ci: add Docker image publishing workflow#319
Conversation
Add CI workflow that builds and pushes multi-platform Docker images (linux/amd64, linux/arm64) to GitHub Container Registry on tagged releases (v*). Uses docker/build-push-action with BuildKit cache, docker/metadata-action for semver tagging, and QEMU for cross-platform builds.
WalkthroughA new GitHub Actions workflow is added to automate Docker image publishing to GitHub Container Registry on tagged releases. The workflow is triggered by push events matching Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Adds CI automation to publish multi-arch Docker images to GHCR on version tag pushes, aligning releases with a consistent container distribution path.
Changes:
- Introduces a new GitHub Actions workflow to build and push
linux/amd64+linux/arm64images onv*tag pushes. - Uses
docker/metadata-actionfor semver/minor/SHA tagging and BuildKit GHA cache for faster rebuilds. - Updates
CHANGELOG.mdwith an Unreleased entry describing the new workflow.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/workflows/docker-publish.yml |
New workflow to build/push multi-platform images to GHCR on tag pushes. |
CHANGELOG.md |
Adds an Unreleased “Added” entry for the new Docker publish workflow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| id: meta | ||
| uses: docker/metadata-action@v5 | ||
| with: | ||
| images: ghcr.io/${{ github.repository }} |
There was a problem hiding this comment.
images: ghcr.io/${{ github.repository }} will expand to ghcr.io/KiiChain/kiichain in this repo, and Docker image references must be lowercase. This can cause invalid reference format and prevent publishing. Use an explicit lowercase image name (e.g. ghcr.io/kiichain/kiichain, per the PR description) or otherwise ensure the value is lowercased before passing it to metadata-action.
| images: ghcr.io/${{ github.repository }} | |
| images: ghcr.io/kiichain/kiichain |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/docker-publish.yml (1)
16-43: Pin third-party GitHub Actions to immutable SHAs for publish security.Using floating tags (
@v3/@v4/@v5/@v6) in a release-publish workflow weakens supply-chain guarantees. Please pin these actions to full commit SHAs and let Dependabot/Renovate handle updates.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/docker-publish.yml around lines 16 - 43, The workflow uses floating action tags (actions/checkout@v4, docker/setup-qemu-action@v3, docker/setup-buildx-action@v3, docker/login-action@v3, docker/metadata-action@v5, docker/build-push-action@v6) which should be replaced with immutable commit SHAs; update each uses: line to reference the corresponding full commit SHA for the specific release you want to lock to (for example replace actions/checkout@v4 with actions/checkout@<full-sha>), commit the updated .github/workflows/docker-publish.yml, and rely on Dependabot/Renovate to propose future SHA upgrades rather than using floating tags.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/docker-publish.yml:
- Line 47: The Dockerfile uses uname -m in the RUN cp
"/lib/libwasmvm_muslc.$(uname -m).a" step which picks the build host arch and
breaks cross-platform builds; add ARG TARGETARCH near the top of the Dockerfile,
replace the uname usage with the BuildKit variable (use ${TARGETARCH} in the
COPY/CP step), and add a small mapping step in the Dockerfile to translate
TARGETARCH values to the library naming convention (map amd64 -> x86_64 and
arm64 -> aarch64) so RUN cp "/lib/libwasmvm_muslc.${LIB_ARCH}.a"
/lib/libwasmvm_muslc.a uses the correct suffix at build time.
---
Nitpick comments:
In @.github/workflows/docker-publish.yml:
- Around line 16-43: The workflow uses floating action tags
(actions/checkout@v4, docker/setup-qemu-action@v3,
docker/setup-buildx-action@v3, docker/login-action@v3,
docker/metadata-action@v5, docker/build-push-action@v6) which should be replaced
with immutable commit SHAs; update each uses: line to reference the
corresponding full commit SHA for the specific release you want to lock to (for
example replace actions/checkout@v4 with actions/checkout@<full-sha>), commit
the updated .github/workflows/docker-publish.yml, and rely on
Dependabot/Renovate to propose future SHA upgrades rather than using floating
tags.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 753b4af3-c1de-484d-a5a0-cbc90188613e
📒 Files selected for processing (2)
.github/workflows/docker-publish.ymlCHANGELOG.md
| with: | ||
| context: . | ||
| push: true | ||
| platforms: linux/amd64,linux/arm64 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether arch selection is target-aware before publishing multi-arch images.
# Expected: TARGETARCH/TARGETPLATFORM usage should exist in Dockerfile/build path.
# Risk signal: `uname -m` present but TARGETARCH/TARGETPLATFORM absent.
set -euo pipefail
echo "== Dockerfile arch-related checks =="
fd -i '^Dockerfile$' --exec rg -n 'uname -m|TARGETARCH|TARGETPLATFORM|GOARCH|GOOS|libwasmvm_muslc'
echo
echo "== Makefile cross-compile signal checks =="
fd -i '^Makefile$' --exec rg -n 'GOARCH|GOOS|CGO_ENABLED|make build|BUILD_TAGS'Repository: KiiChain/kiichain
Length of output: 885
🏁 Script executed:
#!/bin/bash
# Get the full Dockerfile to check BuildKit syntax and architecture handling
echo "== Full Dockerfile =="
fd -i '^Dockerfile$' --exec cat {}
echo
echo "== docker-publish.yml complete workflow =="
cat .github/workflows/docker-publish.yml
echo
echo "== Makefile build targets (lines around 'docker-build' or 'build' targets) =="
fd -i '^Makefile$' --exec sed -n '160,220p' {}Repository: KiiChain/kiichain
Length of output: 4676
Broken linux/arm64 publish path: Dockerfile uses uname -m instead of TARGETARCH.
The workflow at line 47 enables multi-arch publishing (linux/amd64,linux/arm64), but the Dockerfile line 16 uses RUN cp "/lib/libwasmvm_muslc.$(uname -m).a" /lib/libwasmvm_muslc.a, which executes at build time and returns the build host's architecture, not the target platform. This will fail when cross-compiling: building linux/arm64 on an amd64 host will attempt to link the x86_64 library into an arm64 binary.
Fix by replacing $(uname -m) with BuildKit's TARGETARCH variable:
- Add
ARG TARGETARCHnear the top of the Dockerfile - Change line 16 to:
RUN cp "/lib/libwasmvm_muslc.${TARGETARCH}.a" /lib/libwasmvm_muslc.a
This requires mapping the BuildKit TARGETARCH values (amd64 and arm64) to the downloaded library naming convention (x86_64 and aarch64).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/docker-publish.yml at line 47, The Dockerfile uses uname
-m in the RUN cp "/lib/libwasmvm_muslc.$(uname -m).a" step which picks the build
host arch and breaks cross-platform builds; add ARG TARGETARCH near the top of
the Dockerfile, replace the uname usage with the BuildKit variable (use
${TARGETARCH} in the COPY/CP step), and add a small mapping step in the
Dockerfile to translate TARGETARCH values to the library naming convention (map
amd64 -> x86_64 and arm64 -> aarch64) so RUN cp
"/lib/libwasmvm_muslc.${LIB_ARCH}.a" /lib/libwasmvm_muslc.a uses the correct
suffix at build time.
|
Hi @jhelison — friendly ping! This PR is ready for review whenever you have a moment. All CI checks are passing. Happy to address any feedback. Thanks! |
|
Hey @Thaleszh, would love to get your eyes on this when you have a moment. Thanks! |
Summary
Adds a GitHub Actions workflow that automatically builds and publishes multi-platform Docker images to GitHub Container Registry (GHCR) whenever a version tag (
v*) is pushed.Closes #61
What this does
v*tag push (e.g.v7.2.0)ghcr.io/kiichain/kiichainlinux/amd64andlinux/arm64(matches the wasmvm libs already in the Dockerfile)7.2.0), minor (7.2), and git SHAtype=gha) for faster rebuildsGITHUB_TOKEN— no extra secrets requiredFiles changed
.github/workflows/docker-publish.ymlCHANGELOG.md