Skip to content

ci: parallelise container builds using matrix and manifest merge #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abn merged 2 commits into from
May 31, 2026
Merged

ci: parallelise container builds using matrix and manifest merge #1

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
419bdd0
ci: parallelise container builds using matrix and manifest merge
abn May 31, 2026
9ba76ac
ci: implement atomic tag promotion for container builds
abn May 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
96 changes: 83 additions & 13 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,14 +45,26 @@ jobs:
- 'Containerfile'
- '.github/workflows/ci.yml'

publish:
name: Build & Publish Containers
build-arch:
name: Build & Publish (${{ matrix.platform }})
needs: [lint, detect-changes]
if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/') || needs.detect-changes.outputs.container == 'true'
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
include:
- platform: linux/amd64
runner: ubuntu-latest
suffix: amd64
- platform: linux/arm64
runner: ubuntu-24.04-arm
suffix: arm64
runs-on: ${{ matrix.runner }}
permissions:
contents: read
packages: write
outputs:
push: ${{ steps.resolve.outputs.push }}
steps:
- name: Checkout Code
uses: actions/checkout@v6
Expand Down Expand Up @@ -89,18 +101,16 @@ jobs:

echo "sha-tag=sha-$SHORT_SHA" >> "$GITHUB_OUTPUT"


- name: Build Flatpak Base Image
id: build-flatpak
uses: redhat-actions/buildah-build@v2
with:
context: .
containerfiles: ./Containerfile
platforms: linux/amd64,linux/arm64
platforms: ${{ matrix.platform }}
image: ghcr.io/aetherpak/flatpak
tags: |
${{ steps.resolve.outputs.tags }}
${{ steps.resolve.outputs.sha-tag }}
${{ steps.resolve.outputs.sha-tag }}-${{ matrix.suffix }}
extra-args: --target flatpak
oci: true

Expand All @@ -109,32 +119,92 @@ jobs:
uses: redhat-actions/push-to-registry@v2
with:
image: ${{ steps.build-flatpak.outputs.image }}
tags: ${{ steps.resolve.outputs.tags }}
tags: |
${{ steps.resolve.outputs.sha-tag }}-${{ matrix.suffix }}
registry: ghcr.io
extra-args: |
--tls-verify=true


- name: Build Flatpak Builder Image
id: build-builder
uses: redhat-actions/buildah-build@v2
with:
context: .
containerfiles: ./Containerfile
platforms: linux/amd64,linux/arm64
platforms: ${{ matrix.platform }}
image: ghcr.io/aetherpak/flatpak-builder
tags: ${{ steps.resolve.outputs.tags }}
tags: ${{ steps.resolve.outputs.sha-tag }}-${{ matrix.suffix }}
extra-args: |
--target flatpak-builder
--build-arg BASE_IMAGE=ghcr.io/aetherpak/flatpak:${{ steps.resolve.outputs.sha-tag }}
--build-arg BASE_IMAGE=ghcr.io/aetherpak/flatpak:${{ steps.resolve.outputs.sha-tag }}-${{ matrix.suffix }}
oci: true

- name: Push Flatpak Builder Image
if: ${{ steps.resolve.outputs.push == 'true' && github.event_name != 'pull_request' }}
uses: redhat-actions/push-to-registry@v2
with:
image: ${{ steps.build-builder.outputs.image }}
tags: ${{ steps.resolve.outputs.tags }}
tags: ${{ steps.resolve.outputs.sha-tag }}-${{ matrix.suffix }}
registry: ghcr.io
extra-args: |
--tls-verify=true

merge-manifests:
name: Merge Multi-Arch Manifests
needs: build-arch
if: ${{ needs.build-arch.result == 'success' && needs.build-arch.outputs.push == 'true' }}
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: Log in to the Container registry
uses: redhat-actions/podman-login@v1
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}

- name: Create and Push Manifest Lists
shell: bash
run: |
set -euo pipefail
REF_NAME="${{ github.ref_name }}"
SHA="${{ github.sha }}"
SHORT_SHA="${SHA:0:7}"
SHA_TAG="sha-${SHORT_SHA}"

if [ "$REF_NAME" = "main" ]; then
TAGS="latest"
elif [[ "$REF_NAME" =~ ^v[0-9] ]]; then
TAGS="$REF_NAME"
else
TAGS="sha-${SHORT_SHA}"
fi

# Merge flatpak base image (both main tag and sha-tag)
for tag in $TAGS $SHA_TAG; do
echo "=== Merging Flatpak Base Image tag: ${tag} ==="
podman manifest create "ghcr.io/aetherpak/flatpak:${tag}"
podman manifest add "ghcr.io/aetherpak/flatpak:${tag}" "docker://ghcr.io/aetherpak/flatpak:${SHA_TAG}-amd64"
podman manifest add "ghcr.io/aetherpak/flatpak:${tag}" "docker://ghcr.io/aetherpak/flatpak:${SHA_TAG}-arm64"
podman manifest push --tls-verify=true "ghcr.io/aetherpak/flatpak:${tag}"
done

# Merge flatpak-builder image
for tag in $TAGS; do
echo "=== Merging Flatpak Builder Image tag: ${tag} ==="
podman manifest create "ghcr.io/aetherpak/flatpak-builder:${tag}"
podman manifest add "ghcr.io/aetherpak/flatpak-builder:${tag}" "docker://ghcr.io/aetherpak/flatpak-builder:${SHA_TAG}-amd64"
podman manifest add "ghcr.io/aetherpak/flatpak-builder:${tag}" "docker://ghcr.io/aetherpak/flatpak-builder:${SHA_TAG}-arm64"
podman manifest push --tls-verify=true "ghcr.io/aetherpak/flatpak-builder:${tag}"
done

# Promote single-arch rolling/release tags in registry
for tag in $TAGS; do
echo "=== Promoting single-arch tags for tag: ${tag} ==="
skopeo copy --all --src-creds "${{ github.actor }}:${{ github.token }}" --dest-creds "${{ github.actor }}:${{ github.token }}" "docker://ghcr.io/aetherpak/flatpak:${SHA_TAG}-amd64" "docker://ghcr.io/aetherpak/flatpak:${tag}-amd64"
skopeo copy --all --src-creds "${{ github.actor }}:${{ github.token }}" --dest-creds "${{ github.actor }}:${{ github.token }}" "docker://ghcr.io/aetherpak/flatpak:${SHA_TAG}-arm64" "docker://ghcr.io/aetherpak/flatpak:${tag}-arm64"
skopeo copy --all --src-creds "${{ github.actor }}:${{ github.token }}" --dest-creds "${{ github.actor }}:${{ github.token }}" "docker://ghcr.io/aetherpak/flatpak-builder:${SHA_TAG}-amd64" "docker://ghcr.io/aetherpak/flatpak-builder:${tag}-amd64"
skopeo copy --all --src-creds "${{ github.actor }}:${{ github.token }}" --dest-creds "${{ github.actor }}:${{ github.token }}" "docker://ghcr.io/aetherpak/flatpak-builder:${SHA_TAG}-arm64" "docker://ghcr.io/aetherpak/flatpak-builder:${tag}-arm64"
done
Loading