mirror of
https://github.com/Homebrew/brew.git
synced 2026-08-12 22:29:27 +04:00
451 lines
17 KiB
YAML
451 lines
17 KiB
YAML
name: Docker
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches:
|
|
- main
|
|
merge_group:
|
|
release:
|
|
types:
|
|
- published
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash -xeuo pipefail {0}
|
|
|
|
env:
|
|
# odeprecated: remove 22.04 image in Homebrew >=6.1
|
|
VERSIONS: '["22.04", "24.04", "26.04"]'
|
|
|
|
jobs:
|
|
generate-tags:
|
|
if: github.repository_owner == 'Homebrew'
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
matrix: ${{ steps.attributes.outputs.matrix }}
|
|
tags: ${{ steps.attributes.outputs.tags }}
|
|
labels: ${{ steps.attributes.outputs.labels }}
|
|
push: ${{ steps.attributes.outputs.push }}
|
|
merge: ${{ steps.attributes.outputs.merge }}
|
|
core_revision: ${{ steps.attributes.outputs.core_revision }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Fetch origin/HEAD from Git
|
|
run: git fetch origin HEAD
|
|
|
|
- name: Determine build attributes
|
|
id: attributes
|
|
run: |
|
|
date="$(date --rfc-3339=seconds --utc)"
|
|
brew_version="$(git describe --tags --dirty --abbrev=7)"
|
|
core_revision="$(git ls-remote https://github.com/Homebrew/homebrew-core refs/heads/main | cut -f1)"
|
|
|
|
DELIMITER="END_LABELS_$(uuidgen)"
|
|
cat <<EOS | tee -a "${GITHUB_OUTPUT}"
|
|
labels<<${DELIMITER}
|
|
org.opencontainers.image.created=${date}
|
|
org.opencontainers.image.url=https://brew.sh
|
|
org.opencontainers.image.documentation=https://docs.brew.sh
|
|
org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}
|
|
org.opencontainers.image.version=${brew_version}
|
|
org.opencontainers.image.revision=${GITHUB_SHA}
|
|
org.opencontainers.image.vendor=${GITHUB_REPOSITORY_OWNER}
|
|
org.opencontainers.image.licenses=BSD-2-Clause
|
|
${DELIMITER}
|
|
EOS
|
|
|
|
typeset -A tag_hash
|
|
typeset -A push_hash
|
|
matrix=()
|
|
merge=false
|
|
while IFS=$'\n' read -r version; do
|
|
tags=()
|
|
if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
|
|
tags+=(
|
|
"ghcr.io/homebrew/ubuntu${version}:${brew_version}"
|
|
"ghcr.io/homebrew/ubuntu${version}:latest"
|
|
)
|
|
if [[ "${version}" == "24.04" ]]; then
|
|
tags+=(
|
|
"ghcr.io/homebrew/brew:${brew_version}"
|
|
"ghcr.io/homebrew/brew:latest"
|
|
)
|
|
fi
|
|
elif [[ "${GITHUB_EVENT_NAME}" == "push" &&
|
|
("${GITHUB_REF}" == "refs/heads/main") ]]; then
|
|
if [[ "${version}" == "24.04" ]]; then
|
|
tags+=("ghcr.io/homebrew/brew:main")
|
|
fi
|
|
tags+=("ghcr.io/homebrew/ubuntu${version}:main")
|
|
fi
|
|
|
|
if [[ "${#tags[@]}" -ne 0 ]]; then
|
|
tags_as_json_array="$(
|
|
jq --null-input --compact-output '$ARGS.positional' --args "${tags[@]}"
|
|
)"
|
|
tag_hash["${version}"]="${tags_as_json_array}"
|
|
push_hash["${version}"]=true
|
|
merge=true
|
|
matrix+=("${version}")
|
|
else
|
|
push_hash["${version}"]=false
|
|
fi
|
|
done <<<"$(jq --raw-output '.[]' <<<"${VERSIONS}")"
|
|
|
|
{
|
|
# Transform the `matrix` variable into a JSON array.
|
|
echo "matrix=$(jq --null-input --compact-output '$ARGS.positional' --args "${matrix[@]}")"
|
|
echo "merge=${merge}"
|
|
echo "core_revision=${core_revision}"
|
|
} >>"${GITHUB_OUTPUT}"
|
|
|
|
{
|
|
DELIMITER="END_TAGS_$(uuidgen)"
|
|
has_previous=
|
|
echo "tags<<${DELIMITER}"
|
|
printf '{'
|
|
for version in "${!tag_hash[@]}"; do
|
|
[[ -n "${has_previous:-}" ]] && printf ','
|
|
printf '"%s": %s' "${version}" "${tag_hash[$version]}"
|
|
has_previous=1
|
|
done
|
|
echo '}'
|
|
echo "${DELIMITER}"
|
|
} | tee -a "${GITHUB_OUTPUT}"
|
|
|
|
{
|
|
DELIMITER="END_PUSH_$(uuidgen)"
|
|
has_previous=
|
|
echo "push<<${DELIMITER}"
|
|
printf '{'
|
|
for version in "${!push_hash[@]}"; do
|
|
[[ -n "${has_previous:-}" ]] && printf ','
|
|
printf '"%s": %s' "${version}" "${push_hash[$version]}"
|
|
has_previous=1
|
|
done
|
|
echo '}'
|
|
echo "${DELIMITER}"
|
|
} | tee -a "${GITHUB_OUTPUT}"
|
|
|
|
build:
|
|
needs: generate-tags
|
|
if: github.repository_owner == 'Homebrew'
|
|
name: docker (${{ matrix.arch }} Ubuntu ${{ matrix.version }})
|
|
runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
# odeprecated: remove 22.04 image in Homebrew >=6.1
|
|
version: ["22.04", "24.04", "26.04"]
|
|
arch: ["x86_64", "arm64"]
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Fetch origin/HEAD from Git
|
|
run: git fetch origin HEAD
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
|
|
with:
|
|
cache-binary: false
|
|
|
|
- name: Retrieve build attributes
|
|
id: attributes
|
|
env:
|
|
VERSION: ${{ matrix.version }}
|
|
PUSH: ${{ needs.generate-tags.outputs.push }}
|
|
run: |
|
|
# odeprecated: remove 22.04 image in Homebrew >=6.1
|
|
if [[ "${VERSION}" == "22.04" ]]; then
|
|
echo "The homebrew/ubuntu22.04 image is deprecated and will be retired in Homebrew 6.1. Use homebrew/brew." > .docker-deprecate
|
|
fi
|
|
|
|
filter="$(printf '.["%s"]' "${VERSION}")"
|
|
echo "push=$(jq --raw-output "${filter}" <<<"${PUSH}")" >>"${GITHUB_OUTPUT}"
|
|
|
|
- name: Log in to GitHub Packages (github-actions[bot])
|
|
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: github-actions[bot]
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build Docker image
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
|
with:
|
|
context: .
|
|
load: true
|
|
tags: brew
|
|
cache-from: type=registry,ref=ghcr.io/homebrew/ubuntu${{ matrix.version }}:cache-${{ matrix.arch }}
|
|
build-args: |
|
|
version=${{ matrix.version }}
|
|
HOMEBREW_CORE_REVISION=${{ needs.generate-tags.outputs.core_revision }}
|
|
labels: ${{ needs.generate-tags.outputs.labels }}
|
|
|
|
- name: Set environment variables
|
|
if: matrix.version == '22.04'
|
|
# odeprecated: remove 22.04 in Homebrew >=6.1
|
|
run: echo "HOMEBREW_GLIBC_TESTING=1" >> "$GITHUB_ENV"
|
|
|
|
- name: Run brew test-bot --only-setup
|
|
run: docker run --env HOMEBREW_GLIBC_TESTING --rm brew brew test-bot --only-setup
|
|
|
|
- name: Log in to GitHub Packages (BrewTestBot)
|
|
if: fromJSON(steps.attributes.outputs.push)
|
|
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: BrewTestBot
|
|
password: ${{ secrets.HOMEBREW_BREW_GITHUB_PACKAGES_TOKEN }}
|
|
|
|
- name: Deploy the Docker image by digest
|
|
id: digest
|
|
if: fromJSON(steps.attributes.outputs.push)
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
|
with:
|
|
context: .
|
|
cache-from: type=registry,ref=ghcr.io/homebrew/ubuntu${{ matrix.version }}:cache-${{ matrix.arch }}
|
|
cache-to: type=registry,ref=ghcr.io/homebrew/ubuntu${{ matrix.version }}:cache-${{ matrix.arch }},mode=max
|
|
build-args: |
|
|
version=${{ matrix.version }}
|
|
HOMEBREW_CORE_REVISION=${{ needs.generate-tags.outputs.core_revision }}
|
|
labels: ${{ needs.generate-tags.outputs.labels }}
|
|
outputs: type=image,name=ghcr.io/homebrew/ubuntu${{ matrix.version }},name-canonical=true,push=true,push-by-digest=true
|
|
|
|
- name: Export the Docker image digest
|
|
run: |
|
|
mkdir -p "${RUNNER_TEMP}"/digests
|
|
echo "${DIGEST#sha256:}" >"${RUNNER_TEMP}/digests/${VERSION}-${ARCH}"
|
|
env:
|
|
DIGEST: ${{ steps.digest.outputs.digest }}
|
|
VERSION: ${{ matrix.version }}
|
|
ARCH: ${{ matrix.arch }}
|
|
|
|
- name: Upload the Docker image digest
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: digest-${{ matrix.version }}-${{ matrix.arch }}
|
|
path: ${{ runner.temp }}/digests/*
|
|
|
|
- name: Export base image for long runner
|
|
if: matrix.version == '24.04'
|
|
run: |
|
|
mkdir -p "${RUNNER_TEMP}/long-runner-base"
|
|
image_name="long-runner-base:${VERSION}-${ARCH}"
|
|
docker tag brew "${image_name}"
|
|
docker save "${image_name}" | gzip >"${RUNNER_TEMP}/long-runner-base/image-${VERSION}-${ARCH}.tar.gz"
|
|
env:
|
|
VERSION: ${{ matrix.version }}
|
|
ARCH: ${{ matrix.arch }}
|
|
DIGEST: ${{ steps.digest.outputs.digest }}
|
|
|
|
- name: Upload base image artifact for long runner
|
|
if: matrix.version == '24.04'
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: long-runner-base-24.04-${{ matrix.arch }}
|
|
path: ${{ runner.temp }}/long-runner-base/*
|
|
|
|
merge:
|
|
needs: [generate-tags, build]
|
|
if: github.repository_owner == 'Homebrew' && fromJSON(needs.generate-tags.outputs.merge)
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
version: ${{ fromJSON(needs.generate-tags.outputs.matrix) }}
|
|
steps:
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
|
|
with:
|
|
cache-binary: false
|
|
|
|
- name: Download Docker image digests
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
path: ${{ runner.temp }}/digests
|
|
pattern: digest-${{ matrix.version }}-*
|
|
merge-multiple: true
|
|
|
|
- name: Log in to GitHub Packages (BrewTestBot)
|
|
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: BrewTestBot
|
|
password: ${{ secrets.HOMEBREW_BREW_GITHUB_PACKAGES_TOKEN }}
|
|
|
|
- name: Merge and push Docker image
|
|
env:
|
|
TAGS: ${{ needs.generate-tags.outputs.tags }}
|
|
VERSION: ${{ matrix.version }}
|
|
run: |
|
|
filter="$(printf '.["%s"].[]' "${VERSION}")"
|
|
tag_args=()
|
|
while IFS=$'\n' read -r tag; do
|
|
[[ -n "${tag}" ]] || continue
|
|
tag_args+=("--tag=${tag}")
|
|
done <<<"$(jq --raw-output "${filter}" <<<"${TAGS}")"
|
|
|
|
image_args=("ghcr.io/homebrew/ubuntu${VERSION}@sha256:$(<"${RUNNER_TEMP}/digests/${VERSION}-x86_64")")
|
|
image_args+=("ghcr.io/homebrew/ubuntu${VERSION}@sha256:$(<"${RUNNER_TEMP}/digests/${VERSION}-arm64")")
|
|
|
|
attempts=0
|
|
until docker buildx imagetools create "${tag_args[@]}" "${image_args[@]}"; do
|
|
attempts=$((attempts + 1))
|
|
if [[ $attempts -ge 3 ]]; then
|
|
echo "[$(date -u)] ERROR: Failed after 3 attempts." >&2
|
|
exit 1
|
|
fi
|
|
delay=$((2 ** attempts))
|
|
if [[ $delay -gt 15 ]]; then delay=15; fi
|
|
echo "Push failed (attempt $attempts). Retrying in ${delay} seconds..."
|
|
sleep ${delay}
|
|
done
|
|
|
|
build-and-publish-long-runner:
|
|
name: Build runner Docker image (${{ matrix.platform }})
|
|
needs: [generate-tags, build]
|
|
if: github.repository_owner == 'Homebrew'
|
|
runs-on: ${{ matrix.runner }}
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
platform:
|
|
- linux/amd64
|
|
- linux/arm64
|
|
include:
|
|
- platform: linux/amd64
|
|
platform_tag: linux-amd64
|
|
arch: x86_64
|
|
runner: ubuntu-24.04
|
|
- platform: linux/arm64
|
|
platform_tag: linux-arm64
|
|
arch: arm64
|
|
runner: ubuntu-24.04-arm
|
|
steps:
|
|
- env:
|
|
IMAGE_VALUE: ghcr.io/${{ github.repository_owner }}/runner
|
|
run: echo "IMAGE=${IMAGE_VALUE,,}" >> "$GITHUB_ENV"
|
|
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Retrieve build attributes
|
|
id: attributes
|
|
env:
|
|
VERSION: 24.04
|
|
PUSH: ${{ needs.generate-tags.outputs.push }}
|
|
run: |
|
|
filter="$(printf '.["%s"]' "${VERSION}")"
|
|
echo "push=$(jq --raw-output "${filter}" <<<"${PUSH}")" >>"${GITHUB_OUTPUT}"
|
|
|
|
- name: Download long runner base image artifacts
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: long-runner-base-24.04-${{ matrix.arch }}
|
|
path: ${{ runner.temp }}/long-runner-base
|
|
|
|
- name: Load long runner base image
|
|
id: base_image
|
|
run: |
|
|
artifact_dir="${{ runner.temp }}/long-runner-base"
|
|
image_archive="${artifact_dir}/image-24.04-${ARCH}.tar.gz"
|
|
[[ -f "${image_archive}" ]] || {
|
|
echo "Missing brew image archive: ${image_archive}" >&2
|
|
exit 1
|
|
}
|
|
base_image="long-runner-base:24.04-${ARCH}"
|
|
gunzip --stdout "${image_archive}" | docker load
|
|
docker image inspect "${base_image}" >/dev/null
|
|
echo "image=${base_image}" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
ARCH: ${{ matrix.arch }}
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
|
|
with:
|
|
# Use the local Docker daemon so Buildx can resolve
|
|
# the base image loaded from the artifact tarball.
|
|
driver: docker
|
|
|
|
- name: Build ${{ matrix.platform }} runner Docker image
|
|
id: runner_build
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
|
with:
|
|
context: .
|
|
file: .github/scripts/Dockerfile.long_runner
|
|
platforms: ${{ matrix.platform }}
|
|
build-args: HOMEBREW_BREW_IMAGE=${{ steps.base_image.outputs.image }}
|
|
tags: runner:build-${{ matrix.platform_tag }}
|
|
|
|
- name: Verify AWS deployment secrets
|
|
if: fromJSON(steps.attributes.outputs.push)
|
|
shell: bash
|
|
env:
|
|
AWS_PROJECT_ID: ${{ secrets.AWS_PROJECT_ID }}
|
|
run: |
|
|
missing=()
|
|
[ -z "$AWS_PROJECT_ID" ] && missing+=("AWS_PROJECT_ID")
|
|
if [ "${#missing[@]}" -ne 0 ]; then
|
|
printf 'Missing required deployment secrets: %s\n' "${missing[*]}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Configure AWS Credentials
|
|
if: fromJSON(steps.attributes.outputs.push)
|
|
id: aws_registry_credentials
|
|
uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
|
|
with:
|
|
role-to-assume: arn:aws:iam::${{ secrets.AWS_PROJECT_ID }}:role/GithubActionsRoleECRPushBrew
|
|
aws-region: us-east-1
|
|
|
|
- name: AWS Elastic Container Registry Login
|
|
if: fromJSON(steps.attributes.outputs.push)
|
|
id: aws_registry_login
|
|
uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
|
|
|
|
- name: Generate AWS image name
|
|
id: aws_image
|
|
env:
|
|
AWS_REGISTRY: ${{ steps.aws_registry_login.outputs.registry }}
|
|
LONG_RUNNER_IMAGE_DIGEST: ${{ steps.runner_build.outputs.digest }}
|
|
run: |
|
|
digest_without_prefix="${LONG_RUNNER_IMAGE_DIGEST#sha256:}"
|
|
[[ -n "${digest_without_prefix}" ]] || {
|
|
echo "Missing long runner image digest from build output" >&2
|
|
exit 1
|
|
}
|
|
echo "image=${AWS_REGISTRY}/runner-ecr:${digest_without_prefix}-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
|
|
echo "image_latest=${AWS_REGISTRY}/runner-ecr:latest" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Push image to AWS Elastic Container Registry
|
|
if: fromJSON(steps.attributes.outputs.push)
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
|
with:
|
|
context: .
|
|
file: .github/scripts/Dockerfile.long_runner
|
|
platforms: ${{ matrix.platform }}
|
|
build-args: HOMEBREW_BREW_IMAGE=${{ steps.base_image.outputs.image }}
|
|
push: true
|
|
tags: |
|
|
${{ steps.aws_image.outputs.image }}
|
|
${{ steps.aws_image.outputs.image_latest }}
|