docker publishing pipeline for riverproui

bgentry · bgentry · commit 8856e5896bec · 2025-08-03T14:28:55.000-05:00
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
@@ -9,21 +9,27 @@ on:
   pull_request:
     branches:
       - "master"
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Tag to build (e.g. v0.1.0)"
+        required: true
 
 env:
   IMAGE_NAME: ${{ github.repository }}
   REGISTRY: ghcr.io
 
 jobs:
-  build:
-    name: Build Docker image
-    runs-on: ubuntu-latest
+  build-riverui:
+    name: "Build Docker image: riverui"
+    runs-on: ${{ matrix.runner }}
     strategy:
       matrix:
-        docker_platform:
-          - linux/amd64
-          - linux/arm64
-          - linux/arm64/v8
+        include:
+          - docker_platform: linux/amd64
+            runner: ubuntu-latest
+          - docker_platform: linux/arm64
+            runner: ubuntu-24.04-arm64
     outputs:
       tags: ${{ steps.meta.outputs.tags }}
       labels: ${{ steps.meta.outputs.labels }}
@@ -36,15 +42,14 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Prepare
         run: |
           platform=${{ matrix.docker_platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -59,7 +64,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ghcr.io/${{ github.repository }}
+          images: ghcr.io/${{ env.IMAGE_NAME }}
           labels: |
             org.opencontainers.image.source=https://github.com/riverqueue/riverui
             org.opencontainers.image.description="River UI is a web-based user interface for River, a fast and reliable background job system."
@@ -69,6 +74,7 @@ jobs:
             type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
       - name: Build and push to GitHub Container Registry
         id: build
@@ -98,30 +104,108 @@ jobs:
       - name: Upload digest
         uses: actions/upload-artifact@v4
         with:
-          name: digests-${{ env.PLATFORM_PAIR }}
+          name: digests-oss-${{ env.PLATFORM_PAIR }}
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
 
-  merge:
-    name: Merge and publish image manifests
-    runs-on: ubuntu-latest
-    needs:
-      - build
+  build-riverproui:
+    name: "Build Docker image: riverproui"
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+          - docker_platform: linux/amd64
+            runner: ubuntu-latest
+          - docker_platform: linux/arm64
+            runner: ubuntu-24.04-arm64
+
     permissions:
+      attestations: write
       contents: read
       id-token: write
       packages: write
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+
+      - name: Prepare
+        run: |
+          platform=${{ matrix.docker_platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+
+      - name: Set TAG
+        run: echo "TAG=${{ inputs.ref || github.ref_name }}" >> $GITHUB_ENV
+
+      - name: Validate TAG
+        if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
+        run: |
+          if [[ ! "$TAG" == v* ]]; then
+            echo "Tag must start with 'v'"
+            exit 1
+          fi
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile.pro
+          pull: true
+          platforms: ${{ matrix.docker_platform }}
+          labels: |
+            org.opencontainers.image.source=https://github.com/riverqueue/riverui
+            org.opencontainers.image.description=River UI Pro is a web-based user interface for River, with pro features.
+            org.opencontainers.image.licenses=MPL-2.0
+          cache-from: type=registry,ref=riverqueue.com/riverproui:cache
+          cache-to: type=registry,ref=riverqueue.com/riverproui:cache,mode=max
+          outputs: type=image,name=riverqueue.com/riverproui,push-by-digest=true,name-canonical=true,push=false,annotation-index.org.opencontainers.image.description=River UI Pro
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          push-to-registry: false
+          subject-digest: ${{ steps.build.outputs.digest }}
+          subject-name: riverqueue.com/riverproui
+
+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-pro-${{ env.PLATFORM_PAIR }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge-riverui:
+    name: "Merge Docker manifests: riverui"
+    runs-on: ubuntu-latest
+    needs:
+      - build-riverui
+    permissions:
+      contents: read
+      packages: write
 
+    steps:
       - name: Download digests
         uses: actions/download-artifact@v4
         with:
           path: /tmp/digests
-          pattern: digests-*
+          pattern: digests-oss-*
           merge-multiple: true
 
       - name: Set up Docker Buildx
@@ -138,7 +222,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ghcr.io/${{ env.IMAGE_NAME }}
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           labels: |
             org.opencontainers.image.source=https://github.com/riverqueue/riverui
             org.opencontainers.image.description="River UI is a web-based user interface for River, a fast and reliable background job system."
@@ -148,13 +232,140 @@ jobs:
             type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
       - name: Create manifest list and push
         working-directory: /tmp/digests
         run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.source=https://github.com/riverqueue/riverui" \
+            --annotation "index:org.opencontainers.image.description=River UI is a web-based user interface for River, a fast and reliable background job system." \
+            --annotation "index:org.opencontainers.image.licenses=MPL-2.0" \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
             $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
 
-      - name: Inspect image
+  merge-riverproui:
+    name: "Merge Docker manifests: riverproui"
+    runs-on: ubuntu-latest
+    needs:
+      - build-riverproui
+    outputs:
+      image-name: ${{ steps.meta-pro.outputs.tags }}
+      digest: ${{ steps.merge.outputs.digest }}
+    permissions:
+      attestations: write
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: digests-pro-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker meta for Pro
+        id: meta-pro
+        uses: docker/metadata-action@v5
+        with:
+          images: riverqueue.com/riverproui
+          labels: |
+            org.opencontainers.image.source=https://github.com/riverqueue/riverui
+            org.opencontainers.image.description="River UI Pro is a web-based user interface for River, with pro features."
+            org.opencontainers.image.licenses=MPL-2.0
+          # TODO: type=ref are temporary for testing
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+
+      - name: Create manifest list and export to OCI
+        id: merge
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf 'riverqueue.com/riverproui@sha256:%s ' /tmp/digests/*)
+          docker buildx imagetools create --dry-run $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf 'riverqueue.com/riverproui@sha256:%s ' /tmp/digests/*) > /tmp/oci
+          echo "digest=$(sha256sum /tmp/oci | cut -d' ' -f1)" >> $GITHUB_OUTPUT
+
+      - name: Upload OCI artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: pro-oci
+          path: /tmp/oci
+          retention-days: 1
+
+  publish-riverproui:
+    name: "Publish Docker image: riverproui"
+    runs-on: ubuntu-latest
+    needs:
+      - merge-riverproui
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+
+      - name: Download OCI artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: pro-oci
+          path: /tmp/oci
+
+      - name: Install jq
+        run: sudo apt-get update && sudo apt-get install -y jq
+
+      - name: Install AWS CLI
+        uses: unfor19/install-aws-cli-action@v1
+        with:
+          version: 2
+          verbose: false
+          arch: amd64
+
+      - name: Configure AWS CLI
+        run: |
+          aws configure set aws_access_key_id ${{ secrets.R2_ACCESS_KEY_ID }}
+          aws configure set aws_secret_access_key ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          aws configure set default.region auto
+
+      - name: Sync blobs to R2
+        # TODO: temporary for testing
+        # if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
+        env:
+          DOCKER_RELEASE_STORAGE_BUCKET: ${{ vars.DOCKER_RELEASE_STORAGE_BUCKET }}
+          REPO_NAME: riverqueue.com/riverproui
+          ENDPOINT_URL: ${{ secrets.R2_ENDPOINT_URL }}
+        run: |
+          aws s3 cp /tmp/oci/blobs/sha256/ s3://$DOCKER_RELEASE_STORAGE_BUCKET/$REPO_NAME/blobs/sha256/ --recursive --endpoint-url $ENDPOINT_URL
+
+      - name: Upload manifest by digest
+        # TODO: temporary for testing
+        # if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
+        env:
+          DOCKER_RELEASE_STORAGE_BUCKET: ${{ vars.DOCKER_RELEASE_STORAGE_BUCKET }}
+          REPO_NAME: riverqueue.com/riverproui
+          ENDPOINT_URL: ${{ secrets.R2_ENDPOINT_URL }}
+        run: |
+          MANIFEST_DIGEST=$(sha256sum /tmp/oci/index.json | awk '{print $1}')
+          aws s3 cp /tmp/oci/index.json s3://$DOCKER_RELEASE_STORAGE_BUCKET/$REPO_NAME/manifests/sha256:$MANIFEST_DIGEST --content-type "application/vnd.docker.distribution.manifest.list.v2+json" --endpoint-url $ENDPOINT_URL
+
+      - name: Upload tagged manifests
+        # TODO: temporary for testing
+        # if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
+        env:
+          DOCKER_RELEASE_STORAGE_BUCKET: ${{ vars.DOCKER_RELEASE_STORAGE_BUCKET }}
+          REPO_NAME: riverqueue.com/riverproui
+          ENDPOINT_URL: ${{ secrets.R2_ENDPOINT_URL }}
         run: |
-          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
+          # Extract tags from the merge job output
+          TAGS=$(echo '${{ needs.merge-riverproui.outputs.image-name }}' | tr ' ' '\n' | sed 's|riverqueue.com/riverproui:||' | grep -v '^$')
+          for TAG in $TAGS; do
+            aws s3 cp /tmp/oci/index.json s3://$DOCKER_RELEASE_STORAGE_BUCKET/$REPO_NAME/manifests/$TAG --content-type "application/vnd.docker.distribution.manifest.list.v2+json" --endpoint-url $ENDPOINT_URL
+          done
diff --git a/Dockerfile b/Dockerfile
@@ -21,11 +21,13 @@ COPY *.go internal docs/README.md LICENSE ./
 COPY cmd/ cmd/
 COPY internal/ internal/
 COPY public/ public/
+COPY riverproui/ riverproui/
 COPY --from=build-ui /app/dist ./dist
 
-RUN go build -o /bin/riverui ./cmd/riverui
+ARG BINARY=riverui
+RUN go build -o /bin/$BINARY ./cmd/$BINARY
 
 FROM alpine:3.22.0
 ENV PATH_PREFIX="/"
-COPY --from=build-go /bin/riverui /bin/riverui
-CMD ["/bin/sh", "-c", "/bin/riverui -prefix=$PATH_PREFIX"]
+COPY --from=build-go /bin/$BINARY /bin/$BINARY
+CMD ["/bin/sh", "-c", "/bin/$BINARY -prefix=$PATH_PREFIX"]
diff --git a/Dockerfile.pro b/Dockerfile.pro
@@ -0,0 +1,33 @@
+# syntax=docker/dockerfile:1
+
+FROM node:22-alpine AS build-ui
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm install
+ENV NODE_ENV=production
+COPY . .
+
+RUN npx vite build
+
+# Build the Go binary, including embedded UI files:
+FROM golang:1.24-alpine AS build-go
+WORKDIR /go/src/riverui
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy Go files without copying the ui dir:
+COPY *.go internal docs/README.md LICENSE ./
+COPY cmd/ cmd/
+COPY internal/ internal/
+COPY public/ public/
+COPY riverproui/ riverproui/
+COPY --from=build-ui /app/dist ./dist
+
+WORKDIR /go/src/riverui/riverproui
+RUN go build -o /bin/riverproui ./cmd/riverproui
+
+FROM alpine:3.22.0
+ENV PATH_PREFIX="/"
+COPY --from=build-go /bin/riverproui /bin/riverproui
+CMD ["/bin/sh", "-c", "/bin/riverproui -prefix=$PATH_PREFIX"]
