Publish the native release as a container image and document deployment

A static nginx image (unprivileged, read-only) of the production build, published to Gitea's registry for amd64 and arm64: version tags go to prod, manual dev-<commit> builds to dev, each smoke-tested first and optionally announced to Dockhand. The README describes running it with Docker Compose. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-18 00:27:23 +02:00
1 parent d3e3faff72
commit b33725adfa
@@ -0,0 +1,127 @@
+name: Publish container image
+on:
+  push:
+    tags:
+      - "**"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "dev-<commit SHA> (7-40 lowercase hex characters, matching the selected source)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: docker-build
+    container:
+      image: node:22-bookworm
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
+    timeout-minutes: 30
+    env:
+      # Gitea does not implement GitHub's build-summary/artifact service.
+      DOCKER_BUILD_SUMMARY: "false"
+      DOCKER_BUILD_RECORD_UPLOAD: "false"
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Resolve and validate image tag
+        id: image
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          GIT_REF: ${{ github.ref }}
+          INPUT_TAG: ${{ github.event.inputs.tag }}
+          SERVER_URL: ${{ github.server_url }}
+          REPOSITORY: ${{ github.repository }}
+        run: node scripts/image-publication.mjs
+
+      - name: Check registry credentials
+        env:
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          test -n "$REGISTRY_USERNAME" || { echo 'Set the REGISTRY_USERNAME Actions secret.'; exit 1; }
+          test -n "$REGISTRY_TOKEN" || { echo 'Set the REGISTRY_TOKEN Actions secret (write:package).'; exit 1; }
+
+      - name: Install Docker client and check daemon access
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends ca-certificates curl
+          install -m 0755 -d /etc/apt/keyrings
+          curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+          chmod a+r /etc/apt/keyrings/docker.asc
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" > /etc/apt/sources.list.d/docker.list
+          apt-get update
+          apt-get install -y --no-install-recommends docker-ce-cli
+          docker info
+
+      - name: Set up Buildx
+        uses: https://github.com/docker/setup-buildx-action@v3
+
+      - name: Build an image for the runner's architecture
+        uses: https://github.com/docker/build-push-action@v6
+        with:
+          context: .
+          load: true
+          tags: crystal-smoke:${{ github.run_id }}
+
+      - name: Check the container before publication
+        env:
+          SMOKE_IMAGE: crystal-smoke:${{ github.run_id }}
+        run: |
+          container_id=''
+          trap '
+            if [ -n "$container_id" ]; then docker rm -f "$container_id"; fi
+            docker image rm "$SMOKE_IMAGE"
+          ' EXIT
+          container_id=$(docker run -d --read-only --tmpfs /tmp --cap-drop ALL --security-opt no-new-privileges:true "$SMOKE_IMAGE")
+          for _attempt in $(seq 1 30); do
+            if docker exec "$container_id" wget -q -O /dev/null http://127.0.0.1:8080/; then
+              docker exec "$container_id" wget -q -O /dev/null http://127.0.0.1:8080/sw.js
+              exit 0
+            fi
+            sleep 1
+          done
+          docker logs "$container_id"
+          exit 1
+
+      - name: Log in to Gitea's container registry
+        uses: https://github.com/docker/login-action@v3
+        with:
+          registry: ${{ steps.image.outputs.registry }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build and publish
+        uses: https://github.com/docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            ${{ steps.image.outputs.image }}:${{ steps.image.outputs.tag }}
+            ${{ steps.image.outputs.image }}:${{ steps.image.outputs.channel }}
+          labels: |
+            org.opencontainers.image.title=Crystal
+            org.opencontainers.image.source=${{ steps.image.outputs.source }}
+            org.opencontainers.image.revision=${{ steps.image.outputs.revision }}
+            org.opencontainers.image.version=${{ steps.image.outputs.tag }}
+
+      - name: Request production deployment in Dockhand
+        if: steps.image.outputs.channel == 'prod'
+        env:
+          DOCKHAND_WEBHOOK_URL: ${{ secrets.DOCKHAND_PROD_WEBHOOK_URL }}
+          DOCKHAND_WEBHOOK_SECRET: ${{ secrets.DOCKHAND_PROD_WEBHOOK_SECRET }}
+        run: node scripts/notify-dockhand.mjs
+
+      - name: Request test deployment in Dockhand
+        if: steps.image.outputs.channel == 'dev'
+        env:
+          DOCKHAND_WEBHOOK_URL: ${{ secrets.DOCKHAND_DEV_WEBHOOK_URL }}
+          DOCKHAND_WEBHOOK_SECRET: ${{ secrets.DOCKHAND_DEV_WEBHOOK_SECRET }}
+        run: node scripts/notify-dockhand.mjs