Also have zizmor check for low-severity security issues #41

Workflow file for this run

.github/workflows/build-docker.yml at 4c5b011

	# Build and publish a Docker image.
	#
	# Assumed to run as a subworkflow of .github/workflows/release.yml; specifically, as a local
	# artifacts job within `cargo-dist`.
	#
	# TODO(charlie): Ideally, the publish step would happen as a publish job within `cargo-dist`, but
	# sharing the built image as an artifact between jobs is challenging.
	name: "[ruff] Build Docker image"

	on:
	workflow_call:
	inputs:
	plan:
	required: true
	type: string
	pull_request:
	paths:
	- .github/workflows/build-docker.yml

	env:
	RUFF_BASE_IMG: ghcr.io/${{ github.repository_owner }}/ruff

	jobs:
	docker-build:
	name: Build Docker image (ghcr.io/astral-sh/ruff) for ${{ matrix.platform }}
	runs-on: ubuntu-latest
	environment:
	name: release
	strategy:
	fail-fast: false
	matrix:
	platform:
	- linux/amd64
	- linux/arm64
	steps:
	- uses: actions/checkout@v4
	with:
	submodules: recursive
	persist-credentials: false

	- uses: docker/setup-buildx-action@v3

	- uses: docker/login-action@v3
	with:
	registry: ghcr.io
	username: ${{ github.repository_owner }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Check tag consistency
	if: ${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }}
	run: \|
	version=$(grep "version = " pyproject.toml \| sed -e 's/version = "$.*$"/\1/g')
	if [ "${{ fromJson(inputs.plan).announcement_tag }}" != "${version}" ]; then
	echo "The input tag does not match the version from pyproject.toml:" >&2
	echo "${{ fromJson(inputs.plan).announcement_tag }}" >&2
	echo "${version}" >&2
	exit 1
	else
	echo "Releasing ${version}"
	fi

	- name: Extract metadata (tags, labels) for Docker
	id: meta
	uses: docker/metadata-action@v5
	with:
	images: ${{ env.RUFF_BASE_IMG }}
	# Defining this makes sure the org.opencontainers.image.version OCI label becomes the actual release version and not the branch name
	tags: \|
	type=raw,value=dry-run,enable=${{ inputs.plan == '' \|\| fromJson(inputs.plan).announcement_tag_is_implicit }}
	type=pep440,pattern={{ version }},value=${{ inputs.plan != '' && fromJson(inputs.plan).announcement_tag \|\| 'dry-run' }},enable=${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }}

	- name: Normalize Platform Pair (replace / with -)
	run: \|
	platform=${{ matrix.platform }}
	echo "PLATFORM_TUPLE=${platform//\//-}" >> $GITHUB_ENV

	# Adapted from https://docs.docker.com/build/ci/github-actions/multi-platform/
	- name: Build and push by digest
	id: build
	uses: docker/build-push-action@v6
	with:
	context: .
	platforms: ${{ matrix.platform }}
	cache-from: type=gha,scope=ruff-${{ env.PLATFORM_TUPLE }}
	cache-to: type=gha,mode=min,scope=ruff-${{ env.PLATFORM_TUPLE }}
	labels: ${{ steps.meta.outputs.labels }}
	outputs: type=image,name=${{ env.RUFF_BASE_IMG }},push-by-digest=true,name-canonical=true,push=${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }}

	- name: Export digests
	env:
	digest: ${{ steps.build.outputs.digest }}
	run: \|
	mkdir -p /tmp/digests
	touch "/tmp/digests/${digest#sha256:}"

	- name: Upload digests
	uses: actions/upload-artifact@v4
	with:
	name: digests-${{ env.PLATFORM_TUPLE }}
	path: /tmp/digests/*
	if-no-files-found: error
	retention-days: 1

	docker-publish:
	name: Publish Docker image (ghcr.io/astral-sh/ruff)
	runs-on: ubuntu-latest
	environment:
	name: release
	needs:
	- docker-build
	if: ${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }}
	steps:
	- name: Download digests
	uses: actions/download-artifact@v4
	with:
	path: /tmp/digests
	pattern: digests-*
	merge-multiple: true

	- uses: docker/setup-buildx-action@v3

	- name: Extract metadata (tags, labels) for Docker
	id: meta
	uses: docker/metadata-action@v5
	with:
	images: ${{ env.RUFF_BASE_IMG }}
	# Order is on purpose such that the label org.opencontainers.image.version has the first pattern with the full version
	tags: \|
	type=pep440,pattern={{ version }},value=${{ fromJson(inputs.plan).announcement_tag }}
	type=pep440,pattern={{ major }}.{{ minor }},value=${{ fromJson(inputs.plan).announcement_tag }}

	- uses: docker/login-action@v3
	with:
	registry: ghcr.io
	username: ${{ github.repository_owner }}
	password: ${{ secrets.GITHUB_TOKEN }}

	# Adapted from https://docs.docker.com/build/ci/github-actions/multi-platform/
	- name: Create manifest list and push
	working-directory: /tmp/digests
	# The jq command expands the docker/metadata json "tags" array entry to `-t tag1 -t tag2 ...` for each tag in the array
	# The printf will expand the base image with the `<RUFF_BASE_IMG>@sha256:<sha256> ...` for each sha256 in the directory
	# The final command becomes `docker buildx imagetools create -t tag1 -t tag2 ... <RUFF_BASE_IMG>@sha256:<sha256_1> <RUFF_BASE_IMG>@sha256:<sha256_2> ...`
	run: \|
	docker buildx imagetools create \
	$(jq -cr '.tags \| map("-t " + .) \| join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
	$(printf '${RUFF_BASE_IMG}@sha256:%s ' *)

	docker-publish-extra:
	name: Publish additional Docker image based on ${{ matrix.image-mapping }}
	runs-on: ubuntu-latest
	environment:
	name: release
	needs:
	- docker-publish
	if: ${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }}
	strategy:
	fail-fast: false
	matrix:
	# Mapping of base image followed by a comma followed by one or more base tags (comma separated)
	# Note, org.opencontainers.image.version label will use the first base tag (use the most specific tag first)
	image-mapping:
	- alpine:3.20,alpine3.20,alpine
	- debian:bookworm-slim,bookworm-slim,debian-slim
	- buildpack-deps:bookworm,bookworm,debian
	steps:
	- uses: docker/setup-buildx-action@v3

	- uses: docker/login-action@v3
	with:
	registry: ghcr.io
	username: ${{ github.repository_owner }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Generate Dynamic Dockerfile Tags
	shell: bash
	run: \|
	set -euo pipefail

	# Extract the image and tags from the matrix variable
	IFS=',' read -r BASE_IMAGE BASE_TAGS <<< "${{ matrix.image-mapping }}"

	# Generate Dockerfile content
	cat <<EOF > Dockerfile
	FROM ${BASE_IMAGE}
	COPY --from=${RUFF_BASE_IMG}:latest /ruff /usr/local/bin/ruff
	ENTRYPOINT []
	CMD ["/usr/local/bin/ruff"]
	EOF

	# Initialize a variable to store all tag docker metadata patterns
	TAG_PATTERNS=""

	# Loop through all base tags and append its docker metadata pattern to the list
	# Order is on purpose such that the label org.opencontainers.image.version has the first pattern with the full version
	IFS=','; for TAG in ${BASE_TAGS}; do
	TAG_PATTERNS="${TAG_PATTERNS}type=pep440,pattern={{ version }},suffix=-${TAG},value=${{ fromJson(inputs.plan).announcement_tag }}\n"
	TAG_PATTERNS="${TAG_PATTERNS}type=pep440,pattern={{ major }}.{{ minor }},suffix=-${TAG},value=${{ fromJson(inputs.plan).announcement_tag }}\n"
	TAG_PATTERNS="${TAG_PATTERNS}type=raw,value=${TAG}\n"
	done

	# Remove the trailing newline from the pattern list
	TAG_PATTERNS="${TAG_PATTERNS%\\n}"

	# Export image cache name
	echo "IMAGE_REF=${BASE_IMAGE//:/-}" >> $GITHUB_ENV

	# Export tag patterns using the multiline env var syntax
	{
	echo "TAG_PATTERNS<<EOF"
	echo -e "${TAG_PATTERNS}"
	echo EOF
	} >> $GITHUB_ENV

	- name: Extract metadata (tags, labels) for Docker
	id: meta
	uses: docker/metadata-action@v5
	# ghcr.io prefers index level annotations
	env:
	DOCKER_METADATA_ANNOTATIONS_LEVELS: index
	with:
	images: ${{ env.RUFF_BASE_IMG }}
	flavor: \|
	latest=false
	tags: \|
	${{ env.TAG_PATTERNS }}

	- name: Build and push
	uses: docker/build-push-action@v6
	with:
	context: .
	platforms: linux/amd64,linux/arm64
	# We do not really need to cache here as the Dockerfile is tiny
	#cache-from: type=gha,scope=ruff-${{ env.IMAGE_REF }}
	#cache-to: type=gha,mode=min,scope=ruff-${{ env.IMAGE_REF }}
	push: true
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}
	annotations: ${{ steps.meta.outputs.annotations }}

	# This is effectively a duplicate of `docker-publish` to make https://github.com/astral-sh/ruff/pkgs/container/ruff
	# show the ruff base image first since GitHub always shows the last updated image digests
	# This works by annotating the original digests (previously non-annotated) which triggers an update to ghcr.io
	docker-republish:
	name: Annotate Docker image (ghcr.io/astral-sh/ruff)
	runs-on: ubuntu-latest
	environment:
	name: release
	needs:
	- docker-publish-extra
	if: ${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }}
	steps:
	- name: Download digests
	uses: actions/download-artifact@v4
	with:
	path: /tmp/digests
	pattern: digests-*
	merge-multiple: true

	- uses: docker/setup-buildx-action@v3

	- name: Extract metadata (tags, labels) for Docker
	id: meta
	uses: docker/metadata-action@v5
	env:
	DOCKER_METADATA_ANNOTATIONS_LEVELS: index
	with:
	images: ${{ env.RUFF_BASE_IMG }}
	# Order is on purpose such that the label org.opencontainers.image.version has the first pattern with the full version
	tags: \|
	type=pep440,pattern={{ version }},value=${{ fromJson(inputs.plan).announcement_tag }}
	type=pep440,pattern={{ major }}.{{ minor }},value=${{ fromJson(inputs.plan).announcement_tag }}

	- uses: docker/login-action@v3
	with:
	registry: ghcr.io
	username: ${{ github.repository_owner }}
	password: ${{ secrets.GITHUB_TOKEN }}

	# Adapted from https://docs.docker.com/build/ci/github-actions/multi-platform/
	- name: Create manifest list and push
	working-directory: /tmp/digests
	# The readarray part is used to make sure the quoting and special characters are preserved on expansion (e.g. spaces)
	# The jq command expands the docker/metadata json "tags" array entry to `-t tag1 -t tag2 ...` for each tag in the array
	# The printf will expand the base image with the `<RUFF_BASE_IMG>@sha256:<sha256> ...` for each sha256 in the directory
	# The final command becomes `docker buildx imagetools create -t tag1 -t tag2 ... <RUFF_BASE_IMG>@sha256:<sha256_1> <RUFF_BASE_IMG>@sha256:<sha256_2> ...`
	run: \|
	readarray -t lines <<< "$DOCKER_METADATA_OUTPUT_ANNOTATIONS"; annotations=(); for line in "${lines[@]}"; do annotations+=(--annotation "$line"); done
	docker buildx imagetools create \
	"${annotations[@]}" \
	$(jq -cr '.tags \| map("-t " + .) \| join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
	$(printf '${RUFF_BASE_IMG}@sha256:%s ' *)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Also have zizmor check for low-severity security issues #41

Workflow file

Also have zizmor check for low-severity security issues #41

Jobs

Run details

Workflow file for this run