Skip to content

Commit 2307a93

Browse files
0sm0s1z0sm0s1z
committed
fix(compose): add local infra fallback for base-builder dependency
Resolve quick-start failures when GHCR base images are unavailable by making infra containers build system-monitor locally, while preserving CI namespace/tag hardening and documenting the resilient Option 1 flow. Fixes #114 Made-with: Cursor
1 parent fd0b68b commit 2307a93

File tree

8 files changed

+98
-23
lines changed

8 files changed

+98
-23
lines changed

‎.github/workflows/build-base-images.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,15 @@ jobs:
103103
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest-arm64
104104
echo "Published ghcr.io/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest (amd64 + arm64)"
105105
106+
- name: Verify go-builder tags resolve
107+
run: |
108+
set -e
109+
BASE="${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder"
110+
for TAG in latest latest-amd64 latest-arm64; do
111+
echo "Verifying ${BASE}:${TAG}"
112+
docker manifest inspect "${BASE}:${TAG}" > /dev/null
113+
done
114+
106115
# ─────────────────────────────────────────────────────────────────────────────
107116
# Build engine-tools base image (per architecture, native runners)
108117
#
@@ -179,3 +188,12 @@ jobs:
179188
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest-amd64 \
180189
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest-arm64
181190
echo "Published ghcr.io/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest (amd64 + arm64)"
191+
192+
- name: Verify engine-tools tags resolve
193+
run: |
194+
set -e
195+
BASE="${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools"
196+
for TAG in latest latest-amd64 latest-arm64; do
197+
echo "Verifying ${BASE}:${TAG}"
198+
docker manifest inspect "${BASE}:${TAG}" > /dev/null
199+
done

‎.github/workflows/ci.yml‎

Lines changed: 29 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,27 @@ jobs:
107107
fi
108108
fi
109109
110+
# ─────────────────────────────────────────────────────────────────────────────
111+
# Guard against accidental image namespace typos in CI/build paths.
112+
# ─────────────────────────────────────────────────────────────────────────────
113+
guard-registry-namespace:
114+
name: "Guard Registry Namespace"
115+
needs: detect-changes
116+
runs-on: blacksmith-4vcpu-ubuntu-2404
117+
steps:
118+
- name: Checkout code
119+
uses: actions/checkout@v4
120+
121+
- name: Fail on typoed GHCR namespace
122+
run: |
123+
set -e
124+
TARGETS=".github/workflows docker-compose.yaml docker-stack.swarm.yaml scripts sirius-api sirius-engine sirius-postgres sirius-rabbitmq sirius-ui sirius-valkey"
125+
if grep -R --line-number "ghcr.io/siriuscam/" $TARGETS; then
126+
echo "::error::Found typoed GHCR namespace 'siriuscam'. Use '${{ env.IMAGE_NAMESPACE }}'."
127+
exit 1
128+
fi
129+
echo "Registry namespace guard passed."
130+
110131
# ─────────────────────────────────────────────────────────────────────────────
111132
# Verify base images exist in GHCR before any application build starts.
112133
# This catches the race condition where Build Base Images and CI both trigger
@@ -115,7 +136,7 @@ jobs:
115136
# ─────────────────────────────────────────────────────────────────────────────
116137
verify-base-images:
117138
name: "Verify Base Images"
118-
needs: detect-changes
139+
needs: [detect-changes, guard-registry-namespace]
119140
runs-on: blacksmith-4vcpu-ubuntu-2404
120141
steps:
121142
- name: Log in to Container Registry
@@ -128,14 +149,17 @@ jobs:
128149
- name: Verify base images exist
129150
run: |
130151
set -e
131-
echo "Checking ghcr.io/siriusscan/sirius-base-go-builder:latest ..."
132-
docker manifest inspect ghcr.io/siriusscan/sirius-base-go-builder:latest > /dev/null || {
152+
BASE_GO_BUILDER="${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest"
153+
BASE_ENGINE_TOOLS="${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest"
154+
155+
echo "Checking ${BASE_GO_BUILDER} ..."
156+
docker manifest inspect "${BASE_GO_BUILDER}" > /dev/null || {
133157
echo "::error::Base image sirius-base-go-builder:latest not found in GHCR."
134158
echo "::error::Run the 'Build Base Images' workflow first (Actions → Build Base Images → Run workflow)."
135159
exit 1
136160
}
137-
echo "Checking ghcr.io/siriusscan/sirius-base-engine-tools:latest ..."
138-
docker manifest inspect ghcr.io/siriusscan/sirius-base-engine-tools:latest > /dev/null || {
161+
echo "Checking ${BASE_ENGINE_TOOLS} ..."
162+
docker manifest inspect "${BASE_ENGINE_TOOLS}" > /dev/null || {
139163
echo "::error::Base image sirius-base-engine-tools:latest not found in GHCR."
140164
echo "::error::Run the 'Build Base Images' workflow first (Actions → Build Base Images → Run workflow)."
141165
exit 1

‎README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,10 @@ docker compose -f docker-compose.installer.yaml run --rm sirius-installer
143143
docker compose up -d
144144
```
145145

146+
Quick-start resilience: if the shared GHCR base-builder image is unavailable,
147+
infra services (`sirius-valkey`, `sirius-postgres`, `sirius-rabbitmq`) now
148+
build `system-monitor` locally during image build.
149+
146150
#### Option 2: Local Development Overlay
147151

148152
Use live-reload/development mounts for active code work:

‎docker-compose.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
# SiriusScan Base Docker Compose Configuration
2-
# This is the base configuration that works for most environments
2+
# This is the base configuration that works for most environments.
3+
# Infra services (postgres/rabbitmq/valkey) build system-monitor locally
4+
# during image build so standard startup is resilient if GHCR base images
5+
# are unavailable.
36
# Use with: docker compose up -d
47

58
name: sirius

‎scripts/validate-ci-overhaul.sh‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
# 3. Validate docker-compose configs
99
# 4. Optionally run a minimal compose stack to verify startup
1010
#
11-
# Base images are tagged as ghcr.io/siriusscan/sirius-base-*:latest
11+
# Base images are tagged as ${REGISTRY}/${IMAGE_NAMESPACE}/sirius-base-*:latest
1212
# so the application Dockerfiles (which use COPY --from=...) find them
1313
# in the local Docker daemon without needing to pull from the registry.
1414
#
@@ -28,6 +28,14 @@ if [[ "${1:-}" == "--full-compose" ]]; then
2828
FULL_COMPOSE=true
2929
fi
3030

31+
REGISTRY="${REGISTRY:-ghcr.io}"
32+
IMAGE_NAMESPACE="${IMAGE_NAMESPACE:-siriusscan}"
33+
BASE_IMAGE_TAG="${BASE_IMAGE_TAG:-latest}"
34+
BASE_GO_BUILDER_IMAGE="${REGISTRY}/${IMAGE_NAMESPACE}/sirius-base-go-builder:${BASE_IMAGE_TAG}"
35+
BASE_ENGINE_TOOLS_IMAGE="${REGISTRY}/${IMAGE_NAMESPACE}/sirius-base-engine-tools:${BASE_IMAGE_TAG}"
36+
BASE_GO_BUILDER_LATEST_IMAGE="${REGISTRY}/${IMAGE_NAMESPACE}/sirius-base-go-builder:latest"
37+
BASE_ENGINE_TOOLS_LATEST_IMAGE="${REGISTRY}/${IMAGE_NAMESPACE}/sirius-base-engine-tools:latest"
38+
3139
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
3240
PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
3341
LOG_DIR="$PROJECT_ROOT/testing/logs"
@@ -72,17 +80,17 @@ log "${YELLOW}Phase 1: Base Images${NC}"
7280
log ""
7381

7482
run_step "Build sirius-base-go-builder" \
75-
"docker build -t ghcr.io/siriusscan/sirius-base-go-builder:latest ./base-images/go-builder/" || exit 1
83+
"docker build -t ${BASE_GO_BUILDER_IMAGE} -t ${BASE_GO_BUILDER_LATEST_IMAGE} ./base-images/go-builder/" || exit 1
7684

7785
run_step "Build sirius-base-engine-tools (this compiles Nmap from source, may take a few minutes)" \
78-
"docker build -t ghcr.io/siriusscan/sirius-base-engine-tools:latest ./base-images/engine-tools/" || exit 1
86+
"docker build -t ${BASE_ENGINE_TOOLS_IMAGE} -t ${BASE_ENGINE_TOOLS_LATEST_IMAGE} ./base-images/engine-tools/" || exit 1
7987

8088
# Verify base image contents
8189
run_step "Verify go-builder has system-monitor and administrator" \
82-
"docker run --rm ghcr.io/siriusscan/sirius-base-go-builder:latest sh -c 'test -x /usr/local/bin/system-monitor && test -x /usr/local/bin/administrator'" || exit 1
90+
"docker run --rm ${BASE_GO_BUILDER_LATEST_IMAGE} sh -c 'test -x /usr/local/bin/system-monitor && test -x /usr/local/bin/administrator'" || exit 1
8391

8492
run_step "Verify engine-tools has nmap, rustscan, pwsh" \
85-
"docker run --rm ghcr.io/siriusscan/sirius-base-engine-tools:latest sh -c 'nmap --version >/dev/null && rustscan --version >/dev/null && pwsh --version >/dev/null'" || exit 1
93+
"docker run --rm ${BASE_ENGINE_TOOLS_LATEST_IMAGE} sh -c 'nmap --version >/dev/null && rustscan --version >/dev/null && pwsh --version >/dev/null'" || exit 1
8694

8795
log ""
8896
log "${YELLOW}Phase 2: Infrastructure Containers (use base images)${NC}"

‎sirius-postgres/Dockerfile‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,15 @@
11
# Custom PostgreSQL image with system monitoring
22
#
3-
# system-monitor is sourced from the shared sirius-base-go-builder image,
4-
# eliminating the need for a Go build stage in this container.
5-
6-
FROM ghcr.io/siriusscan/sirius-base-go-builder:latest AS go-binaries
3+
# Local fallback stage for quick-start reliability:
4+
# build system-monitor directly so compose up works even if GHCR base images
5+
# are temporarily unavailable.
6+
FROM golang:1.24-alpine AS go-binaries
7+
RUN apk add --no-cache git ca-certificates tzdata && \
8+
git clone https://github.com/SiriusScan/app-system-monitor.git /tmp/system-monitor && \
9+
cd /tmp/system-monitor && \
10+
go mod download && \
11+
CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o /usr/local/bin/system-monitor main.go && \
12+
rm -rf /tmp/system-monitor
713

814
FROM postgres:15-alpine
915

‎sirius-rabbitmq/Dockerfile‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,15 @@
11
# Custom RabbitMQ image with system monitoring
22
#
3-
# system-monitor is sourced from the shared sirius-base-go-builder image,
4-
# eliminating the need for a Go build stage in this container.
5-
6-
FROM ghcr.io/siriusscan/sirius-base-go-builder:latest AS go-binaries
3+
# Local fallback stage for quick-start reliability:
4+
# build system-monitor directly so compose up works even if GHCR base images
5+
# are temporarily unavailable.
6+
FROM golang:1.24-alpine AS go-binaries
7+
RUN apk add --no-cache git ca-certificates tzdata && \
8+
git clone https://github.com/SiriusScan/app-system-monitor.git /tmp/system-monitor && \
9+
cd /tmp/system-monitor && \
10+
go mod download && \
11+
CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o /usr/local/bin/system-monitor main.go && \
12+
rm -rf /tmp/system-monitor
713

814
FROM rabbitmq:3.12-management
915

‎sirius-valkey/Dockerfile‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,15 @@
11
# Custom Valkey image with system monitoring
22
#
3-
# system-monitor is sourced from the shared sirius-base-go-builder image,
4-
# eliminating the need for a Go build stage in this container.
5-
6-
FROM ghcr.io/siriusscan/sirius-base-go-builder:latest AS go-binaries
3+
# Local fallback stage for quick-start reliability:
4+
# build system-monitor directly so compose up works even if GHCR base images
5+
# are temporarily unavailable.
6+
FROM golang:1.24-alpine AS go-binaries
7+
RUN apk add --no-cache git ca-certificates tzdata && \
8+
git clone https://github.com/SiriusScan/app-system-monitor.git /tmp/system-monitor && \
9+
cd /tmp/system-monitor && \
10+
go mod download && \
11+
CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o /usr/local/bin/system-monitor main.go && \
12+
rm -rf /tmp/system-monitor
713

814
FROM valkey/valkey:7.2-alpine
915

0 commit comments

Comments
 (0)