Skip to content

Commit 71ee2c5

Browse files
temblekingtembleking
authored
ci: unify PR workflows and fix multiarch images (#63)
1 parent 458c6c5 commit 71ee2c5

File tree

5 files changed

+219
-125
lines changed

5 files changed

+219
-125
lines changed

‎.github/workflows/publish.yaml‎

Lines changed: 30 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -63,11 +63,14 @@ jobs:
6363
contents: read
6464
packages: write
6565
strategy:
66+
max-parallel: 1
6667
matrix:
6768
include:
6869
- arch: amd64
70+
platform: linux/amd64
6971
nix_package: sysdig-mcp-server-image-amd64
7072
- arch: arm64
73+
platform: linux/arm64
7174
nix_package: sysdig-mcp-server-image-aarch64
7275
steps:
7376
- name: Check out the repo
@@ -88,20 +91,37 @@ jobs:
8891
- name: Build image
8992
run: nix build .#${{ matrix.nix_package }} -o result
9093

94+
- name: Convert to OCI layout
95+
run: |
96+
skopeo copy docker-archive:result oci:/tmp/oci-image:latest
97+
echo "FROM base" > /tmp/Dockerfile.push
98+
99+
- name: Set up Docker Buildx
100+
uses: docker/setup-buildx-action@v3
101+
91102
- name: Log in to GitHub Container Registry
92-
run: echo "${{ secrets.GITHUB_TOKEN }}" | skopeo login ghcr.io -u "${{ github.actor }}" --password-stdin
103+
uses: docker/login-action@v3
104+
with:
105+
registry: ghcr.io
106+
username: ${{ github.actor }}
107+
password: ${{ secrets.GITHUB_TOKEN }}
93108

94109
- name: Push image by digest
95110
id: push
96-
env:
97-
REGISTRY: ghcr.io/sysdiglabs/sysdig-mcp-server
111+
uses: docker/build-push-action@v6
112+
with:
113+
file: /tmp/Dockerfile.push
114+
build-contexts: |
115+
base=oci-layout:///tmp/oci-image
116+
platforms: ${{ matrix.platform }}
117+
provenance: false
118+
outputs: type=image,name=ghcr.io/sysdiglabs/sysdig-mcp-server,push-by-digest=true,name-canonical=true,push=true
119+
120+
- name: Export digest
98121
run: |
99-
skopeo copy --digestfile /tmp/digest \
100-
docker-archive:result \
101-
docker://$REGISTRY --format oci
102-
103122
mkdir -p /tmp/digests
104-
cp /tmp/digest /tmp/digests/${{ matrix.arch }}
123+
digest="${{ steps.push.outputs.digest }}"
124+
touch "/tmp/digests/${digest#sha256:}"
105125
106126
- name: Upload digest
107127
uses: actions/upload-artifact@v5
@@ -144,10 +164,10 @@ jobs:
144164
working-directory: /tmp/digests
145165
run: |
146166
docker buildx imagetools create --tag $REGISTRY:${VERSION} \
147-
$(printf "$REGISTRY@%s " $(cat *))
167+
$(printf "$REGISTRY@sha256:%s " *)
148168
149169
docker buildx imagetools create --tag $REGISTRY:latest \
150-
$(printf "$REGISTRY@%s " $(cat *))
170+
$(printf "$REGISTRY@sha256:%s " *)
151171
152172
- name: Inspect image
153173
env:

‎.github/workflows/pull-request-ci.yaml‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
---
2+
name: Pull Request CI
3+
4+
on:
5+
pull_request:
6+
branches:
7+
- main
8+
- master
9+
workflow_call:
10+
workflow_dispatch:
11+
12+
concurrency:
13+
group: "pr-ci-${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
14+
cancel-in-progress: true
15+
16+
jobs:
17+
build-and-test:
18+
name: Build and Test
19+
runs-on: ubuntu-latest
20+
defaults:
21+
run:
22+
shell: nix develop --command bash {0}
23+
steps:
24+
- name: Check out the repo
25+
uses: actions/checkout@v5
26+
27+
- name: Install Nix
28+
# Pinned to v21 commit SHA for supply-chain safety.
29+
# To update: git ls-remote https://github.com/DeterminateSystems/nix-installer-action.git <tag>
30+
uses: DeterminateSystems/nix-installer-action@c5a866b6ab867e88becbed4467b93592bce69f8a # v21
31+
32+
- name: Enable Nix cache
33+
# Pinned to v13 commit SHA for supply-chain safety.
34+
# To update: git ls-remote https://github.com/DeterminateSystems/magic-nix-cache-action.git <tag>
35+
uses: DeterminateSystems/magic-nix-cache-action@565684385bcd71bad329742eefe8d12f2e765b39 # v13
36+
with:
37+
use-flakehub: false
38+
39+
- name: Build
40+
run: go build ./...
41+
42+
- name: Run Checks
43+
run: just check
44+
env:
45+
SYSDIG_MCP_API_HOST: ${{ vars.SYSDIG_MCP_API_HOST }}
46+
SYSDIG_MCP_API_TOKEN: ${{ secrets.SYSDIG_MCP_API_SECURE_TOKEN }}
47+
48+
test-image:
49+
name: Test Image (${{ matrix.arch }})
50+
runs-on: ubuntu-latest
51+
needs: [build-and-test]
52+
defaults:
53+
run:
54+
shell: nix develop --command bash {0}
55+
permissions:
56+
contents: read # required for actions/checkout
57+
packages: write # required for pushing to GHCR
58+
strategy:
59+
max-parallel: 1
60+
matrix:
61+
include:
62+
- arch: amd64
63+
platform: linux/amd64
64+
nix_package: sysdig-mcp-server-image-amd64
65+
- arch: arm64
66+
platform: linux/arm64
67+
nix_package: sysdig-mcp-server-image-aarch64
68+
steps:
69+
- name: Check out the repo
70+
uses: actions/checkout@v5
71+
with:
72+
ref: ${{ github.sha }}
73+
fetch-depth: "0"
74+
75+
- name: Install Nix
76+
# Pinned to v21 commit SHA for supply-chain safety.
77+
# To update: git ls-remote https://github.com/DeterminateSystems/nix-installer-action.git <tag>
78+
uses: DeterminateSystems/nix-installer-action@c5a866b6ab867e88becbed4467b93592bce69f8a # v21
79+
80+
- name: Enable Nix cache
81+
# Pinned to v13 commit SHA for supply-chain safety.
82+
# To update: git ls-remote https://github.com/DeterminateSystems/magic-nix-cache-action.git <tag>
83+
uses: DeterminateSystems/magic-nix-cache-action@565684385bcd71bad329742eefe8d12f2e765b39 # v13
84+
with:
85+
use-flakehub: false
86+
87+
- name: Build image
88+
run: nix build .#${{ matrix.nix_package }} -o result
89+
90+
- name: Load image
91+
id: load
92+
run: |
93+
IMAGE_TAG=$(docker load < result | sed -n 's/Loaded image: //p')
94+
echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
95+
96+
- name: Test image
97+
if: matrix.arch == 'amd64'
98+
run: docker run --rm "${{ steps.load.outputs.image_tag }}" --help | grep "Sysdig MCP Server"
99+
100+
- name: Scan Docker image
101+
uses: sysdiglabs/scan-action@v6
102+
with:
103+
image-tag: ${{ steps.load.outputs.image_tag }}
104+
sysdig-secure-token: ${{ secrets.SECURE_ENV_MON_API_KEY }}
105+
sysdig-secure-url: ${{ secrets.SECURE_ENV_MON_ENDPOINT }}
106+
stop-on-failed-policy-eval: true
107+
stop-on-processing-error: true
108+
109+
- name: Convert to OCI layout
110+
run: |
111+
skopeo copy docker-archive:result oci:/tmp/oci-image:latest
112+
echo "FROM base" > /tmp/Dockerfile.push
113+
114+
- name: Set up Docker Buildx
115+
uses: docker/setup-buildx-action@v3
116+
117+
- name: Log in to GitHub Container Registry
118+
uses: docker/login-action@v3
119+
with:
120+
registry: ghcr.io
121+
username: ${{ github.actor }}
122+
password: ${{ secrets.GITHUB_TOKEN }}
123+
124+
- name: Push image by digest
125+
id: push
126+
uses: docker/build-push-action@v6
127+
with:
128+
file: /tmp/Dockerfile.push
129+
build-contexts: |
130+
base=oci-layout:///tmp/oci-image
131+
platforms: ${{ matrix.platform }}
132+
provenance: false
133+
outputs: type=image,name=ghcr.io/sysdiglabs/sysdig-mcp-server,push-by-digest=true,name-canonical=true,push=true
134+
135+
- name: Export digest
136+
run: |
137+
mkdir -p /tmp/digests
138+
digest="${{ steps.push.outputs.digest }}"
139+
touch "/tmp/digests/${digest#sha256:}"
140+
141+
- name: Upload digest
142+
uses: actions/upload-artifact@v5
143+
with:
144+
name: digests-${{ matrix.arch }}
145+
path: /tmp/digests/*
146+
if-no-files-found: error
147+
retention-days: 1
148+
149+
push-pr-image:
150+
name: Push PR image to GitHub Packages
151+
runs-on: ubuntu-latest
152+
needs: [test-image]
153+
if: github.event_name == 'pull_request'
154+
permissions:
155+
contents: read
156+
packages: write
157+
env:
158+
REGISTRY: ghcr.io/sysdiglabs/sysdig-mcp-server
159+
steps:
160+
- name: Download digests
161+
uses: actions/download-artifact@v6
162+
with:
163+
path: /tmp/digests
164+
pattern: digests-*
165+
merge-multiple: true
166+
167+
- name: Set up Docker Buildx
168+
uses: docker/setup-buildx-action@v3
169+
170+
- name: Log in to GitHub Container Registry
171+
uses: docker/login-action@v3
172+
with:
173+
registry: ghcr.io
174+
username: ${{ github.actor }}
175+
password: ${{ secrets.GITHUB_TOKEN }}
176+
177+
- name: Create manifest list and push
178+
env:
179+
PR_NUMBER: ${{ github.event.pull_request.number }}
180+
working-directory: /tmp/digests
181+
run: |
182+
docker buildx imagetools create --tag $REGISTRY:pr-${PR_NUMBER} \
183+
$(printf "$REGISTRY@sha256:%s " *)
184+
185+
- name: Inspect image
186+
env:
187+
PR_NUMBER: ${{ github.event.pull_request.number }}
188+
run: docker buildx imagetools inspect $REGISTRY:pr-${PR_NUMBER}

‎.github/workflows/test.yaml‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

‎.github/workflows/test_image.yaml‎

Lines changed: 0 additions & 69 deletions
This file was deleted.

‎package.nix‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{ buildGo124Module, versionCheckHook }:
22
buildGo124Module (finalAttrs: {
33
pname = "sysdig-mcp-server";
4-
version = "1.0.1";
4+
version = "1.0.2";
55
src = ./.;
66
# This hash is automatically re-calculated with `just rehash-package-nix`. This is automatically called as well by `just update`.
77
vendorHash = "sha256-qMgFlDqzmtpxNOFCX9TsE4sjz0ZdvTJ5Q5IpA8lzG8g=";

0 commit comments

Comments
 (0)