From d637cc97d34fcd5957d22aa98e8b3016cf6e0f09 Mon Sep 17 00:00:00 2001 From: Timo Reymann Date: Wed, 9 Sep 2026 22:21:25 +0200 Subject: [PATCH] feat: add minimal node image to verify tag_ranges works MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds _base/images/node, a deliberately trivial image (FROM scratch, one ARG, one LABEL - no install step) whose only purpose is to prove ContainerHive/ContainerHive#241's tag_ranges resolves a real version from Docker Hub at discovery time and threads it through as the NODEJS_VERSION build arg: tag_ranges: - tag_name: "{{.full}}" source: type: dockerhub image: library/node select: major: { last: 1 } minor: { last: 1 } patch: { last: 1 } versions: nodejs: "{{.full}}" Verified locally against a tag_ranges-capable ch build: `ch generate` resolved the live Docker Hub tag list to a single concrete tag (e.g. 26.8.1) and NODEJS_VERSION=26.8.1 came out the other end of buildconfig_resolver unchanged. Regenerated both CI pipelines to add the resulting node build/test/ manifest jobs and the version-cache steps on generate+lint (also picking up unrelated pending regen output: the ci_cancel_outdated concurrency block and action version bumps that were already sitting uncommitted before this branch). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .github/workflows/main.yml | 194 ++++++++++++++++++++++++++++------ .gitignore | 3 +- _base/images/node/Dockerfile | 3 + _base/images/node/README.md | 11 ++ _base/images/node/image.yml | 19 ++++ gitlab/pipeline.gitlab-ci.yml | 85 ++++++++++++--- 6 files changed, 271 insertions(+), 44 deletions(-) create mode 100644 _base/images/node/Dockerfile create mode 100644 _base/images/node/README.md create mode 100644 _base/images/node/image.yml diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 65865bf..80ec7b4 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,5 +1,6 @@ # Auto-generated by ContainerHive # Do not edit - regenerate with: ch --project github template ci --provider github --output .github/workflows/main.yml --image-name ghcr.io/containerhive/containerhive +# tag_ranges resolved to 9 shard unit(s) - regenerate if this changes. name: Build Images @@ -10,6 +11,10 @@ on: types: [opened, synchronize] branches: [main] +concurrency: + group: ${{ github.event_name == 'push' && format('{0}-{1}', github.workflow, github.ref) || github.run_id }} + cancel-in-progress: ${{ github.event_name == 'push' }} + permissions: packages: write contents: read @@ -21,7 +26,7 @@ permissions: env: SNAPSHOT_ID: "${{ github.event.pull_request.number }}" - CH_IMAGE: ghcr.io/containerhive/containerhive:ee7d8d2 + CH_IMAGE: ghcr.io/containerhive/containerhive:cefac90 jobs: # === GENERATE === @@ -29,17 +34,24 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Prepare temp directory run: mkdir -p "$RUNNER_TEMP/ch" + - name: Restore version cache + uses: actions/cache@v4.2.0 + with: + path: github/.ch-cache + key: ch-versions-${{ github.run_id }} + restore-keys: | + ch-versions- - name: Login to registry run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" - name: Login to GHCR run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io - name: Generate build files - run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github generate --build-id "$SNAPSHOT_ID" + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -e CONTAINER_HIVE_CACHE_DIR="$GITHUB_WORKSPACE/github/.ch-cache" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github generate --build-id "$SNAPSHOT_ID" - name: Upload generated files uses: actions/upload-artifact@v7.0.1 with: @@ -51,11 +63,18 @@ jobs: needs: generate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7.0.1 with: lfs: true + - name: Restore version cache + uses: actions/cache@v4.2.0 + with: + path: github/.ch-cache + key: ch-versions-${{ github.run_id }} + restore-keys: | + ch-versions- - name: Lint Dockerfiles - run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github lint --format github-actions + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -e CONTAINER_HIVE_CACHE_DIR="$GITHUB_WORKSPACE/github/.ch-cache" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github lint --format github-actions # === BASE-CI === @@ -66,7 +85,7 @@ jobs: - lint steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -79,7 +98,7 @@ jobs: - name: Create Docker network run: docker network create ch-net - name: Start BuildKit daemon - run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.30.0 --addr tcp://0.0.0.0:8372 + run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.31.0 --addr tcp://0.0.0.0:8372 - name: Login to registry run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" - name: Login to GHCR @@ -104,7 +123,7 @@ jobs: - lint steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -117,7 +136,7 @@ jobs: - name: Create Docker network run: docker network create ch-net - name: Start BuildKit daemon - run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.30.0 --addr tcp://0.0.0.0:8372 + run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.31.0 --addr tcp://0.0.0.0:8372 - name: Login to registry run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" - name: Login to GHCR @@ -144,7 +163,7 @@ jobs: - build-base-ci-arm64 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -168,7 +187,7 @@ jobs: - build-base-ci-arm64 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -194,7 +213,7 @@ jobs: run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github test base-ci --build-id "$SNAPSHOT_ID" - name: Publish Test Report id: test-report - uses: mikepenz/action-junit-report@v6 + uses: mikepenz/action-junit-report@v6.5.0 if: success() || failure() with: check_name: "Container Structure Tests - base-ci" @@ -213,7 +232,7 @@ jobs: - lint steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -226,7 +245,7 @@ jobs: - name: Create Docker network run: docker network create ch-net - name: Start BuildKit daemon - run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.30.0 --addr tcp://0.0.0.0:8372 + run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.31.0 --addr tcp://0.0.0.0:8372 - name: Login to registry run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" - name: Login to GHCR @@ -251,7 +270,7 @@ jobs: - lint steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -264,7 +283,7 @@ jobs: - name: Create Docker network run: docker network create ch-net - name: Start BuildKit daemon - run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.30.0 --addr tcp://0.0.0.0:8372 + run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.31.0 --addr tcp://0.0.0.0:8372 - name: Login to registry run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" - name: Login to GHCR @@ -291,7 +310,7 @@ jobs: - build-base-deployment-arm64 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -315,7 +334,7 @@ jobs: - build-base-deployment-arm64 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -341,7 +360,7 @@ jobs: run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github test base-deployment --build-id "$SNAPSHOT_ID" - name: Publish Test Report id: test-report - uses: mikepenz/action-junit-report@v6 + uses: mikepenz/action-junit-report@v6.5.0 if: success() || failure() with: check_name: "Container Structure Tests - base-deployment" @@ -351,6 +370,113 @@ jobs: comment: 'true' updateComment: 'true' include_passed: 'true' + # === NODE === + + build-node-amd64: + runs-on: ubuntu-24.04 + needs: + - generate + - lint + steps: + - name: Checkout code + uses: actions/checkout@v7.0.1 + with: + lfs: true + - name: Download generated files + uses: actions/download-artifact@v8.0.1 + with: + name: generated + path: github/dist/ + - name: Prepare temp directory + run: mkdir -p "$RUNNER_TEMP/ch" + - name: Create Docker network + run: docker network create ch-net + - name: Start BuildKit daemon + run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.31.0 --addr tcp://0.0.0.0:8372 + - name: Login to registry + run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" + - name: Login to GHCR + run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io + - name: Wait for BuildKit + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github wait --buildkitd + - name: Build image + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github build node --platform amd64 --build-id "$SNAPSHOT_ID" + - name: Generate SBOM + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github sbom node --platform amd64 --build-id "$SNAPSHOT_ID" + - name: Upload SBOM + uses: actions/upload-artifact@v7.0.1 + with: + name: node-amd64-sbom + path: github/dist/*/*/*/cyclonedx.json + retention-days: 30 + + + manifest-node: + runs-on: ubuntu-latest + needs: + - test-node + - build-node-amd64 + steps: + - name: Checkout code + uses: actions/checkout@v7.0.1 + with: + lfs: true + - name: Download generated files + uses: actions/download-artifact@v8.0.1 + with: + name: generated + path: github/dist/ + - name: Prepare temp directory + run: mkdir -p "$RUNNER_TEMP/ch" + - name: Login to registry + run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" + - name: Login to GHCR + run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io + - name: Finalize manifest + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github finalize node --build-id "$SNAPSHOT_ID" + + test-node: + runs-on: ubuntu-latest + needs: + - build-node-amd64 + steps: + - name: Checkout code + uses: actions/checkout@v7.0.1 + with: + lfs: true + - name: Download generated files + uses: actions/download-artifact@v8.0.1 + with: + name: generated + path: github/dist/ + - name: Prepare temp directory + run: mkdir -p "$RUNNER_TEMP/ch" + - name: Setup QEMU + run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes + - name: Create Docker network + run: docker network create ch-net + - name: Start Docker-in-Docker + run: docker run -d --name dind --privileged --network ch-net -e DOCKER_TLS_CERTDIR="" docker:dind + - name: Login to registry + run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" + - name: Login to GHCR + run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io + - name: Wait for Docker socket + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github wait --docker-socket + - name: Run container tests + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github test node --build-id "$SNAPSHOT_ID" + - name: Publish Test Report + id: test-report + uses: mikepenz/action-junit-report@v6.5.0 + if: success() || failure() + with: + check_name: "Container Structure Tests - node" + report_paths: 'github/dist/**/*-cst-report.xml' + require_tests: 'false' + detailed_summary: 'true' + comment: 'true' + updateComment: 'true' + include_passed: 'true' # === DOTNET-RUNTIME === build-dotnet-runtime-amd64: @@ -361,7 +487,7 @@ jobs: - manifest-base-deployment steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -374,7 +500,7 @@ jobs: - name: Create Docker network run: docker network create ch-net - name: Start BuildKit daemon - run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.30.0 --addr tcp://0.0.0.0:8372 + run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.31.0 --addr tcp://0.0.0.0:8372 - name: Login to registry run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" - name: Login to GHCR @@ -400,7 +526,7 @@ jobs: - build-dotnet-runtime-amd64 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -423,7 +549,7 @@ jobs: - build-dotnet-runtime-amd64 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -449,7 +575,7 @@ jobs: run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github test dotnet-runtime --build-id "$SNAPSHOT_ID" - name: Publish Test Report id: test-report - uses: mikepenz/action-junit-report@v6 + uses: mikepenz/action-junit-report@v6.5.0 if: success() || failure() with: check_name: "Container Structure Tests - dotnet-runtime" @@ -469,7 +595,7 @@ jobs: - manifest-base-ci steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -482,7 +608,7 @@ jobs: - name: Create Docker network run: docker network create ch-net - name: Start BuildKit daemon - run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.30.0 --addr tcp://0.0.0.0:8372 + run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.31.0 --addr tcp://0.0.0.0:8372 - name: Login to registry run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" - name: Login to GHCR @@ -508,7 +634,7 @@ jobs: - build-go-ci-amd64 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -531,7 +657,7 @@ jobs: - build-go-ci-amd64 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -557,7 +683,7 @@ jobs: run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github test go-ci --build-id "$SNAPSHOT_ID" - name: Publish Test Report id: test-report - uses: mikepenz/action-junit-report@v6 + uses: mikepenz/action-junit-report@v6.5.0 if: success() || failure() with: check_name: "Container Structure Tests - go-ci" @@ -573,12 +699,13 @@ jobs: - build-base-ci-arm64 - build-base-deployment-amd64 - build-base-deployment-arm64 + - build-node-amd64 - build-dotnet-runtime-amd64 - build-go-ci-amd64 runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7.0.1 with: lfs: true - name: Download generated files @@ -606,6 +733,11 @@ jobs: with: name: base-deployment-arm64-sbom path: github/dist/ + - name: Download node-amd64 SBOM + uses: actions/download-artifact@v8.0.1 + with: + name: node-amd64-sbom + path: github/dist/ - name: Download dotnet-runtime-amd64 SBOM uses: actions/download-artifact@v8.0.1 with: @@ -633,5 +765,5 @@ jobs: with: path: public/ - name: Deploy to GitHub Pages - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@v5.0.1 if: github.event_name == 'push' && github.ref == 'refs/heads/main' \ No newline at end of file diff --git a/.gitignore b/.gitignore index 20b2593..8223f15 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ -**/dist/ \ No newline at end of file +**/dist/ +**/.ch-cache/ \ No newline at end of file diff --git a/_base/images/node/Dockerfile b/_base/images/node/Dockerfile new file mode 100644 index 0000000..ac2a9fd --- /dev/null +++ b/_base/images/node/Dockerfile @@ -0,0 +1,3 @@ +FROM scratch +ARG NODEJS_VERSION +LABEL nodejs.version="${NODEJS_VERSION}" diff --git a/_base/images/node/README.md b/_base/images/node/README.md new file mode 100644 index 0000000..ea693d3 --- /dev/null +++ b/_base/images/node/README.md @@ -0,0 +1,11 @@ +# Node + +Demo image with no install steps, existing purely to verify that `tag_ranges` resolves +the latest Node.js version from Docker Hub at discovery time and threads it through as +the `NODEJS_VERSION` build arg. + +## Usage + +```dockerfile +FROM __hive__/node: +``` diff --git a/_base/images/node/image.yml b/_base/images/node/image.yml new file mode 100644 index 0000000..93fca87 --- /dev/null +++ b/_base/images/node/image.yml @@ -0,0 +1,19 @@ +description: "Minimal image proving tag_ranges resolves the latest Node.js version straight from Docker Hub." + +tag_ranges: + - tag_name: "{{.full}}" + source: + type: dockerhub + image: library/node + select: + major: { last: 1 } + minor: { last: 1 } + patch: { last: 1 } + versions: + nodejs: "{{.full}}" + +report: + icon: "devicon-nodejs-plain" + +platforms: + - linux/amd64 diff --git a/gitlab/pipeline.gitlab-ci.yml b/gitlab/pipeline.gitlab-ci.yml index ef33308..d4cfceb 100644 --- a/gitlab/pipeline.gitlab-ci.yml +++ b/gitlab/pipeline.gitlab-ci.yml @@ -1,5 +1,13 @@ # Auto-generated by ContainerHive # Do not edit - regenerate with: ch --project gitlab template ci --provider gitlab --output gitlab/pipeline.gitlab-ci.yml --image-name ghcr.io/containerhive/containerhive +# tag_ranges resolved to 9 shard unit(s) - regenerate if this changes. + +workflow: + auto_cancel: + on_new_commit: interruptible + +default: + interruptible: true stages: - generate @@ -10,6 +18,9 @@ stages: - build-base-deployment - test-base-deployment - manifest-base-deployment + - build-node + - test-node + - manifest-node - build-dotnet-runtime - test-dotnet-runtime - manifest-dotnet-runtime @@ -30,7 +41,7 @@ before_script: .build: image: - name: ghcr.io/containerhive/containerhive:df0b431 + name: ghcr.io/containerhive/containerhive:cefac90 entrypoint: [""] services: - name: moby/buildkit:v0.31.0 @@ -51,14 +62,14 @@ before_script: .manifest: image: - name: ghcr.io/containerhive/containerhive:df0b431 + name: ghcr.io/containerhive/containerhive:cefac90 entrypoint: [""] script: - ch -p gitlab finalize ${IMAGE_NAME} --build-id "$SNAPSHOT_ID" .test: image: - name: ghcr.io/containerhive/containerhive:df0b431 + name: ghcr.io/containerhive/containerhive:cefac90 entrypoint: [""] services: - name: docker:dind @@ -73,9 +84,16 @@ before_script: # === GENERATE === generate: image: - name: ghcr.io/containerhive/containerhive:df0b431 + name: ghcr.io/containerhive/containerhive:cefac90 entrypoint: [""] stage: generate + cache: + key: ch-versions + paths: + - gitlab/.ch-cache/ + policy: pull-push + variables: + CONTAINER_HIVE_CACHE_DIR: gitlab/.ch-cache script: - ch -p gitlab generate --build-id "$SNAPSHOT_ID" artifacts: @@ -88,8 +106,15 @@ lint: needs: - generate image: - name: ghcr.io/containerhive/containerhive:df0b431 + name: ghcr.io/containerhive/containerhive:cefac90 entrypoint: [""] + cache: + key: ch-versions + paths: + - gitlab/.ch-cache/ + policy: pull + variables: + CONTAINER_HIVE_CACHE_DIR: gitlab/.ch-cache script: - ch -p gitlab lint --format codeclimate=gl-code-quality-report.json artifacts: @@ -105,7 +130,6 @@ build-base-ci-amd64: variables: IMAGE_NAME: base-ci PLATFORM: amd64 - parallel: 2 needs: - generate artifacts: @@ -120,7 +144,6 @@ build-base-ci-arm64: variables: IMAGE_NAME: base-ci PLATFORM: arm64 - parallel: 2 needs: - generate artifacts: @@ -146,7 +169,6 @@ test-base-ci: stage: test-base-ci variables: IMAGE_NAME: base-ci - parallel: 2 needs: - generate - build-base-ci-amd64 @@ -165,7 +187,6 @@ build-base-deployment-amd64: variables: IMAGE_NAME: base-deployment PLATFORM: amd64 - parallel: 2 needs: - generate artifacts: @@ -180,7 +201,6 @@ build-base-deployment-arm64: variables: IMAGE_NAME: base-deployment PLATFORM: arm64 - parallel: 2 needs: - generate artifacts: @@ -206,7 +226,6 @@ test-base-deployment: stage: test-base-deployment variables: IMAGE_NAME: base-deployment - parallel: 2 needs: - generate - build-base-deployment-amd64 @@ -217,6 +236,47 @@ test-base-deployment: - gitlab/dist/**/*-cst-report.xml reports: junit: gitlab/dist/**/*-cst-report.xml +# === NODE === + +build-node-amd64: + extends: .build-amd64 + stage: build-node + variables: + IMAGE_NAME: node + PLATFORM: amd64 + needs: + - generate + artifacts: + paths: + - gitlab/dist/node/*/*/cyclonedx.json + reports: + cyclonedx: gitlab/dist/node/*/*/cyclonedx.json + + +manifest-node: + extends: .manifest + stage: manifest-node + variables: + IMAGE_NAME: node + needs: + - generate + - test-node + - build-node-amd64 + +test-node: + extends: .test + stage: test-node + variables: + IMAGE_NAME: node + needs: + - generate + - build-node-amd64 + artifacts: + when: always + paths: + - gitlab/dist/**/*-cst-report.xml + reports: + junit: gitlab/dist/**/*-cst-report.xml # === DOTNET-RUNTIME === build-dotnet-runtime-amd64: @@ -308,7 +368,7 @@ test-go-ci: report: image: - name: ghcr.io/containerhive/containerhive:df0b431 + name: ghcr.io/containerhive/containerhive:cefac90 entrypoint: [""] stage: report needs: @@ -317,6 +377,7 @@ report: - build-base-ci-arm64 - build-base-deployment-amd64 - build-base-deployment-arm64 + - build-node-amd64 - build-dotnet-runtime-amd64 - build-go-ci-amd64 script: