ci: support docker buildx

.github/workflows/dev.yml

@@ -97,10 +97,24 @@ jobs:
 
       - run: context=prod task docker:test
 
-      - run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASS }}
+      - uses: docker/setup-qemu-action@v2
-      - run: context=prod tag=develop task docker:build
-      - run: tag=develop task docker:push
 
+      - uses: docker/setup-buildx-action@v2
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          file: ./deployment/docker/dev/buildx.Dockerfile
+          push: true
+          tags: semaphoreui/semaphore:develop
 
 
 

.github/workflows/release.yml

@@ -5,31 +5,31 @@ on:
       - v*
 
 jobs:
-  release:
+#  release:
-    runs-on: [ubuntu-latest]
+#    runs-on: [ubuntu-latest]
-    steps:
+#    steps:
-      - uses: actions/setup-go@v3
+#      - uses: actions/setup-go@v3
-        with: { go-version: 1.18 }
+#        with: { go-version: 1.18 }
-
+#
-      - uses: actions/setup-node@v3
+#      - uses: actions/setup-node@v3
-        with: { node-version: '16' }
+#        with: { node-version: '16' }
-
+#
-      - run: go install github.com/go-task/task/v3/cmd/task@latest
+#      - run: go install github.com/go-task/task/v3/cmd/task@latest
-
+#
-      - run: sudo apt update && sudo apt-get install rpm
+#      - run: sudo apt update && sudo apt-get install rpm
-
+#
-      - uses: actions/checkout@v3
+#      - uses: actions/checkout@v3
-
+#
-      - run: task deps
+#      - run: task deps
-
+#
-      - run: |
+#      - run: |
-          echo ${{ secrets.GPG_KEY }} | tr " " "\n" | base64 -d | gpg --import --batch
+#          echo ${{ secrets.GPG_KEY }} | tr " " "\n" | base64 -d | gpg --import --batch
-          gpg --sign -u "58A7 CC3D 8A9C A2E5 BB5C 141D 4064 23EA F814 63CA" --pinentry-mode loopback --yes --batch --passphrase "${{ secrets.GPG_PASS }}" --output unlock.sig --detach-sign README.md
+#          gpg --sign -u "58A7 CC3D 8A9C A2E5 BB5C 141D 4064 23EA F814 63CA" --pinentry-mode loopback --yes --batch --passphrase "${{ secrets.GPG_PASS }}" --output unlock.sig --detach-sign README.md
-          rm -f unlock.sig
+#          rm -f unlock.sig
-
+#
-      - run:  git reset --hard
+#      - run:  git reset --hard
-
+#
-      - run: GITHUB_TOKEN=${{ secrets.GH_TOKEN }} task release:prod
+#      - run: GITHUB_TOKEN=${{ secrets.GH_TOKEN }} task release:prod
 
 
   deploy-prod:
@@ -44,8 +44,21 @@ jobs:
 
       - run: context=prod task docker:test
 
-      - run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASS }}
+      - uses: docker/setup-qemu-action@v2
-      - run: context=prod tag=latest task docker:build
+
-      - run: tag=latest task docker:push
+      - uses: docker/setup-buildx-action@v2
-      - run: docker tag semaphoreui/semaphore:latest semaphoreui/semaphore:${{ github.ref_name }}
+
-      - run: tag=${{ github.ref_name }} task docker:push
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          file: ./deployment/docker/prod/buildx.Dockerfile
+          push: true
+          tags: semaphoreui/semaphore:latest,semaphoreui/semaphore:${{ github.ref_name }}

Taskfile.yml

@@ -262,6 +262,18 @@ tasks:
           tag: "{{ .tag }}"
           args: -t "{{ .docker_namespace }}/{{ .docker_image }}:{{ .tag }}" .
 
+  docker:buildx:
+    desc: Build a multiarch image for Semaphore, requires context
+    vars:
+      tag: "{{ if .tag }}{{ .tag }}{{ else }}latest{{ end }}"
+    cmds:
+      - task: docker
+        vars:
+          context: "{{ .context }}"
+          action: buildx build
+          tag: "{{ .tag }}"
+          args: --platform=linux/amd64,linux/arm64 -t "{{ .docker_namespace }}/{{ .docker_image }}:{{ .tag }}" .
+
   deps:docker:
     desc: Install docker testing dependencies. These must be installed explicitly and are not included in the general deps task.
     status:
@@ -273,7 +285,7 @@ tasks:
       - sudo chmod +rx /usr/local/bin/goss
       - sudo curl -L https://raw.githubusercontent.com/aelsabbahy/goss/v0.3.5/extras/dgoss/dgoss -o /usr/local/bin/dgoss
       - sudo chmod +rx /usr/local/bin/dgoss
-      - sudo curl -L https://github.com/hadolint/hadolint/releases/download/v1.5.0/hadolint-Linux-x86_64 -o /usr/local/bin/hadolint
+      - sudo curl -L https://github.com/hadolint/hadolint/releases/download/v2.10.0/hadolint-Linux-x86_64 -o /usr/local/bin/hadolint
       - sudo chmod +rx /usr/local/bin/hadolint
 
   docker:test:

deployment/docker/dev/buildx.Dockerfile

@@ -0,0 +1,47 @@
+ARG BUILDPLATFORM=linux/amd64
+
+FROM --platform=$BUILDPLATFORM golang:1.18.3-alpine3.16
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV GOOS="${TARGETOS}"
+ENV GOARCH="${TARGETARCH}"
+
+ENV SEMAPHORE_VERSION="development" SEMAPHORE_ARCH="${TARGETOS}_${TARGETARCH}" \
+    SEMAPHORE_CONFIG_PATH="${SEMAPHORE_CONFIG_PATH:-/etc/semaphore}" \
+    APP_ROOT="/go/src/github.com/ansible-semaphore/semaphore/"
+
+# hadolint ignore=DL3013
+RUN apk add --no-cache sshpass git mysql-client python3 py3-pip py-openssl openssl ca-certificates curl curl-dev openssh-client-default tini nodejs npm bash rsync && \
+    apk --update add --virtual build-dependencies python3-dev libffi-dev openssl-dev build-base &&\
+    rm -rf /var/cache/apk/*
+
+RUN pip3 install --upgrade pip cffi   && \
+    pip3 install ansible &&\
+    apk del build-dependencies
+
+RUN adduser -D -u 1002 -g 0 semaphore && \
+    mkdir -p /go/src/github.com/ansible-semaphore/semaphore && \
+    mkdir -p /tmp/semaphore && \
+    mkdir -p /etc/semaphore && \
+    mkdir -p /var/lib/semaphore && \
+    chown -R semaphore:0 /go && \
+    chown -R semaphore:0 /tmp/semaphore && \
+    chown -R semaphore:0 /etc/semaphore && \
+    chown -R semaphore:0 /var/lib/semaphore && \
+    ssh-keygen -t rsa -q -f "/root/.ssh/id_rsa" -N ""       && \
+    ssh-keyscan -H github.com > /root/.ssh/known_hosts
+
+RUN cd $(go env GOPATH) && curl -sL https://taskfile.dev/install.sh | sh
+
+RUN git config --global --add safe.directory /go/src/github.com/ansible-semaphore/semaphore
+
+# Copy in app source
+WORKDIR ${APP_ROOT}
+COPY . ${APP_ROOT}
+RUN deployment/docker/dev/bin/install
+
+USER semaphore
+EXPOSE 3000
+ENTRYPOINT ["/usr/local/bin/semaphore-wrapper"]
+CMD ["./bin/semaphore", "server", "--config", "/etc/semaphore/config.json"]

deployment/docker/prod/Dockerfile

@@ -1,10 +1,17 @@
+ARG BUILDPLATFORM=linux/amd64
+
 # ansible-semaphore production image
-FROM golang:1.18.3-alpine3.16 as builder
+FROM --platform=$BUILDPLATFORM golang:1.18.3-alpine3.16 as builder
 
 
 COPY ./ /go/src/github.com/ansible-semaphore/semaphore
 WORKDIR /go/src/github.com/ansible-semaphore/semaphore
 
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV GOOS="${TARGETOS}" 
+ENV GOARCH="${TARGETARCH}"
+
 RUN apk add --no-cache -U libc-dev curl nodejs npm git && \
   ./deployment/docker/prod/bin/install
 

deployment/docker/prod/buildx.Dockerfile

@@ -0,0 +1,42 @@
+ARG BUILDPLATFORM=linux/amd64
+
+# ansible-semaphore production image
+FROM --platform=$BUILDPLATFORM golang:1.18.3-alpine3.16 as builder
+
+
+COPY ./ /go/src/github.com/ansible-semaphore/semaphore
+WORKDIR /go/src/github.com/ansible-semaphore/semaphore
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+ENV GOOS="${TARGETOS}" 
+ENV GOARCH="${TARGETARCH}"
+
+RUN apk add --no-cache -U libc-dev curl nodejs npm git && \
+  ./deployment/docker/prod/bin/install
+
+# Uses frolvlad alpine so we have access to glibc which is needed for golang
+# and when deploying in openshift
+FROM frolvlad/alpine-glibc:alpine-3.16 as runner
+LABEL maintainer="Tom Whiston <tom.whiston@gmail.com>"
+
+RUN apk add --no-cache sshpass git curl ansible mysql-client openssh-client-default tini py3-aiohttp && \
+    adduser -D -u 1001 -G root semaphore && \
+    mkdir -p /tmp/semaphore && \
+    mkdir -p /etc/semaphore && \
+    mkdir -p /var/lib/semaphore && \
+    chown -R semaphore:0 /tmp/semaphore && \
+    chown -R semaphore:0 /etc/semaphore && \
+    chown -R semaphore:0 /var/lib/semaphore
+
+COPY --from=builder /usr/local/bin/semaphore-wrapper /usr/local/bin/
+COPY --from=builder /usr/local/bin/semaphore /usr/local/bin/
+
+RUN chown -R semaphore:0 /usr/local/bin/semaphore-wrapper &&\
+    chown -R semaphore:0 /usr/local/bin/semaphore
+
+WORKDIR /home/semaphore
+USER 1001
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["/usr/local/bin/semaphore-wrapper", "/usr/local/bin/semaphore", "server", "--config", "/etc/semaphore/config.json"]