Skip to content

enh(ci): replace GHA cache with ghcr.io for fat container images #6109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Tpo76 wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

enh(ci): replace GHA cache with ghcr.io for fat container images #6109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 37 additions & 34 deletions .github/workflows/perl-cpan-libraries.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,21 +179,24 @@ jobs:
username: ${{ secrets.HARBOR_CENTREON_PULL_USERNAME }}
password: ${{ secrets.HARBOR_CENTREON_PULL_TOKEN }}

- name: Pull and save image
- name: Login to GitHub Container Registry
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}

- name: Pull image from Harbor and push to ghcr.io
env:
DOCKER_IMAGE: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/${{ matrix.image }}
IMAGE_NAME: ${{ matrix.image }}
HARBOR_IMAGE: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/${{ matrix.image }}
GHCR_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.image }}:${{ github.sha }}-${{ github.run_id }}
run: |
docker image prune -af
docker pull "${DOCKER_IMAGE}:latest"
docker save -o "./${IMAGE_NAME}" "${DOCKER_IMAGE}:latest"
docker pull "${HARBOR_IMAGE}:latest"
docker tag "${HARBOR_IMAGE}:latest" "${GHCR_IMAGE}"
docker push "${GHCR_IMAGE}"
Copy link
Copy Markdown
Contributor

@tuntoja tuntoja Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does this need to have these ?

    permissions:
      contents: read
      packages: write

Copy link
Copy Markdown
Contributor Author

@Tpo76 Tpo76 Apr 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not mandatory as the docker push to ghcr.io uses ${{ github.token }}, which inherits the repository's default permissions that are currently fine.
However, we can always fine-tune by explicitly adding the permissions in the get-packaging-images section.
With this for example

get-packaging-images:
      needs: [get-environment]
      permissions:
        contents: read
        packages: write
      if: |

shell: bash

- uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: ./${{ matrix.image }}
key: ${{ matrix.image }}-${{ github.sha }}-${{ github.run_id }}

package-rpm:
needs: [get-environment, generate-matrices, get-packaging-images]
if: |
Expand All @@ -211,22 +214,22 @@ jobs:
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Restore packaging image from cache
uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
- name: Login to GitHub Container Registry
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
path: ./${{ matrix.image }}
key: ${{ matrix.image }}-${{ github.sha }}-${{ github.run_id }}
fail-on-cache-miss: true
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}

- name: Load packaging image
- name: Pull packaging image from ghcr.io
env:
IMAGE_NAME: ${{ matrix.image }}
run: docker load --input "./${IMAGE_NAME}"
GHCR_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.image }}:${{ github.sha }}-${{ github.run_id }}
run: docker pull "${GHCR_IMAGE}"
shell: bash

- if: ${{ matrix.spec_file == '' }}
env:
DOCKER_IMAGE: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/${{ matrix.image }}
DOCKER_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.image }}:${{ github.sha }}-${{ github.run_id }}
VERSION: ${{ matrix.version || matrix.cpan_version }}
RPM_DEPENDENCIES: ${{ matrix.rpm_dependencies }}
RPM_PROVIDES: ${{ matrix.rpm_provides }}
Expand All @@ -244,20 +247,20 @@ jobs:
-e VERSION -e RPM_DEPENDENCIES -e RPM_PROVIDES \
-e NO_AUTO_DEPENDS -e PREINSTALL_CPANLIBS -e PREINSTALL_PACKAGES \
-e PKG_NAME -e PKG_EXT -e DISTRIB -e REVISION \
"${DOCKER_IMAGE}:latest" \
"${DOCKER_IMAGE}" \
bash .github/scripts/perl-cpan-libraries/package-cpan-rpm.sh
shell: bash

- if: ${{ matrix.spec_file != '' }}
env:
DOCKER_IMAGE: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/${{ matrix.image }}
DOCKER_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.image }}:${{ github.sha }}-${{ github.run_id }}
SPEC_FILE: ${{ matrix.spec_file }}
run: |
docker run --rm \
-v "$(pwd):/work" \
--workdir /work \
-e SPEC_FILE \
"${DOCKER_IMAGE}:latest" \
"${DOCKER_IMAGE}" \
bash -c '
mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
rpmbuild --undefine=_disable_source_fetch -ba "$SPEC_FILE"
Expand Down Expand Up @@ -362,17 +365,17 @@ jobs:
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Restore packaging image from cache
uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
- name: Login to GitHub Container Registry
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
path: ./${{ matrix.image }}
key: ${{ matrix.image }}-${{ github.sha }}-${{ github.run_id }}
fail-on-cache-miss: true
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}

- name: Load packaging image
- name: Pull packaging image from ghcr.io
env:
IMAGE_NAME: ${{ matrix.image }}
run: docker load --input "./${IMAGE_NAME}"
GHCR_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.image }}:${{ github.sha }}-${{ github.run_id }}
run: docker pull "${GHCR_IMAGE}"
shell: bash

- name: Parse distrib name
Expand All @@ -383,7 +386,7 @@ jobs:

- if: ${{ matrix.use_dh_make_perl == 'false' }}
env:
DOCKER_IMAGE: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/${{ matrix.image }}
DOCKER_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.image }}:${{ github.sha }}-${{ github.run_id }}
VERSION: ${{ matrix.version || matrix.cpan_version }}
DEB_DEPENDENCIES: ${{ matrix.deb_dependencies }}
DEB_PROVIDES: ${{ matrix.deb_provides }}
Expand All @@ -404,13 +407,13 @@ jobs:
-e NO_AUTO_DEPENDS -e PREINSTALL_CPANLIBS -e PREINSTALL_PACKAGES \
-e PKG_NAME -e PKG_EXT -e DISTRIB -e REVISION \
-e DISTRIB_SEPARATOR -e DISTRIB_SUFFIX \
"${DOCKER_IMAGE}:latest" \
"${DOCKER_IMAGE}" \
bash .github/scripts/perl-cpan-libraries/package-cpan-deb-fpm.sh
shell: bash

- if: ${{ matrix.use_dh_make_perl == 'true' }}
env:
DOCKER_IMAGE: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/${{ matrix.image }}
DOCKER_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.image }}:${{ github.sha }}-${{ github.run_id }}
VERSION: ${{ matrix.version || matrix.cpan_version }}
PREINSTALL_CPANLIBS: ${{ matrix.preinstall_cpanlibs }}
PREINSTALL_PACKAGES: ${{ matrix.preinstall_packages }}
Expand All @@ -426,7 +429,7 @@ jobs:
-e VERSION -e PREINSTALL_CPANLIBS -e PREINSTALL_PACKAGES \
-e PKG_NAME -e DISTRIB -e REVISION \
-e DISTRIB_SEPARATOR -e DISTRIB_SUFFIX \
"${DOCKER_IMAGE}:latest" \
"${DOCKER_IMAGE}" \
bash .github/scripts/perl-cpan-libraries/package-cpan-deb-dhmaker.sh
shell: bash

Expand Down
60 changes: 27 additions & 33 deletions .github/workflows/plugins-robot-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,12 +52,9 @@ on:
required: true

jobs:
test-image-to-cache:
push-test-image-to-ghcr:
runs-on: ${{ contains(inputs.image, 'arm') && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
steps:
- name: Checkout sources
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Login to Registry
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
Expand All @@ -72,30 +69,26 @@ jobs:
username: ${{ secrets.registry_username }}
password: ${{ secrets.registry_password }}

- name: Load image
env:
DOCKER_IMAGE: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/${{ inputs.image }}
run: |
docker image prune -af
docker pull $DOCKER_IMAGE
shell: bash
- name: Login to GitHub Container Registry
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}

- name: Save image on disk
- name: Pull image from Harbor and push to ghcr.io
env:
IMAGE_NAME: ${{ inputs.image }}
DOCKER_IMAGE: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/${{ inputs.image }}
HARBOR_IMAGE: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/${{ inputs.image }}
GHCR_IMAGE: ghcr.io/${{ github.repository }}/${{ inputs.image }}:${{ github.sha }}-${{ github.run_id }}
Copy link
Copy Markdown
Contributor

@kduret kduret Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

test images are not yet pushed on ghcr.io
I think we should wait my work to validate if ghcr.io works properly and then we will migrate these images from docker.centreon.com to ghcr

run: |
docker save -o ./$IMAGE_NAME $DOCKER_IMAGE
docker image prune -af
docker pull "${HARBOR_IMAGE}"
docker tag "${HARBOR_IMAGE}" "${GHCR_IMAGE}"
docker push "${GHCR_IMAGE}"
shell: bash

- name: Save image into cache
uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: ./${{ inputs.image }}
key: ${{ inputs.image }}-${{ github.sha }}-${{ github.run_id }}

robot-test:
needs: [test-image-to-cache]
needs: [push-test-image-to-ghcr]
runs-on: ${{ contains(inputs.image, 'arm') && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}

strategy:
Expand All @@ -110,12 +103,18 @@ jobs:
- name: Checkout sources
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Get the cached docker image for tests
uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
- name: Login to GitHub Container Registry
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
path: ./${{ inputs.image }}
key: ${{ inputs.image }}-${{ github.sha }}-${{ github.run_id }}
fail-on-cache-miss: true
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}

- name: Pull test image from ghcr.io
env:
GHCR_IMAGE: ghcr.io/${{ github.repository }}/${{ inputs.image }}:${{ github.sha }}-${{ github.run_id }}
run: docker pull "${GHCR_IMAGE}"
shell: bash

- name: Get the cached plugins
if: ${{ inputs.get-packages == 'True' }}
Expand All @@ -132,15 +131,10 @@ jobs:
key: ${{ inputs.plugins-json-cache-key }}
fail-on-cache-miss: true

- name: Load image
env:
IMAGE_NAME: ${{ inputs.image }}
run: docker load --input ./$IMAGE_NAME

- name: Install, test and remove plugin
shell: bash
env:
DOCKER_IMAGE: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/${{ inputs.image }}
DOCKER_IMAGE: ghcr.io/${{ github.repository }}/${{ inputs.image }}:${{ github.sha }}-${{ github.run_id }}
PACKAGE_EXTENSION: ${{ inputs.package-extension }}
RUNNER_ID: ${{ matrix.index }}
SKIP_ROBOT_TESTS: ${{ inputs.skip-robot-tests }}
Expand Down
Loading