name: docker # Builds the streamplace container images and publishes them to ghcr.io. # # ghcr.io/streamplace/streamplace:next - release image (amd64+arm64) # ghcr.io/streamplace/streamplace: - immutable release image # ghcr.io/streamplace/streamplace:latest - newest tagged release # ghcr.io/streamplace/streamplace:next-mistserver - MistServer companion (amd64) # ghcr.io/streamplace/streamplace:bunny - leak-test fixture image (amd64) # ghcr.io/streamplace/streamplace:builder - cross-compile toolchain (amd64) # # Pushes happen on `next` and on `v*` tags. Pull requests build everything but # do not push, so the Dockerfiles stay validated without publishing. on: pull_request: push: branches: - next tags: - "v*" concurrency: group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} cancel-in-progress: true permissions: contents: read packages: write env: REGISTRY_IMAGE: ghcr.io/streamplace/streamplace jobs: # The cross-compilation toolchain image, published so it can be pulled for # complex builds locally. amd64 only: the toolchain (clang/llvm, golangci, # aptly, the winehq apt repo) is x86-64. Layer-cached to ghcr so an unchanged # docker/build.Dockerfile is a fast cache hit. builder: name: builder image runs-on: ubuntu-latest steps: - name: Maximize build space run: sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL - name: Check out code uses: actions/checkout@v4.1.7 with: fetch-depth: 0 ref: ${{ github.event.pull_request.head.sha }} - uses: docker/setup-buildx-action@v3 - name: Log in to ghcr.io uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ github.token }} - name: Compute tags id: tags run: | short=${GITHUB_SHA::7} echo "tags=${REGISTRY_IMAGE}:builder,${REGISTRY_IMAGE}:builder-${short}" >> "$GITHUB_OUTPUT" - name: Build and push builder uses: docker/build-push-action@v6 with: context: . file: docker/build.Dockerfile target: builder platforms: linux/amd64 push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.tags.outputs.tags }} # The builder image is large; use a dedicated registry cache tag # (no 10GB cap, unlike the GitHub Actions cache). cache-from: type=registry,ref=${{ env.REGISTRY_IMAGE }}:builder-buildcache cache-to: ${{ github.event_name != 'pull_request' && format('type=registry,ref={0}:builder-buildcache,mode=max', env.REGISTRY_IMAGE) || '' }} # Cross-compile the linux binaries inside the builder container (the same # mechanism as build.yaml) and hand them to the image jobs as an artifact. binaries: name: linux binaries runs-on: ubuntu-latest outputs: version: ${{ steps.version.outputs.version }} steps: - name: Maximize build space run: sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL - name: Check out code uses: actions/checkout@v4.1.7 with: fetch-depth: 0 ref: ${{ github.event.pull_request.head.sha }} - name: Log in to ghcr.io (build-layer cache) uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ github.token }} - name: Cross-compile linux amd64 + arm64 run: | sudo apt install podman -y make in-container \ BUILDER_TARGET=builder-no-darwin \ DOCKER_PWD_MOUNT_PATH=/app \ DOCKER_BUILD_OPTS="--layers --cache-to ghcr.io/streamplace/streamplace --cache-from ghcr.io/streamplace/streamplace" \ DOCKER_OPTS="-e CI=true -e GITHUB_ACTION=true" \ IN_CONTAINER_CMD="make linux-amd64 && make linux-arm64 && go run ./pkg/config/git/git.go -v > sp-version.txt" - name: Capture version id: version run: echo "version=$(cat sp-version.txt)" >> "$GITHUB_OUTPUT" - name: Upload binaries uses: actions/upload-artifact@v4 with: name: streamplace-linux-binaries path: | build-linux-amd64/streamplace build-linux-arm64/streamplace retention-days: 1 if-no-files-found: error # Assemble and publish the product images from the freshly-built binaries. images: name: ${{ matrix.image }} image runs-on: ubuntu-latest needs: binaries strategy: fail-fast: false matrix: include: - image: release file: docker/release.ghcr.Dockerfile platforms: linux/amd64,linux/arm64 suffix: "" - image: mistserver file: docker/mistserver.ghcr.Dockerfile platforms: linux/amd64 suffix: "-mistserver" - image: bunny file: docker/bunny.Dockerfile platforms: linux/amd64 suffix: "-bunny" steps: - name: Check out code uses: actions/checkout@v4.1.7 with: fetch-depth: 0 ref: ${{ github.event.pull_request.head.sha }} - name: Download binaries uses: actions/download-artifact@v4 with: name: streamplace-linux-binaries path: . - name: Stage build context run: | mkdir -p stage/build-linux-amd64 stage/build-linux-arm64 cp build-linux-amd64/streamplace stage/build-linux-amd64/streamplace cp build-linux-arm64/streamplace stage/build-linux-arm64/streamplace cp docker/mistserver.json stage/mistserver.json cp docker/bunny.sh stage/bunny.sh - uses: docker/setup-qemu-action@v3 if: contains(matrix.platforms, 'arm64') - uses: docker/setup-buildx-action@v3 - name: Log in to ghcr.io uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ github.token }} - name: Compute image tags id: tags env: SUFFIX: ${{ matrix.suffix }} VERSION: ${{ needs.binaries.outputs.version }} run: | set -euo pipefail tags=("${REGISTRY_IMAGE}:${VERSION}${SUFFIX}") if [ "${{ github.event_name }}" = "pull_request" ]; then tags+=("${REGISTRY_IMAGE}:pr-${{ github.event.number }}${SUFFIX}") elif [ "${{ github.ref_type }}" = "tag" ]; then tags+=("${REGISTRY_IMAGE}:latest${SUFFIX}") else tags+=("${REGISTRY_IMAGE}:${{ github.ref_name }}${SUFFIX}") fi # bunny gets a stable, version-independent tag (its contents never change). if [ "${{ matrix.image }}" = "bunny" ]; then tags+=("${REGISTRY_IMAGE}:bunny") fi printf -v joined '%s,' "${tags[@]}" echo "tags=${joined%,}" >> "$GITHUB_OUTPUT" echo "tags: ${joined%,}" - name: Build and push ${{ matrix.image }} uses: docker/build-push-action@v6 with: context: stage file: ${{ matrix.file }} platforms: ${{ matrix.platforms }} push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.tags.outputs.tags }} cache-from: type=gha,scope=${{ matrix.image }} cache-to: type=gha,mode=max,scope=${{ matrix.image }}