Skip to content

Commit 6a82ae5

Browse files
0sm0s1z0sm0s1z
committed
feat(ci): CI/CD pipeline overhaul - base images, native ARM, consolidated workflows
- Add shared base images: sirius-base-go-builder, sirius-base-engine-tools - go-builder: pre-built system-monitor and administrator (used by 6 containers) - engine-tools: Nmap 7.95 from source, RustScan, PowerShell (eliminates duplicate builds) - Refactor all app Dockerfiles to COPY from base images instead of redundant builds - ci.yml: native ARM matrix (blacksmith-4vcpu-ubuntu-2404-arm) to avoid QEMU - ci.yml: merge arch-specific tags into multi-arch manifests - ci.yml: fix integration test (always co-start sirius-api with sirius-engine) - ci.yml: fix canary dispatch JSON escaping (gh api -f) - deploy.yml: remove build job and push trigger (deployment-only, workflow_dispatch) - Add scripts/validate-ci-overhaul.sh and make validate-ci-overhaul for local validation - Fix engine dev stage: install Go 1.24 from tarball (Ubuntu apt provides 1.18, air needs 1.20+) Made-with: Cursor
1 parent 4450c3e commit 6a82ae5

File tree

13 files changed

+1132
-770
lines changed

13 files changed

+1132
-770
lines changed

‎.github/workflows/build-base-images.yml‎

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
name: Build Base Images
2+
3+
# Builds and publishes shared base images to GHCR.
4+
#
5+
# Base images are heavy-dependency layers (Nmap compiled from source,
6+
# RustScan, PowerShell, pre-built Go binaries) that would otherwise be
7+
# rebuilt redundantly inside every application container build.
8+
#
9+
# Triggers:
10+
# - Push to main when base-images/** files change
11+
# - Manual dispatch (for emergency rebuilds)
12+
# - Weekly schedule to pick up upstream security patches
13+
14+
on:
15+
push:
16+
branches: [main]
17+
paths:
18+
- "base-images/**"
19+
workflow_dispatch:
20+
inputs:
21+
image:
22+
description: "Which base image to rebuild"
23+
required: false
24+
default: "all"
25+
type: choice
26+
options:
27+
- all
28+
- go-builder
29+
- engine-tools
30+
schedule:
31+
# Every Sunday at 04:00 UTC
32+
- cron: "0 4 * * 0"
33+
34+
env:
35+
REGISTRY: ghcr.io
36+
IMAGE_NAMESPACE: siriusscan
37+
38+
jobs:
39+
# ─────────────────────────────────────────────────────────────────────────────
40+
# Build go-builder base image (per architecture, native runners)
41+
# ─────────────────────────────────────────────────────────────────────────────
42+
build-go-builder:
43+
name: "go-builder (${{ matrix.platform }})"
44+
if: >
45+
github.event_name == 'schedule' ||
46+
github.event_name == 'workflow_dispatch' && (github.event.inputs.image == 'all' || github.event.inputs.image == 'go-builder') ||
47+
github.event_name == 'push'
48+
runs-on: ${{ matrix.runner }}
49+
strategy:
50+
fail-fast: false
51+
matrix:
52+
platform: [amd64, arm64]
53+
include:
54+
- platform: amd64
55+
runner: blacksmith-4vcpu-ubuntu-2404
56+
- platform: arm64
57+
runner: blacksmith-4vcpu-ubuntu-2404-arm
58+
59+
steps:
60+
- name: Checkout code
61+
uses: actions/checkout@v4
62+
63+
- name: Setup Blacksmith Builder
64+
uses: useblacksmith/setup-docker-builder@v1
65+
66+
- name: Log in to Container Registry
67+
uses: docker/login-action@v3
68+
with:
69+
registry: ${{ env.REGISTRY }}
70+
username: ${{ secrets.GHCR_PUSH_USER }}
71+
password: ${{ secrets.GHCR_PUSH_TOKEN }}
72+
73+
- name: Build and push go-builder (${{ matrix.platform }})
74+
uses: useblacksmith/build-push-action@v2
75+
with:
76+
context: ./base-images/go-builder
77+
platforms: linux/${{ matrix.platform }}
78+
push: true
79+
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest-${{ matrix.platform }}
80+
81+
# ─────────────────────────────────────────────────────────────────────────────
82+
# Merge go-builder arch-specific images into a single multi-arch manifest
83+
# ─────────────────────────────────────────────────────────────────────────────
84+
merge-go-builder:
85+
name: "go-builder (merge manifest)"
86+
needs: build-go-builder
87+
runs-on: blacksmith-4vcpu-ubuntu-2404
88+
steps:
89+
- name: Log in to Container Registry
90+
uses: docker/login-action@v3
91+
with:
92+
registry: ${{ env.REGISTRY }}
93+
username: ${{ secrets.GHCR_PUSH_USER }}
94+
password: ${{ secrets.GHCR_PUSH_TOKEN }}
95+
96+
- name: Create and push multi-arch manifest for go-builder
97+
run: |
98+
docker manifest create \
99+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest \
100+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest-amd64 \
101+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest-arm64
102+
103+
docker manifest annotate \
104+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest \
105+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest-amd64 \
106+
--arch amd64
107+
108+
docker manifest annotate \
109+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest \
110+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest-arm64 \
111+
--arch arm64
112+
113+
docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest
114+
echo "Published ghcr.io/${{ env.IMAGE_NAMESPACE }}/sirius-base-go-builder:latest (amd64 + arm64)"
115+
116+
# ─────────────────────────────────────────────────────────────────────────────
117+
# Build engine-tools base image (per architecture, native runners)
118+
# ─────────────────────────────────────────────────────────────────────────────
119+
build-engine-tools:
120+
name: "engine-tools (${{ matrix.platform }})"
121+
if: >
122+
github.event_name == 'schedule' ||
123+
github.event_name == 'workflow_dispatch' && (github.event.inputs.image == 'all' || github.event.inputs.image == 'engine-tools') ||
124+
github.event_name == 'push'
125+
runs-on: ${{ matrix.runner }}
126+
strategy:
127+
fail-fast: false
128+
matrix:
129+
platform: [amd64, arm64]
130+
include:
131+
- platform: amd64
132+
runner: blacksmith-4vcpu-ubuntu-2404
133+
- platform: arm64
134+
runner: blacksmith-4vcpu-ubuntu-2404-arm
135+
136+
steps:
137+
- name: Checkout code
138+
uses: actions/checkout@v4
139+
140+
- name: Setup Blacksmith Builder
141+
uses: useblacksmith/setup-docker-builder@v1
142+
143+
- name: Log in to Container Registry
144+
uses: docker/login-action@v3
145+
with:
146+
registry: ${{ env.REGISTRY }}
147+
username: ${{ secrets.GHCR_PUSH_USER }}
148+
password: ${{ secrets.GHCR_PUSH_TOKEN }}
149+
150+
- name: Build and push engine-tools (${{ matrix.platform }})
151+
uses: useblacksmith/build-push-action@v2
152+
with:
153+
context: ./base-images/engine-tools
154+
platforms: linux/${{ matrix.platform }}
155+
push: true
156+
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest-${{ matrix.platform }}
157+
158+
# ─────────────────────────────────────────────────────────────────────────────
159+
# Merge engine-tools arch-specific images into a single multi-arch manifest
160+
# ─────────────────────────────────────────────────────────────────────────────
161+
merge-engine-tools:
162+
name: "engine-tools (merge manifest)"
163+
needs: build-engine-tools
164+
runs-on: blacksmith-4vcpu-ubuntu-2404
165+
steps:
166+
- name: Log in to Container Registry
167+
uses: docker/login-action@v3
168+
with:
169+
registry: ${{ env.REGISTRY }}
170+
username: ${{ secrets.GHCR_PUSH_USER }}
171+
password: ${{ secrets.GHCR_PUSH_TOKEN }}
172+
173+
- name: Create and push multi-arch manifest for engine-tools
174+
run: |
175+
docker manifest create \
176+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest \
177+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest-amd64 \
178+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest-arm64
179+
180+
docker manifest annotate \
181+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest \
182+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest-amd64 \
183+
--arch amd64
184+
185+
docker manifest annotate \
186+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest \
187+
${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest-arm64 \
188+
--arch arm64
189+
190+
docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest
191+
echo "Published ghcr.io/${{ env.IMAGE_NAMESPACE }}/sirius-base-engine-tools:latest (amd64 + arm64)"

0 commit comments

Comments
 (0)