rmcguireandClaude Opus 5
b888f09eb1
Job names in the Gitea UI rendered as the raw matrix expression
("${{ fromJSON(needs.select.outputs.images) }}"). Gitea resolves a job's matrix
when it PARSES the workflow, before `needs` outputs exist, so matrix.image was
interpolated against an unresolved matrix. There is no way to win with a dynamic
matrix: jobparser.nameWithMatrix interpolates a name containing "${{ }}", and
appends "(<values>)" to one that doesn't — either way the raw expression shows.
See go-gitea/gitea#28207.
So drop the matrix. build.yaml now runs one job, "Build changed images", that
loops over the selected images and emits ::group:: markers, giving a collapsible
section per image. Also: every step has an explicit static name, because Gitea
does not interpolate expressions in names either ("Log in to ${{ env.REGISTRY }}"
rendered literally).
Tag scheme, per review: `latest` now tracks main rather than the newest release,
and `edge` is gone — it's an Alpine/Traefik convention, not a broad standard, and
`main-<sha>` already covers "a specific commit". `latest` has exactly one owner
so a release tag and a main build can't race to define it. Release tags remain
immutable `:vX.Y.Z`/`:vX.Y`/`:vX` for pinning. This also means the ToolHive
manifest's `:latest` resolves as soon as this lands on main, with no release tag
needed first.
hack/docker-tags.sh folded into hack/build-images.sh, which is now the whole
pipeline — tag, build, smoke-test, push — shared by `make build` and CI. It uses
plain `docker build` instead of buildx, dropping setup-buildx-action: it loads
into the local store so the test runs pre-publish, and emits a plain manifest
with no attestations for Gitea's registry.
Verified in a simulated runner (repo in a docker volume, socket mounted, real
runner image): select + build + group markers, all four tag modes, and the
multi-image loop with a scratch second image.
AGENTS.md records the conventions and, importantly, the three Gitea gotchas that
all look fine locally: no bind-mounting the workspace into a sibling container,
no dynamic matrix, no expressions in names.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
122 lines
3.0 KiB
Bash
Executable File
122 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Build, smoke-test and — in CI, on a publishing ref — push images.
|
|
#
|
|
# Usage: build-images.sh <image>...
|
|
#
|
|
# How an image gets tagged is a property of the git ref, not of the image, so one
|
|
# run treats every image it builds the same way:
|
|
#
|
|
# tag <image>/vX.Y.Z -> :vX.Y.Z :vX.Y :vX published release
|
|
# push to main -> :latest :main-<sha> latest tracks main
|
|
# pull request -> :pr-<n> built, never pushed
|
|
# anywhere else -> :dev built, never pushed (local default)
|
|
#
|
|
# `latest` has exactly one owner (main), so a release tag and a main build can never
|
|
# race to define it.
|
|
#
|
|
# Uses plain `docker build` rather than buildx with a container driver: it loads
|
|
# straight into the local image store so the smoke test can run before anything is
|
|
# published, and it produces a plain manifest with no attestations, which Gitea's
|
|
# registry rejects.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
REGISTRY=${REGISTRY:-gitea.libretechconsulting.com}
|
|
NAMESPACE=${NAMESPACE:-rmcguire}
|
|
|
|
[ $# -gt 0 ] || {
|
|
echo "usage: ${0##*/} <image>..." >&2
|
|
exit 2
|
|
}
|
|
|
|
sha=$(git rev-parse --short=7 HEAD)
|
|
revision=$(git rev-parse HEAD)
|
|
created=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
|
|
push=false
|
|
if [ "${GITHUB_REF_TYPE:-}" = tag ]; then
|
|
mode="release"
|
|
version=${GITHUB_REF_NAME##*/}
|
|
[[ $version =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
|
|
echo "tag '${GITHUB_REF_NAME}' is not of the form <image>/vX.Y.Z" >&2
|
|
exit 1
|
|
}
|
|
push=true
|
|
elif [ "${GITHUB_EVENT_NAME:-}" = pull_request ]; then
|
|
mode="pr"
|
|
version="pr-${PR_NUMBER:-0}"
|
|
elif [ "${GITHUB_REF_NAME:-}" = main ]; then
|
|
mode="main"
|
|
version="main-$sha"
|
|
push=true
|
|
else
|
|
mode="local"
|
|
version=dev
|
|
fi
|
|
|
|
tags_for() {
|
|
local repo="$REGISTRY/$NAMESPACE/$1" n
|
|
case $mode in
|
|
release)
|
|
n=${version#v}
|
|
printf '%s\n' "$repo:$version" "$repo:v${n%.*}" "$repo:v${n%%.*}"
|
|
;;
|
|
main) printf '%s\n' "$repo:latest" "$repo:$version" ;;
|
|
*) printf '%s\n' "$repo:$version" ;;
|
|
esac
|
|
}
|
|
|
|
# Collapsible sections in the Actions log; plain headers when run locally.
|
|
group() {
|
|
if [ -n "${GITHUB_ACTIONS:-}" ]; then
|
|
echo "::group::$*"
|
|
else
|
|
echo "==> $*"
|
|
fi
|
|
}
|
|
endgroup() {
|
|
if [ -n "${GITHUB_ACTIONS:-}" ]; then
|
|
echo "::endgroup::"
|
|
fi
|
|
}
|
|
|
|
echo "mode=$mode version=$version push=$push images=$*"
|
|
|
|
for image in "$@"; do
|
|
[ -f "images/$image/Dockerfile" ] || {
|
|
echo "no such image: images/$image/Dockerfile does not exist" >&2
|
|
exit 1
|
|
}
|
|
|
|
mapfile -t tags < <(tags_for "$image")
|
|
tag_args=()
|
|
for tag in "${tags[@]}"; do tag_args+=(--tag "$tag"); done
|
|
|
|
group "build $image"
|
|
docker build "${tag_args[@]}" \
|
|
--build-arg "VERSION=$version" \
|
|
--build-arg "REVISION=$revision" \
|
|
--build-arg "CREATED=$created" \
|
|
"images/$image"
|
|
endgroup
|
|
|
|
if [ -x "images/$image/test.sh" ]; then
|
|
group "test $image"
|
|
"images/$image/test.sh" "${tags[0]}"
|
|
endgroup
|
|
else
|
|
echo "note: $image has no test.sh, nothing to smoke-test"
|
|
fi
|
|
|
|
if [ "$push" = true ]; then
|
|
group "push $image"
|
|
for tag in "${tags[@]}"; do
|
|
echo "pushing $tag"
|
|
docker push "$tag"
|
|
done
|
|
endgroup
|
|
fi
|
|
done
|
|
|
|
echo "done: $* ($mode)"
|