Skip to content

Commit 7adc3b0

Browse files
n2p5n2p5
authored
Oci containers (#2)
* chore: adding hermetic build containers * fix: update linting, formatting, etc * fix: builder tooling * fix: patch build and deploy script * fix: only support 64bit * fix: update tagging tools for docker * fix: tagging tooling * fix: removed broken scan tool
1 parent 365a53c commit 7adc3b0

12 files changed

Lines changed: 891 additions & 51 deletions

File tree

‎.github/workflows/go.yaml‎

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
- name: Set up Go
1919
uses: actions/setup-go@v5
2020
with:
21-
go-version: "1.24.4"
21+
go-version: "1.24.6"
2222

2323
- name: Check formatting
2424
run: |
@@ -29,10 +29,14 @@ jobs:
2929
exit 1
3030
fi
3131
32-
- name: Run Gosec Security Scanner
33-
uses: securego/gosec@master
34-
with:
35-
args: ./...
32+
- name: Run Go vet
33+
run: make lint
34+
35+
- name: Run Shellcheck
36+
run: |
37+
sudo apt-get update
38+
sudo apt-get install -y shellcheck
39+
make shellcheck
3640
3741
test:
3842
runs-on: ubuntu-latest
@@ -43,7 +47,7 @@ jobs:
4347
- name: Set up Go
4448
uses: actions/setup-go@v5
4549
with:
46-
go-version: "1.24.4"
50+
go-version: "1.24.6"
4751

4852
- name: Test
4953
run: make test
@@ -55,3 +59,28 @@ jobs:
5559
env:
5660
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
5761
run: bash <(curl -s https://codecov.io/bash)
62+
63+
docker-build:
64+
runs-on: ubuntu-latest
65+
needs: [quality-checks, test]
66+
# Only build and push Docker images on main branch after tests pass
67+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
68+
steps:
69+
- uses: actions/checkout@v4
70+
71+
- name: Set up Docker Buildx
72+
uses: docker/setup-buildx-action@v3
73+
74+
- name: Log in to Docker Hub
75+
uses: docker/login-action@v3
76+
with:
77+
username: ${{ secrets.DOCKERHUB_USERNAME }}
78+
password: ${{ secrets.DOCKERHUB_TOKEN }}
79+
80+
- name: Build info
81+
run: make docker-info
82+
83+
- name: Build and push Docker image
84+
run: make docker-push
85+
env:
86+
DOCKER_PUSH: true

‎.github/workflows/release.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*'
7+
8+
jobs:
9+
promote-release:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v4
13+
14+
- name: Set up Docker Buildx
15+
uses: docker/setup-buildx-action@v3
16+
17+
- name: Log in to Docker Hub
18+
uses: docker/login-action@v3
19+
with:
20+
username: ${{ secrets.DOCKERHUB_USERNAME }}
21+
password: ${{ secrets.DOCKERHUB_TOKEN }}
22+
23+
- name: Extract version from tag
24+
id: version
25+
run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
26+
27+
- name: Build info
28+
run: |
29+
echo "Promoting release: ${{ steps.version.outputs.VERSION }}"
30+
make docker-info
31+
32+
- name: Promote Docker image
33+
run: |
34+
# The image should already exist from the main branch build
35+
# We're just adding the version tag to it (immutable tags - no latest)
36+
make docker-promote TAGS="${{ steps.version.outputs.VERSION }}"
37+
38+
- name: Create GitHub Release
39+
uses: softprops/action-gh-release@v1
40+
with:
41+
generate_release_notes: true
42+
draft: false
43+
prerelease: false

‎Makefile‎

Lines changed: 73 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,14 @@
1-
.PHONEY: coverage test inspect install sec-scan lint fmt check
1+
.PHONY: coverage test inspect install sec-scan lint fmt check shellcheck
2+
.PHONY: tree-hash docker-build docker-push docker-exists docker-promote docker-release docker-list
23

4+
# Docker configuration with defaults (override with environment variables)
5+
export DOCKER_REGISTRY ?= docker.io
6+
export DOCKER_REPO ?= nomasters/haystack
7+
export DOCKER_PLATFORMS ?= linux/amd64,linux/arm64
8+
export DOCKER_PUSH ?= false
9+
export SKIP_GIT_CHECK ?= false
10+
11+
# Go targets
312
test:
413
go test -v ./...
514

@@ -13,16 +22,76 @@ sec-scan:
1322
gosec -fmt=json -out=gosec-report.json -stdout -verbose=text ./...
1423

1524
lint:
16-
golangci-lint run ./...
25+
go vet ./...
1726

1827
fmt:
1928
go fmt ./...
2029

21-
check: fmt lint test
30+
# Check shell scripts for issues
31+
shellcheck:
32+
@echo "Checking shell scripts with shellcheck..."
33+
@shellcheck scripts/*.sh
34+
35+
check: fmt lint test shellcheck
2236
@echo "All checks passed!"
2337

2438
update-deps:
2539
go get -u && go mod tidy
2640

2741
install:
28-
go install github.com/nomasters/haystack/cmd/haystack
42+
go install github.com/nomasters/haystack/cmd/haystack
43+
44+
# Docker targets - Local-first hermetic builds
45+
# These commands work identically on your machine and in CI
46+
47+
# Calculate the tree hash of source files
48+
tree-hash:
49+
@./scripts/tree-hash.sh
50+
51+
# Build Docker image (idempotent - only builds if tree hash changed)
52+
# Requires clean git working directory (override with SKIP_GIT_CHECK=true)
53+
docker-build:
54+
@./scripts/docker-build.sh
55+
56+
# Build and push Docker image to registry
57+
docker-push:
58+
@DOCKER_PUSH=true ./scripts/docker-build.sh
59+
60+
# Check if image exists for current tree hash
61+
docker-exists:
62+
@TREE_HASH=$$(./scripts/tree-hash.sh) && \
63+
./scripts/docker-tags.sh exists "tree-$$TREE_HASH"
64+
65+
# Promote current commit's image with additional tags
66+
# Usage: make docker-promote TAGS="v1.0.0"
67+
docker-promote:
68+
@if [ -z "$(TAGS)" ]; then \
69+
echo "Error: TAGS variable required. Usage: make docker-promote TAGS=\"v1.0.0\""; \
70+
exit 1; \
71+
fi
72+
@./scripts/docker-tags.sh release $(TAGS)
73+
74+
# Release workflow - build if needed, then tag
75+
# Usage: make docker-release VERSION=v1.0.0
76+
docker-release: docker-push
77+
@if [ -z "$(VERSION)" ]; then \
78+
echo "Error: VERSION variable required. Usage: make docker-release VERSION=v1.0.0"; \
79+
exit 1; \
80+
fi
81+
@./scripts/docker-tags.sh release $(VERSION)
82+
83+
# List all Docker tags in the registry
84+
docker-list:
85+
@./scripts/docker-tags.sh list
86+
87+
# Clean up local Docker buildx builders
88+
docker-clean:
89+
@docker buildx rm haystack-builder 2>/dev/null || true
90+
91+
# Show current build information
92+
docker-info:
93+
@echo "Tree hash: $$(./scripts/tree-hash.sh)"
94+
@echo "Commit SHA: $$(git rev-parse --short HEAD)"
95+
@echo "Branch: $$(git rev-parse --abbrev-ref HEAD)"
96+
@echo "Registry: $${DOCKER_REGISTRY:-docker.io}"
97+
@echo "Repository: $${DOCKER_REPO:-nomasters/haystack}"

0 commit comments

Comments
 (0)