR=$(echo ${{ matrix.platform }} | sed 's|/|-|g')" >> $GITHUB_ENV
|
|
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: main
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Build and push by digest
|
|
id: build
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: ${{ matrix.platform }}
|
|
outputs: type=image,name=mauriceboe/trek,push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: true
|
|
build-args: |
|
|
APP_VERSION=${{ needs.version-bump.outputs.version }}
|
|
|
|
- name: Export digest
|
|
run: |
|
|
mkdir -p /tmp/digests
|
|
digest="${{ steps.build.outputs.digest }}"
|
|
touch "/tmp/digests/${digest#sha256:}"
|
|
|
|
- name: Upload digest artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: digests-${{ env.PLATFORM_PAIR }}
|
|
path: /tmp/digests/*
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
merge:
|
|
runs-on: ubuntu-latest
|
|
needs: [version-bump, build]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: main
|
|
|
|
- name: Download build digests
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
path: /tmp/digests
|
|
pattern: digests-*
|
|
# Deliberately NOT merged: the per-platform folder names are what lets
|
|
# the manifest below be assembled in a fixed order.
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Create and push multi-arch manifest
|
|
working-directory: /tmp/digests
|
|
run: |
|
|
set -euo pipefail
|
|
VERSION="${{ needs.version-bump.outputs.version }}"
|
|
MAJOR_TAG="$(echo "$VERSION" | cut -d. -f1)"
|
|
# amd64 first, always. This used to be a glob over hash-named files, so
|
|
# the order changed from one release to the next: 3.4.1 listed amd64
|
|
# first and 4.0.0 listed arm64 first. Clients that read the first entry
|
|
# of the index rather than matching their own platform then compare the
|
|
# wrong digest and report "no update" — which is what Unraid users hit
|
|
# on :latest after 4.0.0 shipped. The image was fine; the order was not.
|
|
digests=()
|
|
for platform in linux-amd64 linux-arm64; do
|
|
dir="digests-$platform"
|
|
[ -d "$dir" ] || { echo "::error::missing digest artifact for $platform"; exit 1; }
|
|
for f in "$dir"/*; do
|
|
[ -e "$f" ] || { echo "::error::no digest file in $dir"; exit 1; }
|
|
digests+=("mauriceboe/trek@sha256:$(basename "$f")")
|
|
done
|
|
done
|
|
docker buildx imagetools create \
|
|
-t "mauriceboe/trek:latest" \
|
|
-t "mauriceboe/trek:$MAJOR_TAG" \
|
|
-t "mauriceboe/trek:$VERSION" \
|
|
"${digests[@]}"
|
|
|
|
- name: Inspect manifest
|
|
run: docker buildx imagetools inspect mauriceboe/trek:latest
|
|
|
|
release-helm:
|
|
runs-on: ubuntu-latest
|
|
needs: version-bump
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: main
|
|
|
|
- name: Publish Helm chart
|
|
uses: stefanprodan/helm-gh-pages@v1.7.0
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
charts_dir: charts
|
|
charts_url: https://chart.liketrek.com
|