-
Notifications
You must be signed in to change notification settings - Fork 234
151 lines (132 loc) · 5.17 KB
/
docker-images.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
name: Docker Images CI
on:
push:
branches: ["main"]
# Publish semver tags as releases.
tags:
- "v*"
env:
REGISTRY: ghcr.io
ORG: trypromptly
IMAGE_NAME_API: "llmstack-api"
IMAGE_NAME_NGINX: "llmstack-nginx"
IMAGE_NAME_PLAYWRIGHT: "llmstack-playwright"
jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
# This is used to complete the identity challenge
# with sigstore/fulcio when running outside of PRs.
id-token: write
steps:
- name: Checkout repository
uses: actions/checkout@v3
# Install the cosign tool except on PR
# https://github.com/sigstore/cosign-installer
- name: Install cosign
if: github.event_name != 'pull_request'
uses: sigstore/[email protected]
with:
cosign-release: "v2.1.1"
# Setup QEMU for cross compilation
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
# Setup Docker Buildx
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
# Login against a Docker registry except on PR
# https://github.com/docker/login-action
- name: Log into registry ${{ env.REGISTRY }}
if: github.event_name != 'pull_request'
uses: docker/[email protected]
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
# Extract metadata (tags, labels) for Docker
# https://github.com/docker/metadata-action
- name: Extract Docker metadata for API
id: meta-api
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.ORG }}/${{ env.IMAGE_NAME_API }}
- name: Extract Docker metadata for nginx
id: meta-nginx
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.ORG }}/${{ env.IMAGE_NAME_NGINX }}
- name: Extract Docker metadata for playwright
id: meta-playwright
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.ORG }}/${{ env.IMAGE_NAME_PLAYWRIGHT }}
# Build client
- name: Build client
run: |
cd client
npm install
npm run build
# Build and push Docker image with Buildx (don't push on PR)
# https://github.com/docker/build-push-action
- name: Build and push LLMStack API Docker image
id: build-and-push-api
uses: docker/build-push-action@v4
with:
context: .
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta-api.outputs.tags }}
labels: ${{ steps.meta-api.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
file: Dockerfile
platforms: linux/amd64,linux/arm64
- name: Build and push LLMStack nginx Docker image
id: build-and-push-nginx
uses: docker/build-push-action@v4
with:
context: .
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta-nginx.outputs.tags }}
labels: ${{ steps.meta-nginx.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
file: Dockerfile.nginx
platforms: linux/amd64,linux/arm64
build-args: |
REGISTRY=${{ env.REGISTRY }}/${{ env.ORG }}/
TAG=main
- name: Build and push LLMStack playwright Docker image
id: build-and-push-playwright
uses: docker/build-push-action@v4
with:
context: playwright
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta-playwright.outputs.tags }}
labels: ${{ steps.meta-playwright.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
file: playwright/Dockerfile
platforms: linux/amd64,linux/arm64
- name: Sign the published LLMStack API Docker image
if: ${{ github.event_name != 'pull_request' }}
env:
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
TAGS: ${{ steps.meta-api.outputs.tags }}
DIGEST: ${{ steps.build-and-push-api.outputs.digest }}
# This step uses the identity token to provision an ephemeral certificate
# against the sigstore community Fulcio instance.
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
- name: Sign the published LLMStack nginx Docker image
if: ${{ github.event_name != 'pull_request' }}
env:
TAGS: ${{ steps.meta-nginx.outputs.tags }}
DIGEST: ${{ steps.build-and-push-nginx.outputs.digest }}
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
- name: Sign the published LLMStack playwright Docker image
if: ${{ github.event_name != 'pull_request' }}
env:
TAGS: ${{ steps.meta-playwright.outputs.tags }}
DIGEST: ${{ steps.build-and-push-playwright.outputs.digest }}
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}