From 715f97630f158ee23d191157590e7b0a7bbcc5eb Mon Sep 17 00:00:00 2001 From: hiddify <114227601+hiddify-com@users.noreply.github.com> Date: Sun, 29 Sep 2024 11:48:17 +0200 Subject: [PATCH] new: better docker management and add more supported platforms --- .github/workflows/release.yml | 151 +++++++++++++++++++--------------- docker/Dockerfile | 5 +- 2 files changed, 88 insertions(+), 68 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 51f8568..b0f7b83 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,6 +11,9 @@ on: - '.github/**' - '!.github/workflows/release.yml' +env: + REGISTRY_IMAGE: ghcr.io/hiddify/hiddify-core + jobs: build: permissions: write-all @@ -165,97 +168,111 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: tag_name: ${{ github.ref_name }} + files: bin/*.tar.gz + + + + + + + + + + make-upload-docker: permissions: write-all if: ${{ github.ref_type=='tag' }} needs: [upload-release] + runs-on: ubuntu-latest - # permissions: - # contents: read - # packages: write - # # This is used to complete the identity challenge - # # with sigstore/fulcio when running outside of PRs. - # id-token: write + strategy: + fail-fast: true + matrix: + platform: + - linux/amd64 + - linux/arm/v5 + - linux/arm/v6 + - linux/arm/v7 + - linux/arm64 + - linux/386 + # - linux/ppc64le + # - linux/riscv64 + - linux/s390x steps: - - uses: actions/download-artifact@v4 - with: - merge-multiple: true - pattern: hiddify-* - path: bin/ - - - - name: Checkout repository - uses: actions/checkout@v3 - - # Install the cosign tool except on PR - # https://github.com/sigstore/cosign-installer - - name: Install cosign - - uses: sigstore/cosign-installer@v3 - with: - cosign-release: 'v2.1.1' - - # Set up BuildKit Docker container builder to be able to build - # multi-platform images and export cache - # https://github.com/docker/setup-buildx-action - - name: Set up Docker Buildx + - name: Prepare + run: | + platform=${{ matrix.platform }} + echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV + - name: Setup QEMU + uses: docker/setup-qemu-action@v3 + - name: Setup Docker Buildx uses: docker/setup-buildx-action@v3 - - # Login against a Docker registry except on PR - # https://github.com/docker/login-action - - name: Log into registry ghcr.io - uses: docker/login-action@v3 + - name: Login to GitHub Container Registry + uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - - # Extract metadata (tags, labels) for Docker - # https://github.com/docker/metadata-action - - name: Extract Docker metadata + - name: Docker meta id: meta uses: docker/metadata-action@v5 with: - images: ghcr.io/hiddify/hiddify-core - - # Build and push Docker image with Buildx (don't push on PR) - # https://github.com/docker/build-push-action - - name: Build and push Docker image - id: build-and-push + images: ${{ env.REGISTRY_IMAGE }} + - name: Build and push by digest + id: build uses: docker/build-push-action@v6 with: + platforms: ${{ matrix.platform }} context: ./docker/ - push: true - tags: ${{ steps.meta.outputs.tags }} + build-args: | + BUILDKIT_CONTEXT_KEEP_GIT_DIR=1 labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - + outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true - name: Export digest run: | mkdir -p /tmp/digests - digest="${{ steps.build-and-push.outputs.digest }}" + digest="${{ steps.build.outputs.digest }}" touch "/tmp/digests/${digest#sha256:}" - name: Upload digest uses: actions/upload-artifact@v4 with: - name: digests - path: /tmp/digests/* - if-no-files-found: error - retention-days: 1 - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data even for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign - - name: Sign the published Docker image - env: - # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable - TAGS: ${{ steps.meta.outputs.tags }} - DIGEST: ${{ steps.build-and-push.outputs.digest }} - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} - \ No newline at end of file + name: digests-${{ env.PLATFORM_PAIR }} + path: /tmp/digests/* + if-no-files-found: error + retention-days: 1 + merge: + permissions: write-all + runs-on: ubuntu-latest + needs: + - make-upload-docker + env: + LATEST: ${{ endsWith(github.ref_name, 'dev') && 'beta' ||'latest'}} + steps: + - name: Download digests + uses: actions/download-artifact@v4 + with: + path: /tmp/digests + pattern: digests-* + merge-multiple: true + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Login to GitHub Container Registry + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + - name: Create manifest list and push + working-directory: /tmp/digests + run: | + docker buildx imagetools create \ + -t "${{ env.REGISTRY_IMAGE }}:${{ env.LATEST }}" \ + -t "${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}" \ + $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *) + - name: Inspect image + + run: | + docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ env.LATEST }} + docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }} diff --git a/docker/Dockerfile b/docker/Dockerfile index 5b53a63..e3ac6d7 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -7,8 +7,11 @@ RUN apk add curl tar gzip libc6-compat # iptables ip6tables RUN case "$(apk --print-arch)" in \ x86_64) ARCH=amd64 ;; \ i386) ARCH=386 ;; \ - armv7) ARCH=arm ;; \ aarch64) ARCH=arm64 ;; \ + armv7) ARCH=armv7 ;; \ + armv6) ARCH=armv6 ;; + armv5) ARCH=armv5 ;; + s390x) ARCH=s390x ;;\ *) echo "Unsupported architecture: $(apk --print-arch) $(uname -m)" && exit 1 ;; \ esac && \ curl -L -o hiddify-cli.tar.gz https://github.com/hiddify/hiddify-core/releases/download/${VERSION}/hiddify-cli-linux-$ARCH.tar.gz && \