From f5eb4313a159425a2ca7012891476a65a9a2023c Mon Sep 17 00:00:00 2001 From: Steven Green Date: Wed, 5 Aug 2026 15:39:48 -0700 Subject: [PATCH 1/4] Workflow for release images Adds a workflow to automatically create docker images for backend/frontend when a release is tagged. --- .github/workflows/build-docker-images.yml | 133 ++++++++++++++++++++++ 1 file changed, 133 insertions(+) create mode 100644 .github/workflows/build-docker-images.yml diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml new file mode 100644 index 00000000..87f18fab --- /dev/null +++ b/.github/workflows/build-docker-images.yml @@ -0,0 +1,133 @@ +name: Build Docker Images + +on: + workflow_dispatch: + inputs: + target_branch_or_tag: + required: true + pull_request: + +jobs: + build-images: + runs-on: ubuntu-24.04-arm + permissions: + contents: write + packages: write + + steps: + - name: Checkout repository when push + if: github.event_name == 'push' + uses: actions/checkout@v6 + with: + submodules: recursive + fetch-depth: 1 + + - name: Checkout repository when input + if: github.event_name == 'workflow_dispatch' + uses: actions/checkout@v6 + with: + ref: ${{ inputs.target_branch_or_tag }} + submodules: recursive + fetch-depth: 1 + + - name: Log in to Github Container Registry + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - parallel: + - name: Store backend tag + id: backend_tag + run: | + cd backend + echo "tag=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT + + - name: Store frontend tag + id: frontend_tag + run: | + cd frontend + echo "tag=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT + + - parallel: + - name: Check if backend image exists + id: check_tag_backend + env: + IMAGE_NAME: "ghcr.io/${{ github.repository_owner }}/csa-certification-tool-backend" + run: | + if docker manifest inspect $IMAGE_NAME:${{ steps.backend_tag.outputs.tag }} > /dev/null 2>&1; then + echo "exists=true" >> $GITHUB_OUTPUT + else + echo "exists=false" >> $GITHUB_OUTPUT + fi + + - name: Check if frontend image exists + id: check_tag_frontend + env: + IMAGE_NAME: "ghcr.io/${{ github.repository_owner }}/csa-certification-tool-frontend" + run: | + if docker manifest inspect $IMAGE_NAME:${{ steps.frontend_tag.outputs.tag }} > /dev/null 2>&1; then + echo "exists=true" >> $GITHUB_OUTPUT + else + echo "exists=false" >> $GITHUB_OUTPUT + fi + + - name: Set up QEMU + if: steps.check_tag_backend.outputs.exists == 'false' || steps.check_tag_frontend.outputs.exists == 'false' + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + if: steps.check_tag_backend.outputs.exists == 'false' || steps.check_tag_frontend.outputs.exists == 'false' + uses: docker/setup-buildx-action@v3 + with: + platforms: linux/amd64, linux/arm64 + + - name: Install docker squash + if: steps.check_tag_backend.outputs.exists == 'false' || steps.check_tag_frontend.outputs.exists == 'false' + run: + pip install docker-squash + + - parallel: + - name: Build and push backend image + if: steps.check_tag_backend.outputs.exists == 'false' + run: | + ./backend/scripts/build-docker-image.sh --squash --push --multiarch + + - name: Build and push frontend image + if: steps.check_tag_frontend.outputs.exists == 'false' + run: | + ./frontend/scripts/build-docker-image.sh --squash --push + + - name: Ensure backend sha is used in docker-compose + env: + SHORT_HASH: steps.backend_tag.outputs.tag + run: + sed -i "s/backend:[a-z0-9]\{7\}/backend:${SHORT_HASH}/" docker-compose.yml + + - name: Ensure frontend sha is used in docker-compose + env: + SHORT_HASH: steps.frontend.outputs.tag + run: + sed -i "s/frontend:[a-z0-9]\{7\}/frontend:${SHORT_HASH}/" docker-compose.yml + + - name: Add changes + run: | + git add docker-compose.yml + + - name: Check for changes + id: check + run: | + if git diff --staged --exit-code; then + echo "has_changes=false" >> $GITHUB_OUTPUT + else + echo "has_changes=true" >> $GITHUB_OUTPUT + fi + + - name: Commit and push + if: steps.check.outputs.has_changes == 'true' + run: | + git config user.name "GitHub Actions" + git config user.email "actions@github.com" + git commit -m "Updating image labels in docker-compose" + git push From d845f180026f4d3d2397fd2f92b6f23ad974350e Mon Sep 17 00:00:00 2001 From: Steven Green Date: Wed, 12 Aug 2026 16:45:58 -0700 Subject: [PATCH 2/4] fixup -- changes left over from testing --- .github/workflows/build-docker-images.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml index 87f18fab..c93e2993 100644 --- a/.github/workflows/build-docker-images.yml +++ b/.github/workflows/build-docker-images.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository when push - if: github.event_name == 'push' + if: github.event_name == 'pull_request' uses: actions/checkout@v6 with: submodules: recursive From e9a2253c3d042c9a1f3c7a53b8f455a1b6929c7d Mon Sep 17 00:00:00 2001 From: Steven Green Date: Wed, 12 Aug 2026 16:54:34 -0700 Subject: [PATCH 3/4] fixup --- .github/workflows/build-docker-images.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml index c93e2993..a31c8494 100644 --- a/.github/workflows/build-docker-images.yml +++ b/.github/workflows/build-docker-images.yml @@ -19,6 +19,7 @@ jobs: if: github.event_name == 'pull_request' uses: actions/checkout@v6 with: + ref: ${{ github.head_ref }} submodules: recursive fetch-depth: 1 @@ -101,13 +102,13 @@ jobs: - name: Ensure backend sha is used in docker-compose env: - SHORT_HASH: steps.backend_tag.outputs.tag + SHORT_HASH: ${{ steps.backend_tag.outputs.tag }} run: sed -i "s/backend:[a-z0-9]\{7\}/backend:${SHORT_HASH}/" docker-compose.yml - name: Ensure frontend sha is used in docker-compose env: - SHORT_HASH: steps.frontend.outputs.tag + SHORT_HASH: ${{ steps.frontend.outputs.tag }} run: sed -i "s/frontend:[a-z0-9]\{7\}/frontend:${SHORT_HASH}/" docker-compose.yml @@ -130,4 +131,4 @@ jobs: git config user.name "GitHub Actions" git config user.email "actions@github.com" git commit -m "Updating image labels in docker-compose" - git push + git push origin ${{ github.head_ref }} From 95c381c746094f9c4afccb0076fe8cc142b38279 Mon Sep 17 00:00:00 2001 From: Steven Green Date: Wed, 12 Aug 2026 16:56:39 -0700 Subject: [PATCH 4/4] fixup --- .github/workflows/build-docker-images.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml index a31c8494..3744c42a 100644 --- a/.github/workflows/build-docker-images.yml +++ b/.github/workflows/build-docker-images.yml @@ -5,7 +5,7 @@ on: inputs: target_branch_or_tag: required: true - pull_request: + push: jobs: build-images: @@ -16,10 +16,9 @@ jobs: steps: - name: Checkout repository when push - if: github.event_name == 'pull_request' + if: github.event_name == 'push' uses: actions/checkout@v6 with: - ref: ${{ github.head_ref }} submodules: recursive fetch-depth: 1 @@ -131,4 +130,4 @@ jobs: git config user.name "GitHub Actions" git config user.email "actions@github.com" git commit -m "Updating image labels in docker-compose" - git push origin ${{ github.head_ref }} + git push