Daniel Sutton
e9c459fb8d
## Summary
The container publish workflows hardcoded `ghcr.io/triggerdotdev/...` as
the image destination. As a result, a fork that builds on push-to-`main`
(or on the worker publish tags) would attempt to push to — and attest —
the upstream packages rather than its own, which fails on permissions
and is surprising besides.
This makes the image destination configurable via a single
`IMAGE_REGISTRY` repository variable, while leaving the upstream
defaults byte-identical:
- **Single source of truth** (`publish.yml`): a `resolve-registry` job
resolves the target registry namespace once — `IMAGE_REGISTRY`
repository variable, defaulting to `ghcr.io/${{ github.repository_owner
}}` — and passes it down to every publish job as an `image_registry`
input. So a fork publishes to its own namespace automatically with no
configuration.
- **Webapp** (`publish-webapp.yml`): the image now lives at
`<registry>/<repo-name>` (e.g. `ghcr.io/<owner>/trigger.dev`). The
provenance attestation and the downstream Trivy scan follow the same
computed repo via the `image_repo` workflow output.
- **Workers** (`publish-worker.yml`, `publish-worker-v4.yml`): build
under `<registry>/<worker-name>`. They keep a `vars.IMAGE_REGISTRY ||
ghcr.io/<owner>` fallback so they still resolve correctly on their
direct `infra-*` / `re2-*` push triggers (which bypass the parent
workflow).
A single `IMAGE_REGISTRY` namespace variable now governs both webapp and
workers (the earlier `WEBAPP_IMAGE_REPO` full-path override is dropped,
removing the full-path/namespace asymmetry). When `IMAGE_REGISTRY` is
unset, every resolved image name is exactly what it is today, so there
is no change for this repo.
## Test plan
- [x] `actionlint` passes on all four workflows
- [ ] On merge, confirm the webapp publish still pushes
`ghcr.io/triggerdotdev/trigger.dev:main` + the commit-SHA tag (defaults
unchanged)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
106 lines
3.4 KiB
YAML
106 lines
3.4 KiB
YAML
name: "⚒️ Publish Worker"
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
image_tag:
|
|
description: The image tag to publish
|
|
type: string
|
|
required: false
|
|
default: ""
|
|
image_registry:
|
|
description: The registry namespace to publish under (e.g. ghcr.io/<owner>)
|
|
type: string
|
|
required: false
|
|
default: ""
|
|
secrets:
|
|
DOCKERHUB_USERNAME:
|
|
required: false
|
|
DOCKERHUB_TOKEN:
|
|
required: false
|
|
push:
|
|
tags:
|
|
- "infra-dev-*"
|
|
- "infra-test-*"
|
|
- "infra-prod-*"
|
|
|
|
permissions:
|
|
packages: write
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
strategy:
|
|
matrix:
|
|
package: [coordinator, docker-provider, kubernetes-provider]
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
DOCKER_BUILDKIT: "1"
|
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
steps:
|
|
- name: ⬇️ Checkout git repo
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: 📦 Get image repo
|
|
id: get_repository
|
|
env:
|
|
PACKAGE: ${{ matrix.package }}
|
|
run: |
|
|
if [[ "$PACKAGE" == *-provider ]]; then
|
|
repo="provider/${PACKAGE%-provider}"
|
|
else
|
|
repo="$PACKAGE"
|
|
fi
|
|
echo "repo=${repo}" >> "$GITHUB_OUTPUT"
|
|
|
|
- id: get_tag
|
|
uses: ./.github/actions/get-image-tag
|
|
with:
|
|
tag: ${{ inputs.image_tag }}
|
|
|
|
- name: 🐋 Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
|
|
|
|
# ..to avoid rate limits when pulling images
|
|
- name: 🐳 Login to DockerHub
|
|
if: ${{ env.DOCKERHUB_USERNAME }}
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: 🚢 Build Container Image
|
|
run: |
|
|
docker build -t infra_image -f ./apps/${{ matrix.package }}/Containerfile .
|
|
|
|
# ..to push image
|
|
- name: 🐙 Login to GitHub Container Registry
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: 🐙 Push to GitHub Container Registry
|
|
run: |
|
|
docker tag infra_image "$REGISTRY/$REPOSITORY:$IMAGE_TAG"
|
|
docker push "$REGISTRY/$REPOSITORY:$IMAGE_TAG"
|
|
env:
|
|
# Resolved by the caller when invoked from publish.yml; falls back to the
|
|
# IMAGE_REGISTRY repository variable (or ghcr.io/<owner>) for the direct
|
|
# push triggers above, so a fork publishes to its own namespace.
|
|
REGISTRY: ${{ inputs.image_registry || vars.IMAGE_REGISTRY || format('ghcr.io/{0}', github.repository_owner) }}
|
|
REPOSITORY: ${{ steps.get_repository.outputs.repo }}
|
|
IMAGE_TAG: ${{ steps.get_tag.outputs.tag }}
|
|
|
|
# - name: 🐙 Push 'v3' tag to GitHub Container Registry
|
|
# if: steps.get_tag.outputs.is_semver == 'true'
|
|
# run: |
|
|
# docker tag infra_image "$REGISTRY/$REPOSITORY:v3"
|
|
# docker push "$REGISTRY/$REPOSITORY:v3"
|
|
# env:
|
|
# REGISTRY: ghcr.io/triggerdotdev
|
|
# REPOSITORY: ${{ steps.get_repository.outputs.repo }}
|