From 100caa4ff3921e04db880ae7ad7bb88d7afc14fa Mon Sep 17 00:00:00 2001 From: Jeremy Bernard Date: Thu, 15 Oct 2026 17:02:20 +0200 Subject: [PATCH] ci: publish OCI image on Docker Hub --- .github/workflows/ci.yaml | 53 +++++++++---------- ...l => conventional-commit-on-pr-title.yaml} | 7 +-- .github/workflows/docker-build-on-tag.yaml | 15 +++--- .github/workflows/release-please.yaml | 9 ++-- 4 files changed, 38 insertions(+), 46 deletions(-) rename .github/workflows/{conventional-commits.yaml => conventional-commit-on-pr-title.yaml} (68%) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 97faaf0..097bb97 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -8,8 +8,8 @@ on: jobs: build-and-test: - # rust-build-v3.0.0 - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/rust-build.yml@6c7896d7145583aad706eb822715be122a3f8a14 + # rust-build-v3.0.1 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/rust-build.yml@9be95371356a8f82615ff3dd0a6df945265d33a6 with: rust-version: '1.98.0' working-directory: "." @@ -20,54 +20,49 @@ jobs: name: Determine image tag needs: build-and-test runs-on: ubuntu-latest - if: | - github.repository_owner == 'iExecBlockchainComputing' && - (github.ref_name == 'main' || - startsWith(github.head_ref, 'feat/') || - startsWith(github.head_ref, 'fix/') || - (github.event_name == 'workflow_dispatch' && (startsWith(github.ref_name, 'feat/') || startsWith(github.ref_name, 'fix/')))) + if: github.repository_owner == 'iExecBlockchainComputing' outputs: image_tag: ${{ steps.determine-tag.outputs.image_tag }} steps: - name: Determine base tag id: determine-tag + env: + BRANCH: ${{ github.head_ref || github.ref_name }} + HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} run: | - if [ "${{ github.event_name }}" = "pull_request" ] ; then - SHORT_SHA=$(echo ${{ github.event.pull_request.head.sha }} | cut -c1-8) - else - SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-8) - fi + short_sha=$(echo "$HEAD_SHA" | cut -c1-8) - if [ "${{ github.ref_name }}" = "main" ] ; then - echo "Processing main branch" - echo "image_tag=dev-${SHORT_SHA}" | tee -a $GITHUB_OUTPUT - else - # This covers feat/ and fix/ branches - echo "Processing feat/fix branch ${{ github.head_ref }}" - echo "image_tag=feature-${SHORT_SHA}" | tee -a $GITHUB_OUTPUT - fi + case "$BRANCH" in + main) echo "image_tag=dev-${short_sha}" | tee -a $GITHUB_OUTPUT;; + feat/*|fix/*) echo "image_tag=feature-${short_sha}" | tee -a $GITHUB_OUTPUT;; + release-please--*) : ;; + *) + echo "❌ Branch does not respect naming rules: $BRANCH" + echo "Expected one of: main, feat/*, fix/*, release-please--*" + exit 1 + ;; + esac build-oci-image: name: Build OCI images needs: prepare + if: needs.prepare.outputs.image_tag != '' strategy: matrix: package: [post-compute, pre-compute] - # docker-build-v3.5.2 - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@0b4bde3c948a886b7df750a3ccbda169102d94b4 + # docker-build-v3.8.0 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@71e6b9e61eefe6ca92540523ff2589274399b7cd with: - image-name: docker-regis.iex.ec/tee-worker-${{ matrix.package }}-rust + image-name: docker.io/iexechub/tee-worker-${{ matrix.package }}-rust image-tag: ${{ needs.prepare.outputs.image_tag }} dockerfile: ${{ matrix.package }}/Dockerfile context: . - registry: docker-regis.iex.ec + registry: docker.io push: true security-scan: true security-report: "sarif" hadolint: true platform: linux/amd64 secrets: - dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }} - dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN_PULL_ONLY }} - username: ${{ secrets.NEXUS_USERNAME }} - password: ${{ secrets.NEXUS_PASSWORD }} + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_PAT }} diff --git a/.github/workflows/conventional-commits.yaml b/.github/workflows/conventional-commit-on-pr-title.yaml similarity index 68% rename from .github/workflows/conventional-commits.yaml rename to .github/workflows/conventional-commit-on-pr-title.yaml index ab91c6c..ae900a2 100644 --- a/.github/workflows/conventional-commits.yaml +++ b/.github/workflows/conventional-commit-on-pr-title.yaml @@ -1,11 +1,12 @@ name: Conventional Commit as PR title on: - pull_request_target: + pull_request: types: - opened - edited - reopened + - synchronize jobs: lint-pr-title: @@ -13,5 +14,5 @@ jobs: if: github.repository_owner == 'iExecBlockchainComputing' permissions: pull-requests: read - # conventional-commits-1.2.1 - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@7825b11bd6f0b141075368add5223c873d76a2d3 + # conventional-commits-1.2.3 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@36e876b00619725344c27c59748cc44d0d4d6e44 diff --git a/.github/workflows/docker-build-on-tag.yaml b/.github/workflows/docker-build-on-tag.yaml index 9b0601a..ccd909c 100644 --- a/.github/workflows/docker-build-on-tag.yaml +++ b/.github/workflows/docker-build-on-tag.yaml @@ -22,6 +22,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 + persist-credentials: false - name: Determine base tag id: determine-tag @@ -58,21 +59,19 @@ jobs: build-oci-image: name: Build OCI image needs: prepare - # docker-build-v3.5.2 - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@0b4bde3c948a886b7df750a3ccbda169102d94b4 + # docker-build-v3.8.0 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@71e6b9e61eefe6ca92540523ff2589274399b7cd with: - image-name: docker-regis.iex.ec/${{ needs.prepare.outputs.image_name }} + image-name: docker.io/iexechub/${{ needs.prepare.outputs.image_name }} image-tag: ${{ needs.prepare.outputs.image_tag }} dockerfile: ${{ needs.prepare.outputs.dockerfile }} context: . - registry: docker-regis.iex.ec + registry: docker.io push: true security-scan: true security-report: "sarif" hadolint: true platform: linux/amd64 secrets: - dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }} - dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN_PULL_ONLY }} - username: ${{ secrets.NEXUS_USERNAME }} - password: ${{ secrets.NEXUS_PASSWORD }} + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_PAT }} diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index 17af62a..9999204 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -5,17 +5,14 @@ on: branches: - main -permissions: - contents: write - issues: write - pull-requests: write +permissions: {} jobs: release-please: # Prevent execution on forks if: github.repository_owner == 'iExecBlockchainComputing' - # release-please-v2.2.1 - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@1c4f92368b01037ca4f209c2f9179cf8a07f00ff + # release-please-v2.2.3 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@31ad5d9e686d47c7ebdd3c7df3f8c50f58415428 secrets: RELEASE_PLEASE_APPLICATION_ID: ${{ secrets.RELEASE_PLEASE_APPLICATION_ID }} RELEASE_PLEASE_PRIVATE_KEY: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}