Docker #392
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| # parts of this are copy pasted from various sample github actions | |
| # main goals: | |
| # - build spring's petclinic project with a few additions for observability and push it as a custom docker image | |
| # - make sure the docker compose file in this repo starts up correctly | |
| # - some steps to sign the built image have been deactivated. This was just copy pasted but seems interesting | |
| on: | |
| schedule: | |
| - cron: '41 18 * * *' | |
| push: | |
| branches: [ "main" ] | |
| # Publish semver tags as releases. | |
| tags: [ 'v*.*.*' ] | |
| pull_request: | |
| branches: [ "main" ] | |
| env: | |
| # Use docker.io for Docker Hub if empty | |
| REGISTRY: ghcr.io | |
| # github.repository as <account>/<repo> | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| # This is used to complete the identity challenge | |
| # with sigstore/fulcio when running outside of PRs. | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| # Install the cosign tool except on PR | |
| # https://github.com/sigstore/cosign-installer | |
| - name: Install cosign | |
| # if: github.event_name != 'pull_request' | |
| if: false | |
| uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 | |
| with: | |
| cosign-release: 'v2.1.1' | |
| # Login against a Docker registry except on PR | |
| # https://github.com/docker/login-action | |
| - name: Log into registry ${{ env.REGISTRY }} | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Extract metadata (tags, labels) for Docker | |
| # https://github.com/docker/metadata-action | |
| - name: Extract Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| - name: Set up JDK | |
| uses: actions/[email protected] | |
| with: | |
| java-version: '21' | |
| distribution: 'corretto' | |
| - name: Build | |
| shell: bash | |
| id: build-image | |
| run: | | |
| # always work off of the most up to date petclinic sample | |
| git clone https://github.com/spring-projects/spring-petclinic.git | |
| cd spring-petclinic || exit 1 | |
| # copy recipe for open rewrite and config for maven versions plugin | |
| cp ../petclinic-build-files/rewrite.yml ../petclinic-build-files/versions-rules.xml . | |
| # copy logbook and observability spring config and json logback config | |
| cp ../petclinic-build-files/application-o11y.yaml ../petclinic-build-files/logback-spring.xml src/main/resources | |
| # add logbook and micrometer dependencies for metrics and tracing | |
| ./mvnw -B -ntp -U org.openrewrite.maven:rewrite-maven-plugin:run -Drewrite.activeRecipes=me.dtem.AddDependencies -Dcheckstyle.skip | |
| # make sure the added dependencies are up to date (maybe should fail build if actually changed?) | |
| ./mvnw -B -ntp versions:update-properties -DincludeProperties="zipkin-reporter-brave.version,datasource-micrometer-spring-boot.version,logstash-logback-encoder.version,logbook.version,jib-maven-plugin.version" -Dcheckstyle.skip | |
| # build the spring project and create the docker image | |
| ./mvnw -B -ntp package jib:build -DskipTests -Dimage=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} -Dcheckstyle.skip | |
| - name: Publish | |
| # if: ${{ github.event_name != 'pull_request' }} | |
| if: false | |
| shell: bash | |
| id: publish-image | |
| run: | | |
| # add tags created by github (nightly, vsemver, branch name) | |
| echo "${{ steps.meta.outputs.tags }}" | xargs -I {} docker tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} {} | |
| docker push --quiet --all-tags ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| # save the digest of the pushed image (used by signing) | |
| echo "DIGEST=$(docker images --format='{{.Digest}}' ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | head -n1)" >> $GITHUB_OUTPUT | |
| # Sign the resulting Docker image digest except on PRs. | |
| # This will only write to the public Rekor transparency log when the Docker | |
| # repository is public to avoid leaking data. If you would like to publish | |
| # transparency data even for private images, pass --force to cosign below. | |
| # https://github.com/sigstore/cosign | |
| - name: Sign the published Docker image | |
| # if: ${{ github.event_name != 'pull_request' }} | |
| if: false | |
| env: | |
| # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable | |
| TAGS: ${{ steps.meta.outputs.tags }} | |
| DIGEST: ${{ steps.publish-image.outputs.DIGEST }} | |
| # This step uses the identity token to provision an ephemeral certificate | |
| # against the sigstore community Fulcio instance. | |
| run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} | |
| test: | |
| needs: | |
| - build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Compose up | |
| shell: bash | |
| id: compose-up | |
| run: | | |
| docker compose up -d | |
| - name: Test | |
| timeout-minutes: 2 | |
| shell: bash | |
| run: | | |
| # does a bunch of basic health checks on exposed endpoints | |
| ./test.sh |