docker publishing pipeline for riverproui

bgentry · bgentry · commit 383569ceca4e · 2025-08-02T20:09:24.000-05:00
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
@@ -9,21 +9,27 @@ on:
   pull_request:
     branches:
       - "master"
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Tag to build (e.g. v0.1.0)"
+        required: true
 
 env:
   IMAGE_NAME: ${{ github.repository }}
   REGISTRY: ghcr.io
 
 jobs:
-  build:
-    name: Build Docker image
-    runs-on: ubuntu-latest
+  build-riverui:
+    name: "Build Docker image: riverui"
+    runs-on: ${{ matrix.runner }}
     strategy:
       matrix:
-        docker_platform:
-          - linux/amd64
-          - linux/arm64
-          - linux/arm64/v8
+        include:
+          - docker_platform: linux/amd64
+            runner: ubuntu-latest
+          - docker_platform: linux/arm64
+            runner: ubuntu-24.04-arm64
     outputs:
       tags: ${{ steps.meta.outputs.tags }}
       labels: ${{ steps.meta.outputs.labels }}
@@ -36,15 +42,14 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Prepare
         run: |
           platform=${{ matrix.docker_platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -59,7 +64,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ghcr.io/${{ github.repository }}
+          images: ghcr.io/${{ env.IMAGE_NAME }}
           labels: |
             org.opencontainers.image.source=https://github.com/riverqueue/riverui
             org.opencontainers.image.description="River UI is a web-based user interface for River, a fast and reliable background job system."
@@ -69,6 +74,7 @@ jobs:
             type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
       - name: Build and push to GitHub Container Registry
         id: build
@@ -98,63 +104,150 @@ jobs:
       - name: Upload digest
         uses: actions/upload-artifact@v4
         with:
-          name: digests-${{ env.PLATFORM_PAIR }}
+          name: digests-oss-${{ env.PLATFORM_PAIR }}
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
 
-  merge:
-    name: Merge and publish image manifests
+  build-riverproui:
+    name: "Build Docker image: riverproui"
     runs-on: ubuntu-latest
-    needs:
-      - build
+    # TODO: disabled for testing
+    # if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
     permissions:
+      attestations: write
       contents: read
       id-token: write
-      packages: write
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
-      - name: Download digests
-        uses: actions/download-artifact@v4
         with:
-          path: /tmp/digests
-          pattern: digests-*
-          merge-multiple: true
+          ref: ${{ inputs.ref || github.ref }}
+
+      - name: Set TAG
+        run: echo "TAG=${{ inputs.ref || github.ref_name }}" >> $GITHUB_ENV
+
+      - name: Validate TAG
+        run: |
+          if [[ ! "$TAG" == v* ]]; then
+            echo "Tag must start with 'v'"
+            exit 1
+          fi
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+      - name: Docker meta for Pro
+        id: meta-pro
+        uses: docker/metadata-action@v5
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          images: riverqueue.com/riverproui
+          labels: |
+            org.opencontainers.image.source=https://github.com/riverqueue/riverui
+            org.opencontainers.image.description="River UI Pro is a web-based user interface for River, with pro features."
+            org.opencontainers.image.licenses=MPL-2.0
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
-      - name: Docker meta
-        id: meta
+      - name: Build and export to OCI
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile.pro
+          platforms: linux/amd64,linux/arm64
+          provenance: true
+          push: false
+          tags: ${{ steps.meta-pro.outputs.tags }}
+          labels: ${{ steps.meta-pro.outputs.labels }}
+          outputs: type=oci,dest=/tmp/oci
+
+      - name: Upload OCI artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: pro-oci
+          path: /tmp/oci
+          retention-days: 1
+
+  publish-riverproui:
+    name: "Publish Docker image: riverproui"
+    runs-on: ubuntu-latest
+    needs:
+      - build-riverproui
+    # TODO: disabled for testing
+    # if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+
+      - name: Download OCI artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: pro-oci
+          path: /tmp/oci
+
+      - name: Install jq
+        run: sudo apt-get update && sudo apt-get install -y jq
+
+      - name: Install AWS CLI
+        uses: unfor19/install-aws-cli-action@v1
+        with:
+          version: 2
+          verbose: false
+          arch: amd64
+
+      - name: Configure AWS CLI
+        run: |
+          aws configure set aws_access_key_id ${{ secrets.R2_ACCESS_KEY_ID }}
+          aws configure set aws_secret_access_key ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          aws configure set default.region auto
+
+      - name: Docker meta for Pro
+        id: meta-pro
         uses: docker/metadata-action@v5
         with:
-          images: ghcr.io/${{ env.IMAGE_NAME }}
+          images: riverqueue.com/riverproui
           labels: |
             org.opencontainers.image.source=https://github.com/riverqueue/riverui
-            org.opencontainers.image.description="River UI is a web-based user interface for River, a fast and reliable background job system."
+            org.opencontainers.image.description="River UI Pro is a web-based user interface for River, a fast and reliable background job system, with pro features enabled."
             org.opencontainers.image.licenses=MPL-2.0
           tags: |
-            type=ref,event=branch
-            type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
-      - name: Create manifest list and push
-        working-directory: /tmp/digests
+      - name: Sync blobs to R2
+        env:
+          DOCKER_RELEASE_STORAGE_BUCKET: ${{ vars.DOCKER_RELEASE_STORAGE_BUCKET }}
+          REPO_NAME: riverqueue.com/riverproui
+          ENDPOINT_URL: ${{ secrets.R2_ENDPOINT_URL }}
         run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
+          aws s3 cp /tmp/oci/blobs/sha256/ s3://$DOCKER_RELEASE_STORAGE_BUCKET/$REPO_NAME/blobs/sha256/ --recursive --endpoint-url $ENDPOINT_URL
 
-      - name: Inspect image
+      - name: Upload manifest by digest
+        env:
+          DOCKER_RELEASE_STORAGE_BUCKET: ${{ vars.DOCKER_RELEASE_STORAGE_BUCKET }}
+          REPO_NAME: riverqueue.com/riverproui
+          ENDPOINT_URL: ${{ secrets.R2_ENDPOINT_URL }}
+        run: |
+          MANIFEST_DIGEST=$(sha256sum /tmp/oci/index.json | awk '{print $1}')
+          aws s3 cp /tmp/oci/index.json s3://$DOCKER_RELEASE_STORAGE_BUCKET/$REPO_NAME/manifests/sha256:$MANIFEST_DIGEST --content-type "application/vnd.docker.distribution.manifest.list.v2+json" --endpoint-url $ENDPOINT_URL
+
+      - name: Upload tagged manifests
+        env:
+          DOCKER_RELEASE_STORAGE_BUCKET: ${{ vars.DOCKER_RELEASE_STORAGE_BUCKET }}
+          REPO_NAME: riverqueue.com/riverproui
+          ENDPOINT_URL: ${{ secrets.R2_ENDPOINT_URL }}
         run: |
-          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
+          TAGS=$(echo '${{ steps.meta-pro.outputs.json }}' | jq -r '.tags[] | split("/")[-1]')
+          for TAG in $TAGS; do
+            aws s3 cp /tmp/oci/index.json s3://$DOCKER_RELEASE_STORAGE_BUCKET/$REPO_NAME/manifests/$TAG --content-type "application/vnd.docker.distribution.manifest.list.v2+json" --endpoint-url $ENDPOINT_URL
+          done
diff --git a/Dockerfile b/Dockerfile
@@ -21,11 +21,13 @@ COPY *.go internal docs/README.md LICENSE ./
 COPY cmd/ cmd/
 COPY internal/ internal/
 COPY public/ public/
+COPY riverproui/ riverproui/
 COPY --from=build-ui /app/dist ./dist
 
-RUN go build -o /bin/riverui ./cmd/riverui
+ARG BINARY=riverui
+RUN go build -o /bin/$BINARY ./cmd/$BINARY
 
 FROM alpine:3.22.0
 ENV PATH_PREFIX="/"
-COPY --from=build-go /bin/riverui /bin/riverui
-CMD ["/bin/sh", "-c", "/bin/riverui -prefix=$PATH_PREFIX"]
+COPY --from=build-go /bin/$BINARY /bin/$BINARY
+CMD ["/bin/sh", "-c", "/bin/$BINARY -prefix=$PATH_PREFIX"]
diff --git a/Dockerfile.pro b/Dockerfile.pro
@@ -0,0 +1,33 @@
+# syntax=docker/dockerfile:1
+
+FROM node:22-alpine AS build-ui
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm install
+ENV NODE_ENV=production
+COPY . .
+
+RUN npx vite build
+
+# Build the Go binary, including embedded UI files:
+FROM golang:1.24-alpine AS build-go
+WORKDIR /go/src/riverui
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy Go files without copying the ui dir:
+COPY *.go internal docs/README.md LICENSE ./
+COPY cmd/ cmd/
+COPY internal/ internal/
+COPY public/ public/
+COPY riverproui/ riverproui/
+COPY --from=build-ui /app/dist ./dist
+
+WORKDIR /go/src/riverui/riverproui
+RUN go build -o /bin/riverproui ./cmd/riverproui
+
+FROM alpine:3.22.0
+ENV PATH_PREFIX="/"
+COPY --from=build-go /bin/riverproui /bin/riverproui
+CMD ["/bin/sh", "-c", "/bin/riverproui -prefix=$PATH_PREFIX"]
