Merge pull request #879 from ethpandaops/gloas-fixes #594
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: goreleaser | |
| on: | |
| push: | |
| tags: | |
| - '*' | |
| jobs: | |
| goreleaser: | |
| permissions: | |
| contents: write | |
| runs-on: | |
| - self-hosted-ghr | |
| - size-l-x64 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.ref }} | |
| - name: Derive release suffix from tag (if it exists) | |
| run: | | |
| # Strip the 'refs/tags/' prefix | |
| TAG_NAME=${GITHUB_REF#refs/tags/} | |
| # A release-branch tag is a semver core followed by everything after the | |
| # FIRST '-' (e.g. 'glamsterdam-devnet-7' from '0.0.1-glamsterdam-devnet-7', | |
| # 'dencun' from 'v1.0.0-dencun'). Anchoring on the semver core keeps | |
| # multi-word suffixes intact and leaves plain 'vX.Y.Z' tags unsuffixed. | |
| if [[ $TAG_NAME =~ ^v?[0-9]+\.[0-9]+\.[0-9]+-(.+)$ ]]; then | |
| RELEASE_SUFFIX="${BASH_REMATCH[1]}" | |
| else | |
| RELEASE_SUFFIX="" | |
| fi | |
| echo "RELEASE_SUFFIX=$RELEASE_SUFFIX" >> $GITHUB_ENV | |
| echo "Release suffix: $RELEASE_SUFFIX" | |
| - name: Set up Go | |
| uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| name: Set up Node | |
| with: | |
| node-version: 18 | |
| - name: Run apt-get update | |
| run: sudo apt-get update | |
| - name: Install cross-compiler for linux/arm64 | |
| run: sudo apt-get -y install gcc-aarch64-linux-gnu | |
| - name: Install make | |
| run: sudo apt-get -y install make | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 | |
| - name: Set up Docker Context for Buildx | |
| shell: bash | |
| id: buildx-context | |
| run: | | |
| docker context create builders | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 | |
| with: | |
| endpoint: builders | |
| - name: Login to DockerHub | |
| uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Update GoReleaser config | |
| run: | | |
| cp .goreleaser.yaml .goreleaser.yaml.new | |
| # If we have a RELEASE_SUFFIX, update the goreleaser config to not set | |
| # the release as the latest | |
| if [[ -n "$RELEASE_SUFFIX" ]]; then | |
| echo "release:" >> .goreleaser.yaml.new | |
| echo " prerelease: true" >> .goreleaser.yaml.new | |
| echo " make_latest: false" >> .goreleaser.yaml.new | |
| fi | |
| - name: Run GoReleaser in Docker | |
| run: | | |
| docker run --rm \ | |
| -v ${{ github.workspace }}:/workspace \ | |
| -w /workspace \ | |
| -e GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} \ | |
| -e DOCKER_USERNAME=${{ secrets.DOCKERHUB_USERNAME }} \ | |
| -e DOCKER_PASSWORD=${{ secrets.DOCKERHUB_TOKEN }} \ | |
| -v /var/run/docker.sock:/var/run/docker.sock \ | |
| -e RELEASE_SUFFIX=${{ env.RELEASE_SUFFIX }} \ | |
| goreleaser/goreleaser-cross:v1.26 release --clean --config .goreleaser.yaml.new | |
| # The xatu+cryo image is the EL-cannon variant: it bundles the cryo binary | |
| # alongside xatu. cryo is built from Rust source (./Dockerfile), so it does | |
| # not fit goreleaser's copy-the-prebuilt-binary docker flow — and building | |
| # it inside goreleaser would force every PR's test-build to compile cryo. | |
| # We build it here, release-only. The cryo ref is pinned in ./Dockerfile | |
| # (ARG CRYO_GIT_REF); that layer is cache-stable, so it only recompiles | |
| # when the pinned ref changes. | |
| # | |
| # Cache is a registry image (ethpandaops/xatu:cryo-buildcache), NOT GHA | |
| # cache: GHA cache is scoped per git ref, and releases are tag-triggered, | |
| # so a v1.18.2 run could not read the v1.18.1 run's cache (only its own | |
| # ref + the default branch). Registry cache is ref-agnostic, so every | |
| # release reuses the prior cryo-builder layer and skips the ~10 min Rust | |
| # compile until CRYO_GIT_REF changes (which invalidates that layer and | |
| # recompiles once, then re-warms the cache). | |
| # | |
| # amd64-only: EL cannon runs on amd64 servers, and compiling cryo for | |
| # arm64 under QEMU emulation takes 30-60+ min (it hung a release for | |
| # 35+ min). Native amd64 compiles in ~2-3 min. Add linux/arm64 back here | |
| # only if cannon ever needs to run on arm64. | |
| - name: Derive cryo image version | |
| run: | | |
| echo "CRYO_GIT_COMMIT=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV" | |
| # Match goreleaser's {{ .Version }} (tag with a single leading 'v' stripped). | |
| TAG_NAME=${GITHUB_REF#refs/tags/} | |
| echo "CRYO_IMAGE_VERSION=${TAG_NAME#v}" >> "$GITHUB_ENV" | |
| - name: Build and push xatu+cryo image | |
| uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| provenance: false | |
| sbom: false | |
| build-args: | | |
| VERSION=${{ env.CRYO_IMAGE_VERSION }} | |
| GIT_COMMIT=${{ env.CRYO_GIT_COMMIT }} | |
| tags: | | |
| ethpandaops/xatu:${{ env.CRYO_IMAGE_VERSION }}-cryo | |
| ethpandaops/xatu:${{ env.RELEASE_SUFFIX && format('{0}-cryo', env.RELEASE_SUFFIX) || 'cryo-latest' }} | |
| cache-from: type=registry,ref=ethpandaops/xatu:cryo-buildcache | |
| cache-to: type=registry,ref=ethpandaops/xatu:cryo-buildcache,mode=max,ignore-error=true |