diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml index 6309d7a5..18b020c7 100644 --- a/.github/workflows/dev.yml +++ b/.github/workflows/dev.yml @@ -97,10 +97,24 @@ jobs: - run: context=prod task docker:test - - run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASS }} - - run: context=prod tag=develop task docker:build - - run: tag=develop task docker:push + - uses: docker/setup-qemu-action@v2 + - uses: docker/setup-buildx-action@v2 + + - name: Login to Docker Hub + uses: docker/login-action@v2 + with: + username: ${{ secrets.DOCKER_USER }} + password: ${{ secrets.DOCKER_PASS }} + + - name: Build and push + uses: docker/build-push-action@v3 + with: + context: . + platforms: linux/amd64,linux/arm64 + file: ./deployment/docker/dev/buildx.Dockerfile + push: true + tags: semaphoreui/semaphore:develop diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e1f76d27..71e5db69 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,31 +5,31 @@ on: - v* jobs: - release: - runs-on: [ubuntu-latest] - steps: - - uses: actions/setup-go@v3 - with: { go-version: 1.18 } - - - uses: actions/setup-node@v3 - with: { node-version: '16' } - - - run: go install github.com/go-task/task/v3/cmd/task@latest - - - run: sudo apt update && sudo apt-get install rpm - - - uses: actions/checkout@v3 - - - run: task deps - - - run: | - echo ${{ secrets.GPG_KEY }} | tr " " "\n" | base64 -d | gpg --import --batch - gpg --sign -u "58A7 CC3D 8A9C A2E5 BB5C 141D 4064 23EA F814 63CA" --pinentry-mode loopback --yes --batch --passphrase "${{ secrets.GPG_PASS }}" --output unlock.sig --detach-sign README.md - rm -f unlock.sig - - - run: git reset --hard - - - run: GITHUB_TOKEN=${{ secrets.GH_TOKEN }} task release:prod +# release: +# runs-on: [ubuntu-latest] +# steps: +# - uses: actions/setup-go@v3 +# with: { go-version: 1.18 } +# +# - uses: actions/setup-node@v3 +# with: { node-version: '16' } +# +# - run: go install github.com/go-task/task/v3/cmd/task@latest +# +# - run: sudo apt update && sudo apt-get install rpm +# +# - uses: actions/checkout@v3 +# +# - run: task deps +# +# - run: | +# echo ${{ secrets.GPG_KEY }} | tr " " "\n" | base64 -d | gpg --import --batch +# gpg --sign -u "58A7 CC3D 8A9C A2E5 BB5C 141D 4064 23EA F814 63CA" --pinentry-mode loopback --yes --batch --passphrase "${{ secrets.GPG_PASS }}" --output unlock.sig --detach-sign README.md +# rm -f unlock.sig +# +# - run: git reset --hard +# +# - run: GITHUB_TOKEN=${{ secrets.GH_TOKEN }} task release:prod deploy-prod: @@ -44,8 +44,21 @@ jobs: - run: context=prod task docker:test - - run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASS }} - - run: context=prod tag=latest task docker:build - - run: tag=latest task docker:push - - run: docker tag semaphoreui/semaphore:latest semaphoreui/semaphore:${{ github.ref_name }} - - run: tag=${{ github.ref_name }} task docker:push + - uses: docker/setup-qemu-action@v2 + + - uses: docker/setup-buildx-action@v2 + + - name: Login to Docker Hub + uses: docker/login-action@v2 + with: + username: ${{ secrets.DOCKER_USER }} + password: ${{ secrets.DOCKER_PASS }} + + - name: Build and push + uses: docker/build-push-action@v3 + with: + context: . + platforms: linux/amd64,linux/arm64 + file: ./deployment/docker/prod/buildx.Dockerfile + push: true + tags: semaphoreui/semaphore:latest,semaphoreui/semaphore:${{ github.ref_name }} \ No newline at end of file diff --git a/Taskfile.yml b/Taskfile.yml index d8280cec..8eec220a 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -262,6 +262,18 @@ tasks: tag: "{{ .tag }}" args: -t "{{ .docker_namespace }}/{{ .docker_image }}:{{ .tag }}" . + docker:buildx: + desc: Build a multiarch image for Semaphore, requires context + vars: + tag: "{{ if .tag }}{{ .tag }}{{ else }}latest{{ end }}" + cmds: + - task: docker + vars: + context: "{{ .context }}" + action: buildx build + tag: "{{ .tag }}" + args: --platform=linux/amd64,linux/arm64 -t "{{ .docker_namespace }}/{{ .docker_image }}:{{ .tag }}" . + deps:docker: desc: Install docker testing dependencies. These must be installed explicitly and are not included in the general deps task. status: @@ -273,7 +285,7 @@ tasks: - sudo chmod +rx /usr/local/bin/goss - sudo curl -L https://raw.githubusercontent.com/aelsabbahy/goss/v0.3.5/extras/dgoss/dgoss -o /usr/local/bin/dgoss - sudo chmod +rx /usr/local/bin/dgoss - - sudo curl -L https://github.com/hadolint/hadolint/releases/download/v1.5.0/hadolint-Linux-x86_64 -o /usr/local/bin/hadolint + - sudo curl -L https://github.com/hadolint/hadolint/releases/download/v2.10.0/hadolint-Linux-x86_64 -o /usr/local/bin/hadolint - sudo chmod +rx /usr/local/bin/hadolint docker:test: diff --git a/deployment/docker/dev/buildx.Dockerfile b/deployment/docker/dev/buildx.Dockerfile new file mode 100644 index 00000000..4506dad5 --- /dev/null +++ b/deployment/docker/dev/buildx.Dockerfile @@ -0,0 +1,47 @@ +ARG BUILDPLATFORM=linux/amd64 + +FROM --platform=$BUILDPLATFORM golang:1.18.3-alpine3.16 + +ARG TARGETOS=linux +ARG TARGETARCH=amd64 +ENV GOOS="${TARGETOS}" +ENV GOARCH="${TARGETARCH}" + +ENV SEMAPHORE_VERSION="development" SEMAPHORE_ARCH="${TARGETOS}_${TARGETARCH}" \ + SEMAPHORE_CONFIG_PATH="${SEMAPHORE_CONFIG_PATH:-/etc/semaphore}" \ + APP_ROOT="/go/src/github.com/ansible-semaphore/semaphore/" + +# hadolint ignore=DL3013 +RUN apk add --no-cache sshpass git mysql-client python3 py3-pip py-openssl openssl ca-certificates curl curl-dev openssh-client-default tini nodejs npm bash rsync && \ + apk --update add --virtual build-dependencies python3-dev libffi-dev openssl-dev build-base &&\ + rm -rf /var/cache/apk/* + +RUN pip3 install --upgrade pip cffi && \ + pip3 install ansible &&\ + apk del build-dependencies + +RUN adduser -D -u 1002 -g 0 semaphore && \ + mkdir -p /go/src/github.com/ansible-semaphore/semaphore && \ + mkdir -p /tmp/semaphore && \ + mkdir -p /etc/semaphore && \ + mkdir -p /var/lib/semaphore && \ + chown -R semaphore:0 /go && \ + chown -R semaphore:0 /tmp/semaphore && \ + chown -R semaphore:0 /etc/semaphore && \ + chown -R semaphore:0 /var/lib/semaphore && \ + ssh-keygen -t rsa -q -f "/root/.ssh/id_rsa" -N "" && \ + ssh-keyscan -H github.com > /root/.ssh/known_hosts + +RUN cd $(go env GOPATH) && curl -sL https://taskfile.dev/install.sh | sh + +RUN git config --global --add safe.directory /go/src/github.com/ansible-semaphore/semaphore + +# Copy in app source +WORKDIR ${APP_ROOT} +COPY . ${APP_ROOT} +RUN deployment/docker/dev/bin/install + +USER semaphore +EXPOSE 3000 +ENTRYPOINT ["/usr/local/bin/semaphore-wrapper"] +CMD ["./bin/semaphore", "server", "--config", "/etc/semaphore/config.json"] diff --git a/deployment/docker/prod/Dockerfile b/deployment/docker/prod/Dockerfile index 37e7210c..39a9d098 100644 --- a/deployment/docker/prod/Dockerfile +++ b/deployment/docker/prod/Dockerfile @@ -1,10 +1,17 @@ +ARG BUILDPLATFORM=linux/amd64 + # ansible-semaphore production image -FROM golang:1.18.3-alpine3.16 as builder +FROM --platform=$BUILDPLATFORM golang:1.18.3-alpine3.16 as builder COPY ./ /go/src/github.com/ansible-semaphore/semaphore WORKDIR /go/src/github.com/ansible-semaphore/semaphore +ARG TARGETOS=linux +ARG TARGETARCH=amd64 +ENV GOOS="${TARGETOS}" +ENV GOARCH="${TARGETARCH}" + RUN apk add --no-cache -U libc-dev curl nodejs npm git && \ ./deployment/docker/prod/bin/install diff --git a/deployment/docker/prod/buildx.Dockerfile b/deployment/docker/prod/buildx.Dockerfile new file mode 100644 index 00000000..39a9d098 --- /dev/null +++ b/deployment/docker/prod/buildx.Dockerfile @@ -0,0 +1,42 @@ +ARG BUILDPLATFORM=linux/amd64 + +# ansible-semaphore production image +FROM --platform=$BUILDPLATFORM golang:1.18.3-alpine3.16 as builder + + +COPY ./ /go/src/github.com/ansible-semaphore/semaphore +WORKDIR /go/src/github.com/ansible-semaphore/semaphore + +ARG TARGETOS=linux +ARG TARGETARCH=amd64 +ENV GOOS="${TARGETOS}" +ENV GOARCH="${TARGETARCH}" + +RUN apk add --no-cache -U libc-dev curl nodejs npm git && \ + ./deployment/docker/prod/bin/install + +# Uses frolvlad alpine so we have access to glibc which is needed for golang +# and when deploying in openshift +FROM frolvlad/alpine-glibc:alpine-3.16 as runner +LABEL maintainer="Tom Whiston " + +RUN apk add --no-cache sshpass git curl ansible mysql-client openssh-client-default tini py3-aiohttp && \ + adduser -D -u 1001 -G root semaphore && \ + mkdir -p /tmp/semaphore && \ + mkdir -p /etc/semaphore && \ + mkdir -p /var/lib/semaphore && \ + chown -R semaphore:0 /tmp/semaphore && \ + chown -R semaphore:0 /etc/semaphore && \ + chown -R semaphore:0 /var/lib/semaphore + +COPY --from=builder /usr/local/bin/semaphore-wrapper /usr/local/bin/ +COPY --from=builder /usr/local/bin/semaphore /usr/local/bin/ + +RUN chown -R semaphore:0 /usr/local/bin/semaphore-wrapper &&\ + chown -R semaphore:0 /usr/local/bin/semaphore + +WORKDIR /home/semaphore +USER 1001 + +ENTRYPOINT ["/sbin/tini", "--"] +CMD ["/usr/local/bin/semaphore-wrapper", "/usr/local/bin/semaphore", "server", "--config", "/etc/semaphore/config.json"]