Pin node images to the checked-out source tree (node-26#19)
Nodes checked out v1 code but pulled :latest/:stable images built from main. Each image is now tagged src-<git tree hash of its build directory>: CI adds that tag in every build-*.yml, and scripts/image-tags.sh computes the same value on the node and writes it into .env as DRB_TAG_*, which docker-compose.yml uses (falls back to :latest/:stable for local dev). Tree hashes stay exact even though each image only rebuilds when its own directory changes. - install.sh pins after checkout and fails loudly if a pinned image is missing (compose pull only warns for services with a build: section). - drb-update.sh pulls the target commit's pinned images BEFORE checkout, using the target's own compose file, so a missing image changes nothing (uvicorn --reload would otherwise run new code on old images). It then checks out, writes the pins, recreates, and removes superseded src- tags. - New "Release images" workflow (v* tags + manual dispatch) builds any src- image a release ref is missing; it skips ones already published. The live v1 tag is not moved. Refs #19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Logan Cusano
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
80a0e88fc4
commit
6c8289f3f3
@@ -38,6 +38,10 @@ jobs:
|
||||
run: |
|
||||
echo "REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')" >> $GITHUB_OUTPUT
|
||||
echo "VERSION=$(git describe --tags --always | sed 's/^v//')" >> $GITHUB_OUTPUT
|
||||
# Source pin (node-26#19): the git tree hash of the build context.
|
||||
# A node pulls src-<tree of its own checkout> — scripts/image-tags.sh
|
||||
# computes the identical value — so its code and image always match.
|
||||
echo "SRC_TAG=src-$(git rev-parse HEAD:drb-edge-node)" >> $GITHUB_OUTPUT
|
||||
|
||||
- uses: docker/build-push-action@v6
|
||||
with:
|
||||
@@ -47,6 +51,7 @@ jobs:
|
||||
push: true
|
||||
tags: |
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.VERSION }}
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.SRC_TAG }}
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:latest
|
||||
cache-from: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache
|
||||
cache-to: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache,mode=max
|
||||
|
||||
@@ -38,6 +38,10 @@ jobs:
|
||||
run: |
|
||||
echo "REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')" >> $GITHUB_OUTPUT
|
||||
echo "VERSION=$(git describe --tags --always | sed 's/^v//')" >> $GITHUB_OUTPUT
|
||||
# Source pin (node-26#19): the git tree hash of the build context.
|
||||
# A node pulls src-<tree of its own checkout> — scripts/image-tags.sh
|
||||
# computes the identical value — so its code and image always match.
|
||||
echo "SRC_TAG=src-$(git rev-parse HEAD:icecast)" >> $GITHUB_OUTPUT
|
||||
|
||||
- uses: docker/build-push-action@v6
|
||||
with:
|
||||
@@ -47,6 +51,7 @@ jobs:
|
||||
push: true
|
||||
tags: |
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.VERSION }}
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.SRC_TAG }}
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:latest
|
||||
cache-from: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache
|
||||
cache-to: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache,mode=max
|
||||
|
||||
@@ -38,6 +38,10 @@ jobs:
|
||||
run: |
|
||||
echo "REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')" >> $GITHUB_OUTPUT
|
||||
echo "VERSION=$(git describe --tags --always | sed 's/^v//')" >> $GITHUB_OUTPUT
|
||||
# Source pin (node-26#19): the git tree hash of the build context.
|
||||
# A node pulls src-<tree of its own checkout> — scripts/image-tags.sh
|
||||
# computes the identical value — so its code and image always match.
|
||||
echo "SRC_TAG=src-$(git rev-parse HEAD:op25-container)" >> $GITHUB_OUTPUT
|
||||
|
||||
- uses: docker/build-push-action@v6
|
||||
with:
|
||||
@@ -47,6 +51,7 @@ jobs:
|
||||
push: true
|
||||
tags: |
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.VERSION }}
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.SRC_TAG }}
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:stable
|
||||
# Registry cache — avoids full recompile of GnuRadio/OP25 when only app code changes
|
||||
cache-from: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache
|
||||
|
||||
@@ -38,6 +38,10 @@ jobs:
|
||||
run: |
|
||||
echo "REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')" >> $GITHUB_OUTPUT
|
||||
echo "VERSION=$(git describe --tags --always | sed 's/^v//')" >> $GITHUB_OUTPUT
|
||||
# Source pin (node-26#19): the git tree hash of the build context.
|
||||
# A node pulls src-<tree of its own checkout> — scripts/image-tags.sh
|
||||
# computes the identical value — so its code and image always match.
|
||||
echo "SRC_TAG=src-$(git rev-parse HEAD:secondary-sdr-container)" >> $GITHUB_OUTPUT
|
||||
|
||||
- uses: docker/build-push-action@v6
|
||||
with:
|
||||
@@ -47,6 +51,7 @@ jobs:
|
||||
push: true
|
||||
tags: |
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.VERSION }}
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.SRC_TAG }}
|
||||
git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:latest
|
||||
cache-from: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache
|
||||
cache-to: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache,mode=max
|
||||
|
||||
@@ -0,0 +1,87 @@
|
||||
name: Release images
|
||||
|
||||
# Make sure every node image a release ref needs exists in the registry
|
||||
# (node-26#19). A node on `v1` pulls <image>:src-<tree hash of that image's
|
||||
# directory at v1>. The per-image build workflows only run when their own
|
||||
# directory changes on main, and anything built before #19 has no src- tag at
|
||||
# all, so a release tag can point at trees nobody ever built. This fills the
|
||||
# gaps: for each image, if src-<tree> is already in the registry it does
|
||||
# nothing; otherwise it builds and pushes it (registry cache keeps op25 off a
|
||||
# full recompile when only its app code changed).
|
||||
#
|
||||
# Runs on every v* tag push, including a re-cut `v1`. Also runnable by hand
|
||||
# (workflow_dispatch) on any ref — run it once on the ref `v1` points at
|
||||
# before re-cutting `v1` onto a commit that contains #19, so nodes never see
|
||||
# a moment where their pinned images don't exist yet.
|
||||
#
|
||||
# Pushes ONLY src- tags. :latest / :stable keep tracking main, as before.
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
tags:
|
||||
- "v*"
|
||||
|
||||
jobs:
|
||||
ensure:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- name: edge-node
|
||||
context: drb-edge-node
|
||||
- name: icecast
|
||||
context: icecast
|
||||
- name: op25-client
|
||||
context: op25-container
|
||||
- name: secondary-sdr
|
||||
context: secondary-sdr-container
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: docker/setup-qemu-action@v3
|
||||
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
config-inline: |
|
||||
[registry."git.vpn.cusano.net"]
|
||||
http = false
|
||||
insecure = false
|
||||
|
||||
- uses: docker/login-action@v3
|
||||
with:
|
||||
registry: git.vpn.cusano.net
|
||||
username: ${{ gitea.actor }}
|
||||
password: ${{ secrets.BUILD_TOKEN }}
|
||||
|
||||
- name: Resolve source tag
|
||||
id: meta
|
||||
run: |
|
||||
REPO_NAME="$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')"
|
||||
# Must match scripts/image-tags.sh and the build-*.yml workflows.
|
||||
IMAGE="git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${REPO_NAME}/${{ matrix.name }}"
|
||||
TAG="src-$(git rev-parse HEAD:${{ matrix.context }})"
|
||||
echo "IMAGE=$IMAGE" >> $GITHUB_OUTPUT
|
||||
echo "TAG=$TAG" >> $GITHUB_OUTPUT
|
||||
if docker buildx imagetools inspect "$IMAGE:$TAG" >/dev/null 2>&1; then
|
||||
echo "EXISTS=true" >> $GITHUB_OUTPUT
|
||||
echo "$IMAGE:$TAG already published — nothing to do"
|
||||
else
|
||||
echo "EXISTS=false" >> $GITHUB_OUTPUT
|
||||
echo "$IMAGE:$TAG missing — building it"
|
||||
fi
|
||||
|
||||
- if: steps.meta.outputs.EXISTS != 'true'
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: ./${{ matrix.context }}
|
||||
file: ./${{ matrix.context }}/Dockerfile
|
||||
# arm64 only, same as the build-*.yml workflows (node-26#28).
|
||||
platforms: linux/arm64
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.IMAGE }}:${{ steps.meta.outputs.TAG }}
|
||||
cache-from: type=registry,ref=${{ steps.meta.outputs.IMAGE }}:buildcache
|
||||
Reference in New Issue
Block a user