From 745983dfc057c6b645cad93190be9fab0058208e Mon Sep 17 00:00:00 2001 From: Sergei Zimmerman Date: Sun, 28 Dec 2025 02:21:52 +0300 Subject: [PATCH 1/3] ci: Move docker_push_image into a separate workflow Best reviewed with -w --color-moved. This just moves the code into a separate workflow. This will allow us to reuse it in the release job for github releng of releases. --- .github/workflows/ci.yml | 76 +++------------------------- .github/workflows/docker-push.yml | 84 +++++++++++++++++++++++++++++++ 2 files changed, 91 insertions(+), 69 deletions(-) create mode 100644 .github/workflows/docker-push.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 689a6f6a4..14cf6f418 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -197,79 +197,17 @@ jobs: - run: exec bash -c "nix-channel --add https://releases.nixos.org/nixos/unstable/nixos-23.05pre466020.60c1d71f2ba nixpkgs" - run: exec bash -c "nix-channel --update && nix-env -iA nixpkgs.hello && hello" - # Steps to test CI automation in your own fork. - # 1. Sign-up for https://hub.docker.com/ - # 2. Store your dockerhub username as DOCKERHUB_USERNAME in "Repository secrets" of your fork repository settings (https://github.com/$githubuser/nix/settings/secrets/actions) - # 3. Create an access token in https://hub.docker.com/settings/security and store it as DOCKERHUB_TOKEN in "Repository secrets" of your fork - check_secrets: - permissions: - contents: none - name: Check presence of secrets - runs-on: ubuntu-24.04 - outputs: - docker: ${{ steps.secret.outputs.docker }} - steps: - - name: Check for DockerHub secrets - id: secret - env: - _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }} - run: | - echo "docker=${{ env._DOCKER_SECRETS != '' }}" >> $GITHUB_OUTPUT - docker_push_image: - needs: [tests, check_secrets] + name: Push docker image to DockerHub and GHCR + needs: [flake_regressions, installer_test] + if: github.event_name == 'push' && github.ref_name == 'master' + uses: ./.github/workflows/docker-push.yml permissions: contents: read packages: write - if: >- - needs.check_secrets.outputs.docker == 'true' && - github.event_name == 'push' && - github.ref_name == 'master' - runs-on: ubuntu-24.04 - steps: - - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - uses: ./.github/actions/install-nix-action - with: - dogfood: false - extra_nix_config: | - experimental-features = flakes nix-command - - run: echo NIX_VERSION="$(nix eval .\#nix.version | tr -d \")" >> $GITHUB_ENV - - run: nix build .#dockerImage -L - - run: docker load -i ./result/image.tar.gz - - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION - - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:master - # We'll deploy the newly built image to both Docker Hub and Github Container Registry. - # - # Push to Docker Hub first - - name: Login to Docker Hub - uses: docker/login-action@v3 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION - - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:master - # Push to GitHub Container Registry as well - - name: Login to GitHub Container Registry - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - name: Push image - run: | - IMAGE_ID=ghcr.io/${{ github.repository_owner }}/nix - # Change all uppercase to lowercase - IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]') - - docker tag nix:$NIX_VERSION $IMAGE_ID:$NIX_VERSION - docker tag nix:$NIX_VERSION $IMAGE_ID:latest - docker push $IMAGE_ID:$NIX_VERSION - docker push $IMAGE_ID:latest - # deprecated 2024-02-24 - docker tag nix:$NIX_VERSION $IMAGE_ID:master - docker push $IMAGE_ID:master + secrets: + DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} flake_regressions: needs: tests diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml new file mode 100644 index 000000000..152a8fa10 --- /dev/null +++ b/.github/workflows/docker-push.yml @@ -0,0 +1,84 @@ +name: "Push Docker Image" + +on: + workflow_call: + secrets: + DOCKERHUB_USERNAME: + required: true + DOCKERHUB_TOKEN: + required: true + +permissions: {} + +jobs: + # Steps to test CI automation in your own fork. + # 1. Sign-up for https://hub.docker.com/ + # 2. Store your dockerhub username as DOCKERHUB_USERNAME in "Repository secrets" of your fork repository settings (https://github.com/$githubuser/nix/settings/secrets/actions) + # 3. Create an access token in https://hub.docker.com/settings/security and store it as DOCKERHUB_TOKEN in "Repository secrets" of your fork + check_secrets: + permissions: + contents: none + name: Check presence of secrets + runs-on: ubuntu-24.04 + outputs: + docker: ${{ steps.secret.outputs.docker }} + steps: + - name: Check for DockerHub secrets + id: secret + env: + _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }} + run: | + echo "docker=${{ env._DOCKER_SECRETS != '' }}" >> $GITHUB_OUTPUT + + push: + name: Push docker image to DockerHub and GHCR + needs: [check_secrets] + permissions: + contents: read + packages: write + if: needs.check_secrets.outputs.docker == 'true' + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 0 + - uses: ./.github/actions/install-nix-action + with: + dogfood: false + extra_nix_config: | + experimental-features = flakes nix-command + - run: echo NIX_VERSION="$(nix eval .\#nix.version | tr -d \")" >> $GITHUB_ENV + - run: nix build .#dockerImage -L + - run: docker load -i ./result/image.tar.gz + - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION + - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:master + # We'll deploy the newly built image to both Docker Hub and Github Container Registry. + # + # Push to Docker Hub first + - name: Login to Docker Hub + uses: docker/login-action@v3 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION + - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:master + # Push to GitHub Container Registry as well + - name: Login to GitHub Container Registry + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + - name: Push image + run: | + IMAGE_ID=ghcr.io/${{ github.repository_owner }}/nix + # Change all uppercase to lowercase + IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]') + + docker tag nix:$NIX_VERSION $IMAGE_ID:$NIX_VERSION + docker tag nix:$NIX_VERSION $IMAGE_ID:latest + docker push $IMAGE_ID:$NIX_VERSION + docker push $IMAGE_ID:latest + # deprecated 2024-02-24 + docker tag nix:$NIX_VERSION $IMAGE_ID:master + docker push $IMAGE_ID:master From fb05f6de0d508225d0724c3e87052b5606a623d2 Mon Sep 17 00:00:00 2001 From: Sergei Zimmerman Date: Sun, 28 Dec 2025 02:36:54 +0300 Subject: [PATCH 2/3] ci: Pin actions in docker-push reusable workflow --- .github/workflows/docker-push.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml index 152a8fa10..450b06ea9 100644 --- a/.github/workflows/docker-push.yml +++ b/.github/workflows/docker-push.yml @@ -39,7 +39,7 @@ jobs: if: needs.check_secrets.outputs.docker == 'true' runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: fetch-depth: 0 - uses: ./.github/actions/install-nix-action @@ -56,7 +56,7 @@ jobs: # # Push to Docker Hub first - name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -64,7 +64,7 @@ jobs: - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:master # Push to GitHub Container Registry as well - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: registry: ghcr.io username: ${{ github.actor }} From c867ed6726ffd0cf739b14d08917b86fd3492ff2 Mon Sep 17 00:00:00 2001 From: Sergei Zimmerman Date: Sun, 28 Dec 2025 03:24:19 +0300 Subject: [PATCH 3/3] ci: Make docker-push workflow more configurable This should allow reusing this workflow (with more tweaks) in the releng workflow. --- .github/workflows/ci.yml | 3 +++ .github/workflows/docker-push.yml | 44 +++++++++++++++++++++++-------- 2 files changed, 36 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 14cf6f418..a3303e39b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -202,6 +202,9 @@ jobs: needs: [flake_regressions, installer_test] if: github.event_name == 'push' && github.ref_name == 'master' uses: ./.github/workflows/docker-push.yml + with: + ref: ${{ github.sha }} + is_master: true permissions: contents: read packages: write diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml index 450b06ea9..d83b391e5 100644 --- a/.github/workflows/docker-push.yml +++ b/.github/workflows/docker-push.yml @@ -2,6 +2,15 @@ name: "Push Docker Image" on: workflow_call: + inputs: + ref: + description: "Git ref to build the docker image from" + required: true + type: string + is_master: + description: "Whether run from master branch" + required: true + type: boolean secrets: DOCKERHUB_USERNAME: required: true @@ -42,6 +51,7 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: fetch-depth: 0 + ref: ${{ inputs.ref }} - uses: ./.github/actions/install-nix-action with: dogfood: false @@ -50,8 +60,6 @@ jobs: - run: echo NIX_VERSION="$(nix eval .\#nix.version | tr -d \")" >> $GITHUB_ENV - run: nix build .#dockerImage -L - run: docker load -i ./result/image.tar.gz - - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION - - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:master # We'll deploy the newly built image to both Docker Hub and Github Container Registry. # # Push to Docker Hub first @@ -60,8 +68,17 @@ jobs: with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION - - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:master + - name: Push to Docker Hub + env: + IS_MASTER: ${{ inputs.is_master }} + DOCKERHUB_REPO: ${{ secrets.DOCKERHUB_USERNAME }}/nix + run: | + docker tag nix:$NIX_VERSION $DOCKERHUB_REPO:$NIX_VERSION + docker push $DOCKERHUB_REPO:$NIX_VERSION + if [ "$IS_MASTER" = "true" ]; then + docker tag nix:$NIX_VERSION $DOCKERHUB_REPO:master + docker push $DOCKERHUB_REPO:master + fi # Push to GitHub Container Registry as well - name: Login to GitHub Container Registry uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 @@ -69,16 +86,21 @@ jobs: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - name: Push image + - name: Push to GHCR + env: + IS_MASTER: ${{ inputs.is_master }} run: | IMAGE_ID=ghcr.io/${{ github.repository_owner }}/nix - # Change all uppercase to lowercase IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]') docker tag nix:$NIX_VERSION $IMAGE_ID:$NIX_VERSION - docker tag nix:$NIX_VERSION $IMAGE_ID:latest docker push $IMAGE_ID:$NIX_VERSION - docker push $IMAGE_ID:latest - # deprecated 2024-02-24 - docker tag nix:$NIX_VERSION $IMAGE_ID:master - docker push $IMAGE_ID:master + if [ "$IS_MASTER" = "true" ]; then + # FIXME: Do not tag master as latest. Upload to GHCR as part of + # releng instead. Possibly adapt this reusable workflow for the (yet + # nonexistent) release workflow. + docker tag nix:$NIX_VERSION $IMAGE_ID:latest + docker tag nix:$NIX_VERSION $IMAGE_ID:master + docker push $IMAGE_ID:latest + docker push $IMAGE_ID:master + fi