79 lines
3.3 KiB
YAML
79 lines
3.3 KiB
YAML
name: pinned-zig-toolchain-image
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
validation_rids:
|
|
type: string
|
|
default: '[]'
|
|
outputs:
|
|
image:
|
|
description: Immutable Debian 12 Zig toolchain image reference
|
|
value: ${{ jobs.image.outputs.image }}
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
jobs:
|
|
image:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 60
|
|
outputs:
|
|
image: ${{ steps.publish.outputs.image }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Publish or reuse exact toolchain image
|
|
id: publish
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
ACTOR: ${{ github.actor }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
VALIDATION_RIDS: ${{ inputs.validation_rids || '[]' }}
|
|
BASE_HASH: ${{ hashFiles('build/linux-toolchain/Dockerfile') }}
|
|
RECIPE_HASH: ${{ hashFiles('build/linux-toolchain/Dockerfile*', 'build/linux-toolchain/*.py', 'build/linux-toolchain/*.c', 'build/linux-toolchain/*.gn.in', 'build/linux-toolchain/*lock.json', 'build/linux-toolchain/versions/*.json', 'build/linux-toolchain/patches/**') }}
|
|
run: |
|
|
set -euo pipefail
|
|
printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin
|
|
repository="ghcr.io/${REPOSITORY,,}-zig"
|
|
image="$repository:recipe-$RECIPE_HASH"
|
|
base="$repository:debian12-$BASE_HASH"
|
|
built_image=false
|
|
if ! docker pull "$image"; then
|
|
if ! docker pull "$base"; then
|
|
docker build --platform linux/amd64 \
|
|
--label "org.opencontainers.image.source=https://github.com/$REPOSITORY" \
|
|
-t "$base" build/linux-toolchain
|
|
docker push "$base"
|
|
docker pull "$base"
|
|
fi
|
|
base_digest="$(docker image inspect --format '{{index .RepoDigests 0}}' "$base")"
|
|
docker build --platform linux/amd64 \
|
|
--build-arg "TOOLCHAIN_IMAGE=$base_digest" \
|
|
--label "org.opencontainers.image.source=https://github.com/$REPOSITORY" \
|
|
-f build/linux-toolchain/Dockerfile.cross-probe \
|
|
-t "$image" build/linux-toolchain
|
|
built_image=true
|
|
fi
|
|
mkdir -p artifacts/toolchain-environment
|
|
docker run --rm --user "$(id -u):$(id -g)" \
|
|
-e HOME=/tmp -e DOTNET_CLI_HOME=/tmp -e ZIG_GLOBAL_CACHE_DIR=/tmp/zig-cache \
|
|
-v "$PWD/artifacts/toolchain-environment:/validation" \
|
|
--entrypoint python3 "$image" /opt/staticlink/validate-toolchain.py --output /validation --rids "$VALIDATION_RIDS"
|
|
if [ "$built_image" = true ]; then
|
|
docker push "$image"
|
|
docker pull "$image"
|
|
fi
|
|
digest="$(docker image inspect --format '{{index .RepoDigests 0}}' "$image")"
|
|
case "$digest" in "$repository"@sha256:*) ;; *) echo 'No immutable image digest' >&2; exit 1 ;; esac
|
|
echo "image=$digest" >> "$GITHUB_OUTPUT"
|
|
echo "Toolchain: $digest" >> "$GITHUB_STEP_SUMMARY"
|
|
- name: Upload environment validation report
|
|
if: ${{ always() }}
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: toolchain-environment-validation
|
|
path: artifacts/toolchain-environment/
|
|
if-no-files-found: warn
|