levaliciousandClaude Opus 5.5
b040f97149
images / images (push) Successful in 11m16s
The images go to the registry with --push, but each build also left its tagged images in the runner's local store and an unbounded build cache: after a day of builds the runner's 10Gi Docker volume filled up and run 21 died mid-build (no space left on device). A final step, run even when the build fails, removes our pushed tags and caps the build cache at 4GB (recent layers stay, so builds stay cached). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ
68 lines
2.4 KiB
YAML
68 lines
2.4 KiB
YAML
# Build the images the cluster runs (weave-kube, weave-npc) and push them to
|
|
# this Gitea's container registry. CI stops here: rolling them out is the
|
|
# CD side's job, not this workflow's.
|
|
#
|
|
# Tags are the full commit SHA, so a tag never moves: rebuilding a commit
|
|
# pushes the same name again instead of changing what an existing name means.
|
|
# linux/amd64 only for now (every node is amd64).
|
|
name: images
|
|
|
|
on:
|
|
push:
|
|
paths-ignore:
|
|
- "website/**"
|
|
- "docs/**"
|
|
- "**.md"
|
|
workflow_dispatch:
|
|
|
|
# The job token can't log in to the registry (no package scope there), so
|
|
# the push uses the reweave-ci bot's token from the org secret REGISTRY_TOKEN.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
images:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
REGISTRY: git.levk.dev
|
|
IMAGE_PREFIX: git.levk.dev/reweave
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0 # tags, for the version string
|
|
submodules: true # tools/ (weaveworks/build-tools): make all builds tools/runner
|
|
|
|
- name: Log in to the registry
|
|
run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u reweave-ci --password-stdin
|
|
|
|
- name: Build and push (linux/amd64)
|
|
run: |
|
|
set -eu
|
|
sha=$(git rev-parse HEAD)
|
|
version=$(git describe --tags --always | sed 's/^v//')
|
|
for pair in weavekubeimage:weave-kube weavenpcimage:weave-npc; do
|
|
target=${pair%%:*}
|
|
image="$IMAGE_PREFIX/${pair#*:}:$sha"
|
|
docker buildx build --push --progress=plain \
|
|
--platform=linux/amd64 \
|
|
--target="$target" \
|
|
--build-arg=WEAVE_VERSION="$version" \
|
|
--build-arg=revision="$sha" \
|
|
--build-arg=imageversion="$version" \
|
|
-f reweave/build/Dockerfile \
|
|
-t "$image" \
|
|
.
|
|
echo "pushed $image"
|
|
done
|
|
|
|
# The images live in the registry now; the runner keeps only a bounded build cache. Without this the
|
|
# runner's 10Gi Docker volume fills up after a handful of builds (no space left on device mid-build).
|
|
- name: Free the runner's disk
|
|
if: always()
|
|
run: |
|
|
set -u
|
|
docker image ls --format '{{.Repository}}:{{.Tag}}' | grep "^$IMAGE_PREFIX/" | xargs -r docker image rm -f
|
|
docker image prune -f
|
|
docker builder prune -f --keep-storage 4GB
|
|
docker system df
|