From 15c17d9027f7c91cd38da9fe59d27e25d37185c5 Mon Sep 17 00:00:00 2001 From: Toshihiko SHIMOKAWA Date: Tue, 17 Jun 2025 12:59:42 +0900 Subject: [PATCH 1/2] Add ARM runner support to stable workflow - Based on last stable version (5b1f1fe) to avoid BOLT issues - Add matrix strategy for AMD64/ARM64 separate builds - Use arm-runner for native ARM64 builds - Add ARM runner availability check with notice - Add actionlint.yaml config for custom runner validation - Keep simple stable Dockerfile without complex optimizations --- .github/actionlint.yaml | 3 ++ .github/workflows/build-latest.yml | 55 ++++++++++++++++++++++++------ 2 files changed, 48 insertions(+), 10 deletions(-) create mode 100644 .github/actionlint.yaml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml new file mode 100644 index 0000000..163c71f --- /dev/null +++ b/.github/actionlint.yaml @@ -0,0 +1,3 @@ +self-hosted-runner: + labels: + - arm-runner \ No newline at end of file diff --git a/.github/workflows/build-latest.yml b/.github/workflows/build-latest.yml index ccf3c12..7573f11 100644 --- a/.github/workflows/build-latest.yml +++ b/.github/workflows/build-latest.yml @@ -1,29 +1,64 @@ +--- name: Build latest -on: +"on": push: branches: - main jobs: build: - runs-on: ubuntu-latest + strategy: + matrix: + include: + - platform: linux/amd64 + runner: ubuntu-latest + - platform: linux/arm64 + runner: arm-runner + runs-on: ${{ matrix.runner }} permissions: contents: read packages: write steps: + - name: Check ARM runner availability + if: matrix.runner == 'arm-runner' + run: | + echo "::notice::Using ARM runner for native ARM64 build" + echo "Runner: ${{ matrix.runner }}" + echo "Platform: ${{ matrix.platform }}" + - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@v4 + + - name: Set up QEMU + if: matrix.platform == 'linux/arm64' && matrix.runner == 'ubuntu-latest' + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Login to GitHub Container Registry - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - name: Build Docker image - uses: ./.github/actions/build/ + + - name: Extract metadata + id: meta + uses: docker/metadata-action@v5 with: - platforms: linux/amd64,linux/arm64 - push: true + images: ghcr.io/${{ github.repository_owner }}/atcoder-container tags: | - ghcr.io/${{ github.repository_owner }}/atcoder-container:latest - ghcr.io/${{ github.repository_owner }}/atcoder-container:all + type=raw,value=latest + type=raw,value=all + + - name: Build and push Docker image + uses: docker/build-push-action@v5 + with: + context: . + platforms: ${{ matrix.platform }} + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max From d323c71cc707ea7bd87ade8eca42f0d0c0fa4d65 Mon Sep 17 00:00:00 2001 From: Toshihiko SHIMOKAWA Date: Tue, 21 Oct 2025 21:41:55 +0900 Subject: [PATCH 2/2] Fix PR #26 review comments: multi-arch manifest, SHA pinning, and cache scope - Add Docker manifest creation step to properly combine multi-arch images - Pin all GitHub Actions to specific SHA for security (addresses comment #2448010099, #2448010127) - Add platform-specific cache scope to avoid conflicts (addresses comment #2448010152) - Use architecture-specific intermediate tags (latest-amd64, latest-arm64, all-amd64, all-arm64) - Create final multi-arch manifest images with original tags (latest, all) (addresses comment #2448010076) - Pass yamllint and actionlint validation --- .github/workflows/build-latest.yml | 60 +++++++++++++++++++++++++----- 1 file changed, 50 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build-latest.yml b/.github/workflows/build-latest.yml index 7573f11..a9b83c7 100644 --- a/.github/workflows/build-latest.yml +++ b/.github/workflows/build-latest.yml @@ -12,8 +12,10 @@ jobs: include: - platform: linux/amd64 runner: ubuntu-latest + arch: amd64 - platform: linux/arm64 runner: arm-runner + arch: arm64 runs-on: ${{ matrix.runner }} permissions: contents: read @@ -27,17 +29,22 @@ jobs: echo "Platform: ${{ matrix.platform }}" - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 + # v4.1.7 - name: Set up QEMU if: matrix.platform == 'linux/arm64' && matrix.runner == 'ubuntu-latest' - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf + # v3.2.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + # yamllint disable-line rule:line-length + uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db + # v3.6.1 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 + # v3.3.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -45,20 +52,53 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 + # v5.5.1 with: images: ghcr.io/${{ github.repository_owner }}/atcoder-container tags: | - type=raw,value=latest - type=raw,value=all + type=raw,value=latest-${{ matrix.arch }} + type=raw,value=all-${{ matrix.arch }} - name: Build and push Docker image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 + # v6.7.0 with: context: . platforms: ${{ matrix.platform }} push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max + cache-from: type=gha,scope=${{ matrix.platform }} + cache-to: type=gha,mode=max,scope=${{ matrix.platform }} + + create-manifest: + needs: build + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + steps: + - name: Login to GitHub Container Registry + uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 + # v3.3.0 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Create and push manifest for latest + run: | + IMAGE=ghcr.io/${{ github.repository_owner }}/atcoder-container + docker buildx imagetools create \ + -t ${IMAGE}:latest \ + ${IMAGE}:latest-amd64 \ + ${IMAGE}:latest-arm64 + + - name: Create and push manifest for all + run: | + IMAGE=ghcr.io/${{ github.repository_owner }}/atcoder-container + docker buildx imagetools create \ + -t ${IMAGE}:all \ + ${IMAGE}:all-amd64 \ + ${IMAGE}:all-arm64