Skip to content

Commit 91d01df

Browse files
jbern0rdjbern0rd
authored
ci: add workflows to build OCI images (#9)
1 parent e3310b9 commit 91d01df

File tree

5 files changed

+195
-0
lines changed

5 files changed

+195
-0
lines changed

‎.cargo/config.toml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[build]
2+
rustflags = ["-C", "target-feature=-crt-static"]

‎.github/workflows/ci.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
pull_request:
55
push:
66
branches: [main]
7+
workflow_dispatch:
78

89
jobs:
910
build-and-test:
@@ -13,3 +14,71 @@ jobs:
1314
working-directory: "."
1415
enable-cache: true
1516
publish-crates-io: false
17+
18+
prepare:
19+
name: Determine image tag
20+
runs-on: ubuntu-latest
21+
needs: build-and-test
22+
if: |
23+
github.ref_name == 'main' ||
24+
startsWith(github.head_ref, 'feature/') ||
25+
startsWith(github.head_ref, 'bugfix/') ||
26+
(github.event_name == 'workflow_dispatch' && (startsWith(github.ref_name, 'feature/') || startsWith(github.ref_name, 'bugfix/')))
27+
outputs:
28+
image_tag: ${{ steps.determine-tag.outputs.image_tag }}
29+
steps:
30+
- name: Determine Docker tag based on Git ref
31+
id: determine-tag
32+
run: |
33+
if [ "${{ github.event_name }}" = "pull_request" ] ; then
34+
SHORT_SHA=$(echo ${{ github.event.pull_request.head.sha }} | cut -c1-8)
35+
else
36+
SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-8)
37+
fi
38+
39+
if [ "${{ github.ref_name }}" = "main" ] ; then
40+
echo "Processing main branch"
41+
echo "image_tag=dev-${SHORT_SHA}" | tee -a $GITHUB_OUTPUT
42+
else
43+
# This covers feature/ and bugfix/ branches
44+
echo "Processing feature/bugfix branch ${{ github.head_ref }}"
45+
echo "image_tag=feature-${SHORT_SHA}" | tee -a $GITHUB_OUTPUT
46+
fi
47+
48+
post-compute-oci-image:
49+
name: post-compute OCI image
50+
needs: prepare
51+
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/[email protected]
52+
with:
53+
image-name: docker-regis.iex.ec/tee-worker-post-compute-rust
54+
image-tag: ${{ needs.prepare.outputs.image_tag }}
55+
dockerfile: post-compute/Dockerfile
56+
context: .
57+
registry: docker-regis.iex.ec
58+
push: true
59+
security-scan: true
60+
security-report: "sarif"
61+
hadolint: true
62+
platforms: linux/amd64
63+
secrets:
64+
username: ${{ secrets.NEXUS_USERNAME }}
65+
password: ${{ secrets.NEXUS_PASSWORD }}
66+
67+
pre-compute-oci-image:
68+
name: pre-compute OCI image
69+
needs: prepare
70+
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/[email protected]
71+
with:
72+
image-name: docker-regis.iex.ec/tee-worker-pre-compute-rust
73+
image-tag: ${{ needs.prepare.outputs.image_tag }}
74+
dockerfile: pre-compute/Dockerfile
75+
context: .
76+
registry: docker-regis.iex.ec
77+
push: true
78+
security-scan: true
79+
security-report: "sarif"
80+
hadolint: true
81+
platforms: linux/amd64
82+
secrets:
83+
username: ${{ secrets.NEXUS_USERNAME }}
84+
password: ${{ secrets.NEXUS_PASSWORD }}

‎.github/workflows/docker-build-on-tag.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Build and Push Release Image
2+
3+
on:
4+
push:
5+
tags:
6+
- 'tee-worker-post-compute-v*.*.*'
7+
- 'tee-worker-pre-compute-v*.*.*'
8+
9+
jobs:
10+
prepare:
11+
name: Determine image tag
12+
runs-on: ubuntu-latest
13+
outputs:
14+
dockerfile: ${{ steps.determine-tag.outputs.dockerfile }}
15+
image_name: ${{ steps.determine-tag.outputs.image_name }}
16+
image_tag: ${{ steps.determine-tag.outputs.image_tag }}
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
with:
21+
fetch-depth: 0
22+
23+
- name: Determine Docker tag based on Git ref
24+
id: determine-tag
25+
run: |
26+
# Since this workflow only triggers on tags matching 'v*.*.*' we know we're always dealing with a version tag
27+
TAG_ON_MAIN=$(git branch -r --contains ${{ github.sha }} 'origin/main')
28+
29+
if [ -z "$TAG_ON_MAIN" ] ; then
30+
echo "Error: Tag ${{ github.ref_name }} is not on main branch"
31+
echo "Tags must be created on main branch to generate X.Y.Z image tags"
32+
exit 1
33+
fi
34+
35+
GITHUB_REF_NAME="${{ github.ref_name }}"
36+
echo "Processing tag on main branch: ${{ github.ref_name }}"
37+
38+
case "$GITHUB_REF_NAME" in
39+
tee-worker-post-compute-v*)
40+
echo "dockerfile=post-compute/Dockerfile" | tee -a $GITHUB_OUTPUT
41+
echo "image_name=tee-worker-post-compute-rust" | tee -a $GITHUB_OUTPUT
42+
echo "image_tag=${GITHUB_REF_NAME#tee-worker-post-compute-v}" | tee -a $GITHUB_OUTPUT
43+
;;
44+
tee-worker-pre-compute-v*)
45+
echo "dockerfile=pre-compute/Dockerfile" | tee -a $GITHUB_OUTPUT
46+
echo "image_name=tee-worker-pre-compute-rust" | tee -a $GITHUB_OUTPUT
47+
echo "image_tag=${GITHUB_REF_NAME#tee-worker-pre-compute-v}" | tee -a $GITHUB_OUTPUT
48+
;;
49+
*)
50+
echo "Error: Unsupported tag ${{ github.ref_name }}"
51+
exit 1
52+
;;
53+
esac
54+
55+
build-oci-image:
56+
name: Build OCI image
57+
needs: prepare
58+
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/[email protected]
59+
with:
60+
image-name: docker-regis.iex.ec/${{ needs.prepare.outputs.image_name }}
61+
image-tag: ${{ needs.prepare.outputs.image_tag }}
62+
dockerfile: ${{ needs.prepare.outputs.dockerfile }}
63+
context: .
64+
registry: docker-regis.iex.ec
65+
push: true
66+
security-scan: true
67+
security-report: "sarif"
68+
hadolint: true
69+
platforms: linux/amd64
70+
secrets:
71+
username: ${{ secrets.NEXUS_USERNAME }}
72+
password: ${{ secrets.NEXUS_PASSWORD }}

‎post-compute/Dockerfile‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
FROM rust:1.88-alpine3.22 AS builder
2+
3+
# Install build dependencies with pinned versions
4+
RUN apk add --no-cache musl-dev=1.2.5-r10 openssl-dev=3.5.2-r0
5+
6+
WORKDIR /app
7+
8+
# Copy manifest and source files
9+
COPY . .
10+
11+
# Build the application
12+
RUN cargo build --release --bin tee-worker-post-compute
13+
14+
FROM alpine:3.22
15+
16+
# Install required runtime dependencies with pinned versions
17+
RUN apk add --no-cache libgcc=14.2.0-r6
18+
19+
# Set working directory
20+
WORKDIR /app
21+
22+
# Copy the binary from builder stage
23+
COPY --from=builder /app/target/release/tee-worker-post-compute .
24+
25+
# Run the application
26+
ENTRYPOINT ["/app/tee-worker-post-compute"]

‎pre-compute/Dockerfile‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
FROM rust:1.88-alpine3.22 AS builder
2+
3+
# Install build dependencies with pinned versions
4+
RUN apk add --no-cache musl-dev=1.2.5-r10 openssl-dev=3.5.2-r0
5+
6+
WORKDIR /app
7+
8+
# Copy manifest and source files
9+
COPY . .
10+
11+
# Build the application
12+
RUN cargo build --release --bin tee-worker-pre-compute
13+
14+
FROM alpine:3.22
15+
16+
# Install required runtime dependencies with pinned versions
17+
RUN apk add --no-cache libgcc=14.2.0-r6
18+
19+
# Set working directory
20+
WORKDIR /app
21+
22+
# Copy the binary from builder stage
23+
COPY --from=builder /app/target/release/tee-worker-pre-compute .
24+
25+
# Run the application
26+
ENTRYPOINT ["/app/tee-worker-pre-compute"]

0 commit comments

Comments
 (0)