Readable job names, latest tracks main, and an AGENTS.md
Job names in the Gitea UI rendered as the raw matrix expression
("${{ fromJSON(needs.select.outputs.images) }}"). Gitea resolves a job's matrix
when it PARSES the workflow, before `needs` outputs exist, so matrix.image was
interpolated against an unresolved matrix. There is no way to win with a dynamic
matrix: jobparser.nameWithMatrix interpolates a name containing "${{ }}", and
appends "(<values>)" to one that doesn't — either way the raw expression shows.
See go-gitea/gitea#28207.
So drop the matrix. build.yaml now runs one job, "Build changed images", that
loops over the selected images and emits ::group:: markers, giving a collapsible
section per image. Also: every step has an explicit static name, because Gitea
does not interpolate expressions in names either ("Log in to ${{ env.REGISTRY }}"
rendered literally).
Tag scheme, per review: `latest` now tracks main rather than the newest release,
and `edge` is gone — it's an Alpine/Traefik convention, not a broad standard, and
`main-<sha>` already covers "a specific commit". `latest` has exactly one owner
so a release tag and a main build can't race to define it. Release tags remain
immutable `:vX.Y.Z`/`:vX.Y`/`:vX` for pinning. This also means the ToolHive
manifest's `:latest` resolves as soon as this lands on main, with no release tag
needed first.
hack/docker-tags.sh folded into hack/build-images.sh, which is now the whole
pipeline — tag, build, smoke-test, push — shared by `make build` and CI. It uses
plain `docker build` instead of buildx, dropping setup-buildx-action: it loads
into the local store so the test runs pre-publish, and emits a plain manifest
with no attestations for Gitea's registry.
Verified in a simulated runner (repo in a docker volume, socket mounted, real
runner image): select + build + group markers, all four tag modes, and the
multi-image loop with a scratch second image.
AGENTS.md records the conventions and, importantly, the three Gitea gotchas that
all look fine locally: no bind-mounting the workspace into a sibling container,
no dynamic matrix, no expressions in names.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
Claude Opus 5
Executable
+121
@@ -0,0 +1,121 @@
|
||||
#!/usr/bin/env bash
|
||||
# Build, smoke-test and — in CI, on a publishing ref — push images.
|
||||
#
|
||||
# Usage: build-images.sh <image>...
|
||||
#
|
||||
# How an image gets tagged is a property of the git ref, not of the image, so one
|
||||
# run treats every image it builds the same way:
|
||||
#
|
||||
# tag <image>/vX.Y.Z -> :vX.Y.Z :vX.Y :vX published release
|
||||
# push to main -> :latest :main-<sha> latest tracks main
|
||||
# pull request -> :pr-<n> built, never pushed
|
||||
# anywhere else -> :dev built, never pushed (local default)
|
||||
#
|
||||
# `latest` has exactly one owner (main), so a release tag and a main build can never
|
||||
# race to define it.
|
||||
#
|
||||
# Uses plain `docker build` rather than buildx with a container driver: it loads
|
||||
# straight into the local image store so the smoke test can run before anything is
|
||||
# published, and it produces a plain manifest with no attestations, which Gitea's
|
||||
# registry rejects.
|
||||
set -euo pipefail
|
||||
cd "$(dirname "$0")/.."
|
||||
|
||||
REGISTRY=${REGISTRY:-gitea.libretechconsulting.com}
|
||||
NAMESPACE=${NAMESPACE:-rmcguire}
|
||||
|
||||
[ $# -gt 0 ] || {
|
||||
echo "usage: ${0##*/} <image>..." >&2
|
||||
exit 2
|
||||
}
|
||||
|
||||
sha=$(git rev-parse --short=7 HEAD)
|
||||
revision=$(git rev-parse HEAD)
|
||||
created=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||||
|
||||
push=false
|
||||
if [ "${GITHUB_REF_TYPE:-}" = tag ]; then
|
||||
mode="release"
|
||||
version=${GITHUB_REF_NAME##*/}
|
||||
[[ $version =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
|
||||
echo "tag '${GITHUB_REF_NAME}' is not of the form <image>/vX.Y.Z" >&2
|
||||
exit 1
|
||||
}
|
||||
push=true
|
||||
elif [ "${GITHUB_EVENT_NAME:-}" = pull_request ]; then
|
||||
mode="pr"
|
||||
version="pr-${PR_NUMBER:-0}"
|
||||
elif [ "${GITHUB_REF_NAME:-}" = main ]; then
|
||||
mode="main"
|
||||
version="main-$sha"
|
||||
push=true
|
||||
else
|
||||
mode="local"
|
||||
version=dev
|
||||
fi
|
||||
|
||||
tags_for() {
|
||||
local repo="$REGISTRY/$NAMESPACE/$1" n
|
||||
case $mode in
|
||||
release)
|
||||
n=${version#v}
|
||||
printf '%s\n' "$repo:$version" "$repo:v${n%.*}" "$repo:v${n%%.*}"
|
||||
;;
|
||||
main) printf '%s\n' "$repo:latest" "$repo:$version" ;;
|
||||
*) printf '%s\n' "$repo:$version" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Collapsible sections in the Actions log; plain headers when run locally.
|
||||
group() {
|
||||
if [ -n "${GITHUB_ACTIONS:-}" ]; then
|
||||
echo "::group::$*"
|
||||
else
|
||||
echo "==> $*"
|
||||
fi
|
||||
}
|
||||
endgroup() {
|
||||
if [ -n "${GITHUB_ACTIONS:-}" ]; then
|
||||
echo "::endgroup::"
|
||||
fi
|
||||
}
|
||||
|
||||
echo "mode=$mode version=$version push=$push images=$*"
|
||||
|
||||
for image in "$@"; do
|
||||
[ -f "images/$image/Dockerfile" ] || {
|
||||
echo "no such image: images/$image/Dockerfile does not exist" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
mapfile -t tags < <(tags_for "$image")
|
||||
tag_args=()
|
||||
for tag in "${tags[@]}"; do tag_args+=(--tag "$tag"); done
|
||||
|
||||
group "build $image"
|
||||
docker build "${tag_args[@]}" \
|
||||
--build-arg "VERSION=$version" \
|
||||
--build-arg "REVISION=$revision" \
|
||||
--build-arg "CREATED=$created" \
|
||||
"images/$image"
|
||||
endgroup
|
||||
|
||||
if [ -x "images/$image/test.sh" ]; then
|
||||
group "test $image"
|
||||
"images/$image/test.sh" "${tags[0]}"
|
||||
endgroup
|
||||
else
|
||||
echo "note: $image has no test.sh, nothing to smoke-test"
|
||||
fi
|
||||
|
||||
if [ "$push" = true ]; then
|
||||
group "push $image"
|
||||
for tag in "${tags[@]}"; do
|
||||
echo "pushing $tag"
|
||||
docker push "$tag"
|
||||
done
|
||||
endgroup
|
||||
fi
|
||||
done
|
||||
|
||||
echo "done: $* ($mode)"
|
||||
Reference in New Issue
Block a user