2ccb8a9a56
Docker 28+ defaults to the containerd image store, which pushes layers uncompressed instead of gzip. The GHA runner image updated Docker to 29.x (actions/runner-images#13633), causing the `nixos/nix:2.33.3` image to balloon from 138 MB to 505 MB, with all 70 layers pushed as `application/vnd.docker.image.rootfs.diff.tar` instead of `.tar.gzip`. OCI clients that only support gzip (e.g. `go-containerregistry`, used by Concourse CI) fail with "gzip: invalid header". This commit disables the containerd snapshotter in the release workflow before any Docker operations, restoring the classic storage driver that preserves gzip compression through the `docker load` / `docker push` pipeline. Fixes #15246
81 lines
3.2 KiB
YAML
81 lines
3.2 KiB
YAML
name: Upload Release
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
eval_id:
|
|
description: "Hydra evaluation ID"
|
|
required: true
|
|
type: number
|
|
is_latest:
|
|
description: "Mark as latest release"
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
packages: write
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-24.04
|
|
environment: releases
|
|
steps:
|
|
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
|
|
- uses: ./.github/actions/install-nix-action
|
|
with:
|
|
dogfood: false # Use stable version
|
|
use_cache: false # Don't want any cache injection shenanigans
|
|
extra_nix_config: |
|
|
experimental-features = nix-command flakes
|
|
- name: Set NIX_PATH from flake input
|
|
run: |
|
|
NIXPKGS_PATH=$(nix build --inputs-from .# nixpkgs#path --print-out-paths --no-link)
|
|
# Shebangs with perl have issues. Pin nixpkgs this way. nix shell should maybe
|
|
# get the same uberhack that nix-shell has to support it.
|
|
echo "NIX_PATH=nixpkgs=$NIXPKGS_PATH" >> "$GITHUB_ENV"
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
|
|
with:
|
|
role-to-assume: "arn:aws:iam::080433136561:role/nix-release"
|
|
role-session-name: nix-release-oidc-${{ github.run_id }}
|
|
aws-region: eu-west-1
|
|
- name: Disable containerd image store
|
|
run: |
|
|
# Docker 28+ defaults to the containerd image store, which
|
|
# pushes layers uncompressed instead of gzip. OCI clients
|
|
# that only support gzip (e.g. go-containerregistry) fail
|
|
# with "gzip: invalid header". Disabling the containerd
|
|
# snapshotter restores the classic storage driver, which
|
|
# preserves gzip-compressed layers through the
|
|
# `docker load` / `docker push` pipeline.
|
|
echo '{"features":{"containerd-snapshotter":false}}' | sudo tee /etc/docker/daemon.json > /dev/null
|
|
sudo systemctl restart docker
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Upload release
|
|
run: |
|
|
./maintainers/upload-release.pl \
|
|
${{ inputs.eval_id }} \
|
|
--skip-git
|
|
env:
|
|
IS_LATEST: ${{ inputs.is_latest && '1' || '' }}
|
|
- name: Push to GHCR
|
|
run: |
|
|
DOCKER_OWNER="ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[A-Z]' '[a-z]')/nix"
|
|
./maintainers/upload-release.pl \
|
|
${{ inputs.eval_id }} \
|
|
--skip-git \
|
|
--skip-s3 \
|
|
--docker-owner "$DOCKER_OWNER"
|
|
env:
|
|
IS_LATEST: ${{ inputs.is_latest && '1' || '' }}
|