ci: fix ptrace perms #128
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build, Test, and (if needed) Publish Image | |
| on: | |
| push: | |
| branches: | |
| - master | |
| - dev | |
| release: | |
| types: ['published'] | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| x86-build-and-push-image: | |
| runs-on: ubuntu-22.04 | |
| # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job. | |
| permissions: | |
| contents: read | |
| packages: write | |
| # | |
| steps: | |
| - uses: docker/[email protected] | |
| with: | |
| driver-opts: image=moby/buildkit | |
| - uses: docker/[email protected] | |
| id: meta | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=sha,format=long | |
| type=semver,pattern={{version}} | |
| - uses: docker/[email protected] | |
| if: github.event_name != 'pull_request' | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ github.token }} | |
| - name: Build image (X86) | |
| id: build | |
| uses: docker/[email protected] | |
| with: | |
| load: true | |
| push: false | |
| tags: pyda_tmp | |
| platforms: linux/amd64 | |
| provenance: false | |
| cache-from: type=gha | |
| - name: Test (X86) | |
| run: | | |
| docker run --cap-add=SYS_PTRACE -e PYTHONUNBUFFERED=1 --rm --workdir /opt/pyda/tests --entrypoint python3 pyda_tmp run_tests.py --debug | |
| - name: Push image | |
| uses: docker/[email protected] | |
| if: github.event_name != 'pull_request' | |
| with: | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| platforms: linux/amd64 | |
| provenance: false | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Export digest | |
| run: | | |
| rm -rf /tmp/digests | |
| mkdir -p /tmp/digests | |
| digest="${{ steps.build.outputs.digest }}" | |
| touch "/tmp/digests/${digest#sha256:}" | |
| - name: Upload digest | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: digests-linux-amd64 | |
| path: /tmp/digests/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| arm64-build-and-push-image: | |
| runs-on: [self-hosted, linux, arm64] | |
| # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job. | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: docker/[email protected] | |
| with: | |
| driver-opts: image=moby/buildkit | |
| - uses: docker/[email protected] | |
| id: meta | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=sha,format=long | |
| type=semver,pattern={{version}} | |
| - uses: docker/[email protected] | |
| if: github.event_name != 'pull_request' | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ github.token }} | |
| - name: Build image (ARM64) | |
| id: build | |
| uses: docker/[email protected] | |
| with: | |
| load: true | |
| push: false | |
| tags: pyda_tmp | |
| platforms: linux/arm64 | |
| provenance: false | |
| cache-from: type=gha | |
| - name: Push image | |
| uses: docker/[email protected] | |
| if: github.event_name != 'pull_request' | |
| with: | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| platforms: linux/arm64 | |
| provenance: false | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Export digest | |
| run: | | |
| rm -rf /tmp/digests | |
| mkdir -p /tmp/digests | |
| digest="${{ steps.build.outputs.digest }}" | |
| touch "/tmp/digests/${digest#sha256:}" | |
| - name: Upload digest | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: digests-linux-arm64 | |
| path: /tmp/digests/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| # Attempt to merge the two architecture images into a single image | |
| merge: | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| packages: write | |
| needs: | |
| - x86-build-and-push-image | |
| - arm64-build-and-push-image | |
| if: github.event_name != 'pull_request' | |
| steps: | |
| - name: Download digests | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: /tmp/digests | |
| pattern: digests-* | |
| merge-multiple: true | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - uses: docker/metadata-action@v5 | |
| id: meta | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=sha,format=long | |
| type=semver,pattern={{version}} | |
| - uses: docker/[email protected] | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ github.token }} | |
| - name: Create manifest list and push | |
| working-directory: /tmp/digests | |
| run: | | |
| docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | |
| $(printf 'ghcr.io/${{ github.repository }}@sha256:%s ' *) | |
| - name: Inspect image | |
| run: | | |
| docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ steps.meta.outputs.version }} | |