mirror of
https://github.com/luxfi/indexer.git
synced 2026-09-24 00:25:37 +00:00
zeekayandHanzo Dev
7e198c5359
hanzo-build-linux-amd64, lux-build-linux-amd64, zoo-build-linux-amd64 and every other org-prefixed spelling all meant the same machine. Which org a job belongs to does not change which host can build it, so the org bought one pool name per org per arch and each could go stale on its own -- the evo host alone answered to fourteen names for one label. One vocabulary now: linux-amd64, linux-arm64, macos-arm64, win-amd64. The generic labels every plain workflow uses (ubuntu-latest, self-hosted) are untouched, so naive CI keeps working. Co-authored-by: Hanzo Dev <[email protected]>
87 lines
2.9 KiB
YAML
87 lines
2.9 KiB
YAML
name: Release
|
|
|
|
# Builds ghcr.io/luxfi/indexer on the native runners (git.hanzo.ai → git-runner).
|
|
#
|
|
# This replaces .github/workflows/docker.yml. Three things about it could not
|
|
# work here:
|
|
#
|
|
# * `runs-on: [self-hosted, linux, amd64]` is the bare triple. The pool on
|
|
# this forge is named `linux-amd64`; nothing answers to the
|
|
# triple, and a job naming a label no runner carries does not fail, it
|
|
# waits.
|
|
#
|
|
# * ghcr auth used the instance GITHUB_TOKEN, which on this forge is a Hanzo
|
|
# Git token with no rights at ghcr.io. GHCR_USER / GHCR_TOKEN are org
|
|
# Actions secrets sourced from KMS — the same pair luxfi/node and luxfi/kms
|
|
# authenticate with.
|
|
#
|
|
# * `cache-from: type=gha` is the GitHub-hosted Actions cache service. The
|
|
# registry cache is backend-independent.
|
|
#
|
|
# arm64 is back, emulated on the amd64 pool. The lab runs both architectures,
|
|
# so a single-arch tag deploys on half of it — a slow build beats an image that
|
|
# cannot be pulled. It is emulated rather than cross-compiled because the
|
|
# Dockerfile builds indexerd with CGO against sqlite-dev, so the compile runs
|
|
# inside the target-arch container instead of keying off TARGETARCH.
|
|
#
|
|
# Semver-only: only a v* tag produces a {{version}} manifest, plus an immutable
|
|
# sha tag on every run. No :latest, no floating tags.
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# A release is not made irrelevant by a newer one — let it finish.
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
docker:
|
|
runs-on: [linux-amd64]
|
|
# The arm64 leg compiles under emulation; 45 minutes was sized for amd64
|
|
# alone and would abort the release part-way through the second platform.
|
|
timeout-minutes: 180
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# binfmt for the emulated arm64 leg. One job builds both platforms on the
|
|
# amd64 pool, so without an interpreter registered the arm64 RUN steps
|
|
# have nothing to execute.
|
|
- uses: docker/setup-qemu-action@v3
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
with:
|
|
driver: docker-container
|
|
driver-opts: network=host
|
|
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ secrets.GHCR_USER }}
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
|
|
- id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ghcr.io/luxfi/indexer
|
|
flavor: latest=false
|
|
tags: |
|
|
type=semver,pattern={{version}}
|
|
type=sha,prefix=sha-
|
|
|
|
- uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64,linux/arm64
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
cache-from: type=registry,ref=ghcr.io/luxfi/indexer:buildcache
|
|
cache-to: type=registry,ref=ghcr.io/luxfi/indexer:buildcache,mode=max
|
|
provenance: false
|
|
push: true
|