Skip to content

Commit a5ed347

Browse files
kratsgkratsg
authored
feat: build and deploy docker images (#5)
* add workflow for building/deploying docker image * typo * precommit * added tons more details in the readme * build args * fix up the dockerfile so args pass through * fix attestation * don't do attestations, it will work * tweak reddme more * more updates/tweak * add hep_oslibs * add -y * use @matthewfeickert's comments on docker meta action * typo * clean it up, consolidate back into a single build (and maybe push)
1 parent dfb29cc commit a5ed347

File tree

3 files changed

+207
-32
lines changed

3 files changed

+207
-32
lines changed

‎.github/workflows/docker.yml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# Some of this (well most) is copied from https://github.com/scikit-hep/pyhf/blob/4ecbf49/.github/workflows/docker.yml
2+
name: Docker Images
3+
4+
on:
5+
push:
6+
branches:
7+
- main
8+
pull_request:
9+
branches:
10+
- main
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
contents: read
19+
20+
jobs:
21+
docker:
22+
name: Build, test, and publish Docker images to Docker Hub
23+
runs-on: ubuntu-latest
24+
permissions:
25+
contents: read
26+
packages: write
27+
id-token: write
28+
attestations: write
29+
env:
30+
REGISTRY: ghcr.io
31+
IMAGE_NAME: ${{ github.repository_owner }}/actions-runner
32+
33+
steps:
34+
- name: Checkout
35+
uses: actions/checkout@v5
36+
37+
- name: Load current versions
38+
id: versions
39+
uses: falti/dotenv-action@v1.1.4
40+
with:
41+
log-variables: true
42+
export-variables: true
43+
keys-case: "upper"
44+
45+
- name: Docker meta
46+
id: meta
47+
uses: docker/metadata-action@v5
48+
with:
49+
images: |
50+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
51+
# generate Docker tags based on the following events/attributes
52+
tags: |
53+
type=edge,branch=main
54+
type=sha,format=short
55+
type=ref,event=pr
56+
type=raw,value=latest
57+
type=raw,value=${{ env.RUNNER_VERSION }}-latest
58+
type=raw,value=${{ env.RUNNER_VERSION }}-${{ env.RUNNER_CONTAINER_HOOKS_VERSION }}
59+
60+
- name: Set up QEMU
61+
uses: docker/setup-qemu-action@v3
62+
63+
- name: Set up Docker Buildx
64+
uses: docker/setup-buildx-action@v3
65+
66+
- name: Login to CERN GitLab
67+
if:
68+
github.event_name != 'pull_request' && github.repository ==
69+
'usatlas/runner'
70+
uses: docker/login-action@v3
71+
with:
72+
username: ${{ secrets.GITLAB_REGISTRY_USERNAME }}
73+
password: ${{ secrets.GITLAB_REGISTRY_TOKEN }}
74+
75+
- name: Login to GitHub Container Registry
76+
if:
77+
github.event_name != 'pull_request' && github.repository ==
78+
'usatlas/runner'
79+
uses: docker/login-action@v3
80+
with:
81+
registry: ghcr.io
82+
username: ${{ github.actor }}
83+
password: ${{ secrets.GITHUB_TOKEN }}
84+
85+
- name: Build and push
86+
id: build-only
87+
uses: docker/build-push-action@v6
88+
with:
89+
context: .
90+
file: images/Dockerfile
91+
tags: ${{ steps.meta.outputs.tags }}
92+
labels: ${{ steps.meta.outputs.labels }}
93+
build-args: |
94+
RUNNER_VERSION=${{ env.RUNNER_VERSION }}
95+
RUNNER_CONTAINER_HOOKS_VERSION=${{ env.RUNNER_CONTAINER_HOOKS_VERSION }}
96+
load: true
97+
push:
98+
${{ github.event_name == 'pull_request' && github.ref ==
99+
'refs/heads/main' && github.repository == 'usatlas/runner' }}
100+
101+
- name: Generate attestation
102+
# every PR will trigger a push event on main, so check the push event is actually coming from main
103+
if:
104+
github.event_name == 'push' && github.ref == 'refs/heads/main' &&
105+
github.repository == 'usatlas/runner'
106+
uses: actions/attest-build-provenance@v3
107+
with:
108+
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
109+
subject-digest: ${{ steps.build-and-push.outputs.digest }}
110+
push-to-registry: true
111+
112+
- name: Image digest
113+
run: echo ${{ steps.build-only.outputs.digest }}
114+
115+
- name: List built images
116+
run: docker images

‎README.md‎

Lines changed: 82 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,102 @@
11
# 🛠️ Alma9 GitHub Actions Runner
22

3-
This repository manages the list of GitHub Actions **self-hosted runner versions** used by the USATLAS organization.
4-
It includes an automated workflow that periodically checks for new runner releases and opens a pull request to update the pinned versions.
3+
This repository manages the list of GitHub Actions **self-hosted runner
4+
versions** used by the USATLAS organization. It includes an automated workflow
5+
that periodically checks for new runner releases and opens a pull request to
6+
update the pinned versions.
57

6-
Any changes to the versions will build a new docker image deployed to ghcr.io.
8+
## 🔧 Configuration
79

8-
## 🚀 How It Works
10+
The `.env` file stores the pinned versions used in the docker image, for
11+
example:
912

10-
A scheduled GitHub Actions workflow runs the following process:
13+
```
14+
RUNNER_VERSION=2.329.0
15+
RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
16+
```
1117

12-
1. **Fetch latest runner releases** from the official GitHub runners repository.
13-
2. **Compare versions** against what is currently stored in `.env`.
14-
3. If any versions have changed:
18+
These values are automatically updated by the automated version update workflow.
1519

16-
* A new branch named `update-runner-versions` is created.
17-
* `.env` is updated with the new versions.
18-
* A commit is created with a message summarizing exactly what changed.
19-
* A pull request is automatically opened.
20+
## 🐳 Docker Image Publishing
2021

21-
## 📝 Example Commit Message
22+
Docker images for **Alma9-based GitHub Actions self-hosted runners** are
23+
automatically built and published when changes are pushed to the `main` branch.
24+
These provide an alternative to the standard Ubuntu/Debian-based runners. Pull
25+
requests trigger test builds to validate the Dockerfile, but images are only
26+
published from `main`.
2227

23-
When versions change, the commit message looks like:
28+
### Published Registries
2429

25-
```
26-
Update GitHub Actions runner versions
30+
Images are published to two container registries:
2731

28-
- Container Hooks: [0.7.0](https://github.com/actions/runner-container-hooks/releases/tag/v0.7.0) → [0.8.0](https://github.com/actions/runner-container-hooks/releases/tag/v0.8.0)
29-
```
32+
- **CERN GitLab Container Registry**: `gitlab-registry.cern.ch/usatlas/runner`
33+
- **GitHub Container Registry**: `ghcr.io/usatlas/actions-runner`
3034

31-
Commit messages only include entries for components that actually changed.
35+
### Available Tags
3236

33-
## 🔧 Configuration
37+
Multiple tags are created for each build to support different use cases:
38+
39+
- **`latest`** - Always points to the most recent build from `main`
40+
- **`sha-{hash}`** - Immutable reference to a specific commit (e.g.,
41+
`sha-592ad7bd`)
42+
- **`{RUNNER_VERSION}-latest`** - Latest build for a specific runner version
43+
(e.g., `2.329.0-latest`)
44+
- **`{RUNNER_VERSION}-{HOOKS_VERSION}`** - Fully pinned, reproducible version
45+
(e.g., `2.329.0-0.8.0`)
46+
47+
### Versioning Concepts
48+
49+
The Docker images use two independent version numbers:
50+
51+
- **Runner Version** (`RUNNER_VERSION`): The version of the GitHub Actions
52+
runner software itself, from
53+
[actions/runner](https://github.com/actions/runner/releases)
54+
- **Runner Container Hooks Version** (`RUNNER_CONTAINER_HOOKS_VERSION`): The
55+
version of container hooks for Kubernetes integration, from
56+
[actions/runner-container-hooks](https://github.com/actions/runner-container-hooks/releases)
57+
58+
Both versions are stored in the `.env` file and automatically updated by the
59+
version update workflow.
60+
61+
### Usage Examples
3462

35-
The `.env` file stores the pinned versions, for example:
63+
Pull the latest image:
3664

65+
```bash
66+
docker pull ghcr.io/usatlas/actions-runner:latest
3767
```
38-
RUNNER_VERSION=2.329.0
39-
RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
68+
69+
Pull a specific pinned version:
70+
71+
```bash
72+
docker pull ghcr.io/usatlas/actions-runner:2.329.0-0.8.0
4073
```
4174

42-
These values are automatically updated by the workflow.
75+
### Multi-Platform Support
76+
77+
Images are built for both `linux/amd64` and `linux/arm64` architectures.
78+
79+
## 🚀 Automated Version Updates
80+
81+
The regularly-scheduled GitHub Actions workflow, powered by `gh` CLI for
82+
interacting with GitHub's API, runs the following steps:
83+
84+
1. **Fetch latest runner releases** from the official GitHub runners repository.
85+
2. **Compare versions** against what is currently stored in `.env`.
86+
3. If any versions have changed:
87+
- A new branch named `update-runner-versions` is created.
88+
- `.env` is updated with the new versions.
89+
- A commit is created with a message summarizing exactly what changed.
90+
- A pull request is automatically opened.
91+
92+
### 📝 Example Commit Message
93+
94+
When versions change, the commit message looks like:
95+
96+
```
97+
Update GitHub Actions runner versions
4398
44-
## 🤖 Automation Workflow
99+
- Container Hooks: [0.7.0](https://github.com/actions/runner-container-hooks/releases/tag/v0.7.0) → [0.8.0](https://github.com/actions/runner-container-hooks/releases/tag/v0.8.0)
100+
```
45101

46-
The regularly-scheduled update job is powered by `gh` CLI (preinstalled on runners) for interacting with GitHub.
102+
Commit messages only include entries for components that actually changed.

‎images/Dockerfile‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,25 @@
11
# Replace value with the latest runner release version
22
# source: https://github.com/actions/runner/releases
3-
ARG RUNNER_VERSION=2.329.0
3+
ARG RUNNER_VERSION="2.329.0"
44
# Replace value with the latest runner-container-hooks release version
55
# source: https://github.com/actions/runner-container-hooks/releases
6-
ARG RUNNER_CONTAINER_HOOKS_VERSION=0.8.0
6+
ARG RUNNER_CONTAINER_HOOKS_VERSION="0.8.0"
77
ARG RUNNER_ARCH="x64"
88

9-
FROM ghcr.io/actions/runner:${RUNNER_VERSION} AS runner
10-
FROM ghcr.io/actions/runner-container-hooks:${RUNNER_CONTAINER_HOOKS_VERSION} AS hooks
11-
12-
FROM gitlab-registry.cern.ch/linuxsupport/alma9-base AS build
9+
FROM gitlab-registry.cern.ch/linuxsupport/alma9-base AS runner
10+
ARG RUNNER_VERSION
11+
ARG RUNNER_CONTAINER_HOOKS_VERSION
12+
ARG RUNNER_ARCH
1313

1414
# Runner environment
1515
ENV RUNNER_MANUALLY_TRAP_SIG=1
1616
ENV ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT=1
1717

1818
# Install dependencies
19+
# For HEP_OSLibs: https://gitlab.cern.ch/linuxsupport/rpms/HEP_OSlibs
1920
RUN dnf install -y curl unzip sudo tar gzip \
21+
&& dnf install -y https://linuxsoft.cern.ch/wlcg/el9/x86_64/wlcg-repo-1.0.0-1.el9.noarch.rpm \
22+
&& dnf install -y HEP_OSlibs \
2023
&& dnf clean all
2124

2225
# Create runner user

0 commit comments

Comments
 (0)