Docker Images #38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker Images | |
| on: | |
| # Manual trigger: build dev images from any branch for K8s testing | |
| workflow_dispatch: | |
| # Automatic trigger: fires after the Release workflow completes a version tag | |
| workflow_run: | |
| workflows: ["Release"] | |
| types: | |
| - completed | |
| jobs: | |
| # -------------------------------------------------------------------------- | |
| # Determine context: dev (manual) vs release (automatic) | |
| # -------------------------------------------------------------------------- | |
| prepare: | |
| name: Determine build context | |
| runs-on: ubuntu-latest | |
| if: >- | |
| github.repository == 'SAP/astonish' && | |
| (github.event_name == 'workflow_dispatch' || | |
| (github.event.workflow_run.conclusion == 'success' && | |
| startsWith(github.event.workflow_run.head_branch, 'v'))) | |
| outputs: | |
| is_release: ${{ steps.ctx.outputs.is_release }} | |
| version_tag: ${{ steps.ctx.outputs.version_tag }} | |
| steps: | |
| - name: Determine context | |
| id: ctx | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| WORKFLOW_HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} | |
| run: | | |
| if [ "$EVENT_NAME" = "workflow_dispatch" ]; then | |
| echo "is_release=false" >> "$GITHUB_OUTPUT" | |
| echo "version_tag=dev" >> "$GITHUB_OUTPUT" | |
| else | |
| TAG="$WORKFLOW_HEAD_BRANCH" | |
| echo "is_release=true" >> "$GITHUB_OUTPUT" | |
| echo "version_tag=$TAG" >> "$GITHUB_OUTPUT" | |
| fi | |
| # -------------------------------------------------------------------------- | |
| # Build and push ghcr.io/sap/astonish (multi-arch) | |
| # Uses the multi-stage Dockerfile which handles cross-compilation internally | |
| # -------------------------------------------------------------------------- | |
| build-astonish: | |
| name: Build and push astonish | |
| runs-on: ubuntu-latest | |
| needs: prepare | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ needs.prepare.outputs.is_release == 'true' && needs.prepare.outputs.version_tag || github.ref }} | |
| # Build frontend natively on the runner (avoids slow/hanging Vite build under QEMU arm64) | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24' | |
| cache: 'npm' | |
| cache-dependency-path: web/package-lock.json | |
| - name: Build frontend | |
| run: | | |
| cd web | |
| npm ci | |
| npm run build | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: 'go.mod' | |
| - name: Cross-compile Linux binaries | |
| env: | |
| VERSION_TAG: ${{ needs.prepare.outputs.version_tag }} | |
| run: | | |
| touch web/embed.go | |
| LDFLAGS="-s -w -X github.com/SAP/astonish/cmd/astonish.Version=${VERSION_TAG}" | |
| echo "Building linux/amd64..." | |
| GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="$LDFLAGS" -o astonish-linux-amd64 . | |
| echo "Building linux/arm64..." | |
| GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -ldflags="$LDFLAGS" -o astonish-linux-arm64 . | |
| ls -la astonish-linux-* | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/sap/astonish | |
| tags: | | |
| type=raw,value=${{ needs.prepare.outputs.version_tag }} | |
| type=raw,value=latest,enable=${{ needs.prepare.outputs.is_release == 'true' }} | |
| - name: Build and push Docker image | |
| id: push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: docker/astonish/Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| VERSION=${{ needs.prepare.outputs.version_tag }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Generate artifact attestation | |
| uses: actions/attest-build-provenance@v1 | |
| with: | |
| subject-name: ghcr.io/sap/astonish | |
| subject-digest: ${{ steps.push.outputs.digest }} | |
| push-to-registry: true | |
| # -------------------------------------------------------------------------- | |
| # Build and push ghcr.io/sap/astonish-incus (multi-arch) | |
| # Cross-compiles Go binaries on the runner, then builds the Ubuntu-based image | |
| # -------------------------------------------------------------------------- | |
| build-incus: | |
| name: Build and push astonish-incus | |
| runs-on: ubuntu-latest | |
| needs: prepare | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ needs.prepare.outputs.is_release == 'true' && needs.prepare.outputs.version_tag || github.ref }} | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24' | |
| cache: 'npm' | |
| cache-dependency-path: web/package-lock.json | |
| - name: Build frontend | |
| run: | | |
| cd web | |
| npm ci | |
| npm run build | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: 'go.mod' | |
| - name: Cross-compile Linux binaries | |
| env: | |
| VERSION_TAG: ${{ needs.prepare.outputs.version_tag }} | |
| run: | | |
| touch web/embed.go | |
| LDFLAGS="-s -w -X github.com/SAP/astonish/cmd/astonish.Version=${VERSION_TAG}" | |
| echo "Building linux/amd64..." | |
| GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="$LDFLAGS" -o astonish-linux-amd64 . | |
| echo "Building linux/arm64..." | |
| GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -ldflags="$LDFLAGS" -o astonish-linux-arm64 . | |
| ls -la astonish-linux-* | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/sap/astonish-incus | |
| tags: | | |
| type=raw,value=${{ needs.prepare.outputs.version_tag }} | |
| type=raw,value=latest,enable=${{ needs.prepare.outputs.is_release == 'true' }} | |
| - name: Build and push Docker image | |
| id: push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: docker/incus/Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Generate artifact attestation | |
| uses: actions/attest-build-provenance@v1 | |
| with: | |
| subject-name: ghcr.io/sap/astonish-incus | |
| subject-digest: ${{ steps.push.outputs.digest }} | |
| push-to-registry: true | |
| # -------------------------------------------------------------------------- | |
| # Build and push ghcr.io/sap/astonish-sandbox-base (multi-arch) | |
| # Uses the multi-stage docker/sandbox-base/Dockerfile which compiles the | |
| # entrypoint script generator and astonish binary internally, then produces | |
| # a minimal Debian-slim runtime image with fuse-overlayfs. | |
| # -------------------------------------------------------------------------- | |
| build-sandbox-base: | |
| name: Build and push astonish-sandbox-base | |
| runs-on: ubuntu-latest | |
| needs: prepare | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ needs.prepare.outputs.is_release == 'true' && needs.prepare.outputs.version_tag || github.ref }} | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24' | |
| cache: 'npm' | |
| cache-dependency-path: web/package-lock.json | |
| - name: Build frontend | |
| run: | | |
| cd web | |
| npm ci | |
| npm run build | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/sap/astonish-sandbox-base | |
| tags: | | |
| type=raw,value=${{ needs.prepare.outputs.version_tag }} | |
| type=raw,value=latest,enable=${{ needs.prepare.outputs.is_release == 'true' }} | |
| - name: Build and push Docker image | |
| id: push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: docker/sandbox-base/Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Generate artifact attestation | |
| uses: actions/attest-build-provenance@v1 | |
| with: | |
| subject-name: ghcr.io/sap/astonish-sandbox-base | |
| subject-digest: ${{ steps.push.outputs.digest }} | |
| push-to-registry: true | |
| # -------------------------------------------------------------------------- | |
| # Build and push ghcr.io/sap/astonish-sandbox-openshell (amd64 only) | |
| # Full-featured sandbox for NVIDIA OpenShell backend: CloakBrowser, KasmVNC, | |
| # dev tools. Based on ghcr.io/nvidia/openshell-community/sandboxes/base which | |
| # is amd64-only. | |
| # -------------------------------------------------------------------------- | |
| build-sandbox-openshell: | |
| name: Build and push astonish-sandbox-openshell | |
| runs-on: ubuntu-latest | |
| needs: prepare | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ needs.prepare.outputs.is_release == 'true' && needs.prepare.outputs.version_tag || github.ref }} | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24' | |
| cache: 'npm' | |
| cache-dependency-path: web/package-lock.json | |
| - name: Build frontend | |
| run: | | |
| cd web | |
| npm ci | |
| npm run build | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: 'go.mod' | |
| - name: Cross-compile Linux binaries | |
| env: | |
| VERSION_TAG: ${{ needs.prepare.outputs.version_tag }} | |
| run: | | |
| touch web/embed.go | |
| LDFLAGS="-s -w -X github.com/SAP/astonish/cmd/astonish.Version=${VERSION_TAG}" | |
| echo "Building linux/amd64..." | |
| GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="$LDFLAGS" -o astonish-linux-amd64 . | |
| ls -la astonish-linux-* | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/sap/astonish-sandbox-openshell | |
| tags: | | |
| type=raw,value=${{ needs.prepare.outputs.version_tag }} | |
| type=raw,value=latest,enable=${{ needs.prepare.outputs.is_release == 'true' }} | |
| - name: Build and push Docker image | |
| id: push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: docker/sandbox-openshell/Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Generate artifact attestation | |
| uses: actions/attest-build-provenance@v1 | |
| with: | |
| subject-name: ghcr.io/sap/astonish-sandbox-openshell | |
| subject-digest: ${{ steps.push.outputs.digest }} | |
| push-to-registry: true |