Skip to content

Commit 3623403

Browse files
deboer-timdeboer-tim
committed
chore: switch to container build
The final output of the build was an OCI container, but it was purely used for packaging. This moves the Containerfile to the /build folder and does the full pnpm build using a builder image. Images published are extension-bootc-builder and extension-bootc, switching from the previous podman-desktop-extension-bootc to match what newer extensions have done and make the switch obvious. First part: leaves existing container file in root for e2e tests to run, once workflow has successfully run once we can reuse the latest builder image instead, and remove the Containerfile at root. First part of #2101. Signed-off-by: Tim deBoer <git@tdeboer.ca>
1 parent d1db22d commit 3623403

File tree

5 files changed

+293
-49
lines changed

5 files changed

+293
-49
lines changed

‎.github/workflows/build-next.yaml‎

Lines changed: 99 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#
2-
# Copyright (C) 2023-2024 Red Hat, Inc.
2+
# Copyright (C) 2023-2025 Red Hat, Inc.
33
#
44
# Licensed under the Apache License, Version 2.0 (the "License");
55
# you may not use this file except in compliance with the License.
@@ -23,37 +23,111 @@ on:
2323
- 'main'
2424

2525
jobs:
26-
build:
27-
runs-on: ubuntu-22.04
26+
check-builder-changes:
27+
runs-on: ubuntu-24.04
28+
outputs:
29+
builder_required: ${{ steps.check.outputs.builder_required }}
30+
steps:
31+
- name: Checkout Repository
32+
uses: actions/checkout@v6
33+
with:
34+
fetch-depth: 2 # Ensure we have at least one previous commit for diff check
35+
36+
- name: Check for builder-related changes
37+
id: check
38+
run: |
39+
if git diff --name-only HEAD^ HEAD | grep -E '^(package.json|pnpm-lock.yaml|build/Containerfile.builder|.github/workflows/build-next.yaml)$'; then
40+
echo "builder_required=true" >> $GITHUB_OUTPUT
41+
else
42+
echo "builder_required=false" >> $GITHUB_OUTPUT
43+
fi
44+
45+
builder-image:
46+
needs: check-builder-changes
47+
if: needs.check-builder-changes.outputs.builder_required == 'true'
48+
name: Build and publish builder OCI images only if pnpm-lock.yaml or package.json changes
49+
runs-on: ubuntu-24.04
50+
2851
steps:
2952
- uses: actions/checkout@v6
53+
with:
54+
fetch-depth: 0
3055

31-
- uses: pnpm/action-setup@v4
32-
name: Install pnpm
56+
- name: build builder image
57+
id: builder-image
58+
uses: redhat-actions/buildah-build@v2
3359
with:
34-
run_install: false
60+
image: extension-bootc-builder
61+
tags: next ${{ github.sha }}
62+
platforms: linux/amd64, linux/arm64
63+
containerfiles: |
64+
build/Containerfile.builder
65+
context: .
66+
oci: true
3567

36-
- uses: actions/setup-node@v6
68+
- name: Log in to ghcr.io
69+
uses: redhat-actions/podman-login@v1
3770
with:
38-
node-version: 22
39-
cache: 'pnpm'
71+
username: ${{ github.actor }}
72+
password: ${{ secrets.GITHUB_TOKEN }}
73+
registry: ghcr.io
4074

41-
- name: Execute pnpm
42-
run: pnpm install
75+
- name: publish builder to ghcr.io
76+
id: push-to-ghcr
77+
uses: redhat-actions/push-to-registry@v2
78+
with:
79+
image: ${{ steps.builder-image.outputs.image }}
80+
tags: ${{ steps.builder-image.outputs.tags }}
81+
registry: ghcr.io/${{ github.repository_owner }}
4382

44-
- name: Run Build
45-
run: pnpm build
83+
- name: Generate artifact attestation
84+
uses: actions/attest-build-provenance@v3
85+
with:
86+
subject-name: ghcr.io/${{ github.repository_owner }}/extension-bootc-builder
87+
subject-digest: ${{ steps.push-to-ghcr.outputs.digest }}
88+
push-to-registry: true
4689

47-
- name: Login to ghcr.io
48-
run: podman login --username ${{ github.repository_owner }} --password ${{ secrets.GITHUB_TOKEN }} ghcr.io
90+
extension-image:
91+
name: Build and publish extension OCI image
92+
if: always()
93+
runs-on: ubuntu-24.04
94+
needs: builder-image
4995

50-
- name: Publish Image
51-
id: publish-image
52-
run: |
53-
IMAGE_NAME=ghcr.io/${{ github.repository_owner }}/podman-desktop-extension-bootc
54-
IMAGE_NIGHTLY=${IMAGE_NAME}:nightly
55-
IMAGE_SHA=${IMAGE_NAME}:${GITHUB_SHA}
56-
podman build -t $IMAGE_NIGHTLY .
57-
podman push $IMAGE_NIGHTLY
58-
podman tag $IMAGE_NIGHTLY $IMAGE_SHA
59-
podman push $IMAGE_SHA
96+
steps:
97+
- uses: actions/checkout@v6
98+
with:
99+
fetch-depth: 0
100+
101+
- name: build extension image
102+
id: extension-image
103+
uses: redhat-actions/buildah-build@v2
104+
with:
105+
image: extension-bootc
106+
tags: next ${{ github.sha }}
107+
archs: amd64, arm64
108+
containerfiles: |
109+
build/Containerfile
110+
context: .
111+
oci: true
112+
113+
- name: Log in to ghcr.io
114+
uses: redhat-actions/podman-login@v1
115+
with:
116+
username: ${{ github.actor }}
117+
password: ${{ secrets.GITHUB_TOKEN }}
118+
registry: ghcr.io
119+
120+
- name: publish extension to ghcr.io
121+
id: push-to-ghcr
122+
uses: redhat-actions/push-to-registry@v2
123+
with:
124+
image: ${{ steps.extension-image.outputs.image }}
125+
tags: ${{ steps.extension-image.outputs.tags }}
126+
registry: ghcr.io/${{ github.repository_owner }}
127+
128+
- name: Generate artifact attestation
129+
uses: actions/attest-build-provenance@v3
130+
with:
131+
subject-name: ghcr.io/${{ github.repository_owner }}/extension-bootc
132+
subject-digest: ${{ steps.push-to-ghcr.outputs.digest }}
133+
push-to-registry: true

‎.github/workflows/release.yaml‎

Lines changed: 95 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#
2-
# Copyright (C) 2023-2024 Red Hat, Inc.
2+
# Copyright (C) 2023-2025 Red Hat, Inc.
33
#
44
# Licensed under the Apache License, Version 2.0 (the "License");
55
# you may not use this file except in compliance with the License.
@@ -103,32 +103,104 @@ jobs:
103103
env:
104104
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
105105

106-
- uses: pnpm/action-setup@v4
107-
name: Install pnpm
106+
builder-image:
107+
needs: tag
108+
runs-on: ubuntu-24.04
109+
steps:
110+
- uses: actions/checkout@v6
108111
with:
109-
run_install: false
112+
ref: ${{ needs.tag.outputs.githubTag }}
110113

111-
- uses: actions/setup-node@v6
114+
- name: build builder image
115+
id: builder-image
116+
uses: redhat-actions/buildah-build@v2
112117
with:
113-
node-version: 22
114-
cache: 'pnpm'
118+
image: extension-bootc-builder
119+
tags: latest ${{ needs.tag.outputs.bootcExtensionVersion }}
120+
platforms: linux/amd64, linux/arm64
121+
containerfiles: |
122+
build/Containerfile.builder
123+
context: .
124+
oci: true
115125

116-
- name: Execute pnpm
117-
run: pnpm install
126+
- name: Log in to ghcr.io
127+
uses: redhat-actions/podman-login@v1
128+
with:
129+
username: ${{ github.actor }}
130+
password: ${{ secrets.GITHUB_TOKEN }}
131+
registry: ghcr.io
118132

119-
- name: Run Build
120-
run: pnpm build
133+
- name: publish builder to ghcr.io
134+
id: push-to-ghcr
135+
uses: redhat-actions/push-to-registry@v2
136+
with:
137+
image: ${{ steps.builder-image.outputs.image }}
138+
tags: ${{ steps.builder-image.outputs.tags }}
139+
registry: ghcr.io/${{ github.repository_owner }}
121140

122-
- name: Login to ghcr.io
123-
run: podman login --username ${{ github.repository_owner }} --password ${{ secrets.GITHUB_TOKEN }} ghcr.io
141+
- name: Generate artifact attestation
142+
uses: actions/attest-build-provenance@v3
143+
with:
144+
subject-name: ghcr.io/${{ github.repository_owner }}/extension-bootc-builder
145+
subject-digest: ${{ steps.push-to-ghcr.outputs.digest }}
146+
push-to-registry: true
124147

125-
- name: Publish Image
126-
id: publish-image
127-
run: |
128-
IMAGE_NAME=ghcr.io/${{ github.repository_owner }}/podman-desktop-extension-bootc
129-
IMAGE_WITH_TAG=${IMAGE_NAME}:${{ steps.TAG_UTIL.outputs.bootcExtensionVersion }}
130-
IMAGE_LATEST=${IMAGE_NAME}:latest
131-
podman build -t $IMAGE_WITH_TAG .
132-
podman push $IMAGE_WITH_TAG
133-
podman tag $IMAGE_WITH_TAG $IMAGE_LATEST
134-
podman push $IMAGE_LATEST
148+
extension-image:
149+
name: Build and publish extension OCI image
150+
151+
runs-on: ubuntu-24.04
152+
needs: [builder-image, tag]
153+
154+
steps:
155+
- uses: actions/checkout@v6
156+
with:
157+
fetch-depth: 0
158+
159+
- name: build extension image
160+
id: extension-image
161+
uses: redhat-actions/buildah-build@v2
162+
with:
163+
image: extension-bootc
164+
tags: latest ${{ needs.tag.outputs.bootcExtensionVersion }}
165+
archs: amd64, arm64
166+
containerfiles: |
167+
build/Containerfile
168+
context: .
169+
oci: true
170+
171+
- name: Log in to ghcr.io
172+
uses: redhat-actions/podman-login@v1
173+
with:
174+
username: ${{ github.actor }}
175+
password: ${{ secrets.GITHUB_TOKEN }}
176+
registry: ghcr.io
177+
178+
- name: publish extension to ghcr.io
179+
id: push-to-ghcr
180+
uses: redhat-actions/push-to-registry@v2
181+
with:
182+
image: ${{ steps.extension-image.outputs.image }}
183+
tags: ${{ steps.extension-image.outputs.tags }}
184+
registry: ghcr.io/${{ github.repository_owner }}
185+
186+
- name: Generate artifact attestation
187+
uses: actions/attest-build-provenance@v3
188+
with:
189+
subject-name: ghcr.io/${{ github.repository_owner }}/extension-bootc
190+
subject-digest: ${{ steps.push-to-ghcr.outputs.digest }}
191+
push-to-registry: true
192+
193+
release:
194+
needs: [tag, builder-image, extension-image]
195+
name: Release
196+
runs-on: ubuntu-24.04
197+
steps:
198+
- name: id
199+
run: echo the release id is ${{ needs.tag.outputs.releaseId}}
200+
201+
- name: Publish release
202+
uses: StuYarrow/publish-release@v1.1.2
203+
env:
204+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
205+
with:
206+
id: ${{ needs.tag.outputs.releaseId}}

‎RELEASE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ In the below example, we will pretend that we're upgrading from `1.1.0` to `1.2.
1919
1. Make sure that all tasks for the respective release milestone are completed / updated, then close it. https://github.com/podman-desktop/podman-desktop-extension-bootc/milestones
2020
1. If not already created, click on `New Milestone` and create a new milestone for the NEXT release.
2121
1. Check that https://github.com/podman-desktop/podman-desktop-extension-bootc/actions/workflows/release.yaml has been completed.
22-
1. Ensure the image has been successfully published to https://github.com/podman-desktop/extension-bootc/pkgs/container/podman-desktop-extension-bootc
22+
1. Ensure the image has been successfully published to https://github.com/podman-desktop/extension-bootc/pkgs/container/extension-bootc
2323
1. There should be an automated PR that has been created. The title looks like `chore: 📢 Bump version to 1.3.0`. Rerun workflow manually if some of e2e tests are failing.
2424
1. Wait for the PR above to be approved and merged before continuing with the steps.
2525
1. Edit the new release https://github.com/podman-desktop/podman-desktop-extension-bootc/releases/edit/v1.2.0.

‎build/Containerfile‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
#
2+
# Copyright (C) 2025 Red Hat, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
# SPDX-License-Identifier: Apache-2.0
17+
18+
FROM ghcr.io/podman-desktop/extension-bootc-builder:next AS builder
19+
20+
WORKDIR /opt/app-root/extension-source
21+
22+
# copy source code
23+
COPY --chown=1001:root *.js /opt/app-root/extension-source/
24+
COPY --chown=1001:root .gitignore /opt/app-root/extension-source/
25+
COPY --chown=1001:root *.json /opt/app-root/extension-source/
26+
COPY --chown=1001:root packages /opt/app-root/extension-source/packages
27+
COPY --chown=1001:root .npmrc /opt/app-root/extension-source/
28+
COPY --chown=1001:root .gitignore /opt/app-root/extension-source/
29+
COPY --chown=1001:root types /opt/app-root/extension-source/types
30+
31+
# refresh dependencies (if needed)
32+
# and build the extension
33+
RUN pnpm install && \
34+
pnpm build
35+
36+
# copy output of the build + required files
37+
RUN mkdir /opt/app-root/extension && \
38+
cp -r packages/backend/dist /opt/app-root/extension/ && \
39+
cp packages/backend/package.json /opt/app-root/extension/ && \
40+
cp packages/backend/bootable.woff2 /opt/app-root/extension/ && \
41+
cp packages/backend/icon.png /opt/app-root/extension/ && \
42+
cp -r packages/backend/media/ /opt/app-root/extension/media
43+
44+
COPY LICENSE /opt/app-root/extension/
45+
COPY README.md /opt/app-root/extension/
46+
47+
# TEMPORARY. Permanent fix will be in the future when we can add all of this to vite script.
48+
# We require the macadam.js binaries and library, so we will manually copy this over to the container image.
49+
# we rely on `pnpm build` before creating the container image, so we can safely assume that the macadam.js binaries are already present in the node_modules directory
50+
# and can copy them over to the container image.
51+
COPY node_modules/@crc-org/macadam.js /opt/app-root/extension/node_modules/@crc-org/macadam.js
52+
# Copy over ssh2 and it's dependencies (run jq '.dependencies' node_modules/ssh2/package.json locally to see)
53+
COPY node_modules/ssh2 /opt/app-root/extension/node_modules/ssh2
54+
COPY node_modules/asn1 /opt/app-root/extension/node_modules/asn1
55+
COPY node_modules/bcrypt-pbkdf /opt/app-root/extension/node_modules/bcrypt-pbkdf
56+
COPY node_modules/safer-buffer /opt/app-root/extension/node_modules/safer-buffer
57+
COPY node_modules/tweetnacl /opt/app-root/extension/node_modules/tweetnacl
58+
59+
# Copy the extension to a new image
60+
FROM scratch
61+
62+
LABEL org.opencontainers.image.title="Bootable Container Extension" \
63+
org.opencontainers.image.description="Podman Desktop extension for bootable OS containers (bootc) and generating disk images" \
64+
org.opencontainers.image.vendor="Red Hat" \
65+
io.podman-desktop.api.version=">= 1.18.0"
66+
67+
COPY --from=builder /opt/app-root/extension /extension

‎build/Containerfile.builder‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#
2+
# Copyright (C) 2025 Red Hat, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
# SPDX-License-Identifier: Apache-2.0
17+
18+
FROM registry.access.redhat.com/ubi10/nodejs-22-minimal:10.1-1764649415
19+
20+
# change home directory to be at /opt/app-root
21+
ENV HOME=/opt/app-root
22+
23+
# copy the application files to the /opt/app-root/extension-source directory
24+
WORKDIR /opt/app-root/extension-source
25+
RUN mkdir -p /opt/app-root/extension-source
26+
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc /opt/app-root/extension-source/
27+
COPY packages/backend/package.json /opt/app-root/extension-source/packages/backend/package.json
28+
COPY packages/frontend/package.json /opt/app-root/extension-source/packages/frontend/package.json
29+
30+
RUN npm install --global pnpm@10 && \
31+
pnpm --frozen-lockfile install

0 commit comments

Comments
 (0)