Merge branch 'ghcr-ci-images'

* Branch commit log: misc/cirun: remove, now unused .github/workflows/testing.yml: use new images with actions/[email protected] misc/Dockerfile.arch: build image for uid=1001(runner) gid=127(docker) misc/Dockerfile.focal: build image for uid=1001(runner) gid=127(docker) .github/workflows/testing.yml: FocalAssets: fix $HOME and git checkout .github/workflows/testing.yml: debug all stages .github/workflows/testing.yml: test checkout fixups .github/workflows/testing.yml: quote container image names .github/workflows/testing.yml: run build steps in anklang-ci containers .github/workflows/testing.yml: copy Docs secret into docker volume Signed-off-by: Tim Janik <[email protected]>
tim-janik · Jun 25, 2024 · cbee6b1 · cbee6b1
2 parents a757612 + 0165063
commit cbee6b1
Show file tree

Hide file tree

Showing 4 changed files with 46 additions and 168 deletions.
diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
@@ -13,21 +13,19 @@ jobs:
 
   FocalAssets:
     runs-on: ubuntu-latest
-    env: { CITAG: "focal" }
+    container: { image: 'ghcr.io/tim-janik/anklang-ci:focal-latest' }
     steps:
-    - { uses: actions/[email protected],	with: { fetch-depth: 0 } } # Fix actions/checkout#290
-    - run: git fetch -f --tags && git submodule update --init --recursive && git describe
-    - { uses: actions/cache@v4, with: { path: "/tmp/cicache", key: "cifocal-${{hashFiles ('misc/Dockerfile.focal')}}" } }
-    - run: |
-        misc/cirun build "/tmp/cicache"
+    - { uses: actions/[email protected], with: { fetch-depth: 0, submodules: recursive } }
+    - name: 'Fetch all tags'
+      run: |
+        sed 's,[email protected]:,https://github.com/,' -i .git/config	; # fetch without ssh creds
+        git fetch -f --tags && git describe --always --long		; # Fix actions/checkout#290
     - name: 'Configure build presets'
       run: |
         echo -e ' prefix=/\n CC=clang \n CXX=clang++ \n CLANG_TIDY=clang-tidy ' > config-defaults.mk
-        misc/cirun dir2vol .			;# copy current git to /cirun
     - name: 'Build Dist Assets'
       run: |
-        misc/cirun make mkassets
-        misc/cirun vol2dir .			;# move /cirun out of docker volume
+        make mkassets
     - uses: actions/upload-artifact@v4
       with: { name: assets, path: assets/ }
     - uses: actions/upload-artifact@v4
@@ -36,46 +34,43 @@ jobs:
   UploadDocs:
     if: ${{ github.repository == 'tim-janik/anklang' && github.ref == 'refs/heads/trunk' }}
     runs-on: ubuntu-latest
-    env: { CITAG: "focal" }
+    container: { image: 'ghcr.io/tim-janik/anklang-ci:focal-latest' }
     steps:
-    - { uses: actions/[email protected],	with: { fetch-depth: 0 } } # Fix actions/checkout#290
-    - run: git fetch -f --tags && git submodule update --init --recursive && git describe
-    - { uses: actions/cache@v4, with: { path: "/tmp/cicache", key: "cifocal-${{hashFiles ('misc/Dockerfile.focal')}}" } }
-    - run: |
-        misc/cirun build "/tmp/cicache"
+    - { uses: actions/[email protected], with: { fetch-depth: 0, submodules: recursive } }
+    - name: 'Fetch all tags'
+      run: |
+        sed 's,[email protected]:,https://github.com/,' -i .git/config	; # fetch without ssh creds
+        git fetch -f --tags && git describe --always --long		; # Fix actions/checkout#290
     - name: 'Configure build presets'
       run: |
         echo -e ' prefix=/\n CC=clang \n CXX=clang++ \n CLANG_TIDY=clang-tidy ' > config-defaults.mk
-        misc/cirun dir2vol .			;# copy current git to /cirun
     - name: 'Upload API Docs' # http://tim-janik.github.io/docs/anklang
       run: |
-        misc/cirun make -j`nproc` all
+        make -j`nproc` all
         (umask 0077 && cat <<< "${{ secrets.SSH_ID_GHDOCS4ANKLANG_ECDSA }}" > .git/.ssh_id_ghdocs4anklang)
-        misc/cirun doc/poxy.sh -b -u
+        doc/poxy.sh -b -u
 
   ArchReplay:
     runs-on: ubuntu-latest
-    env: { CITAG: "arch" }
+    container: { image: 'ghcr.io/tim-janik/anklang-ci:arch-latest' }
     steps:
-    - { uses: actions/[email protected],	with: { fetch-depth: 0 } } # Fix actions/checkout#290
-    - run: git fetch -f --tags && git submodule update --init --recursive && git describe
-    - { uses: actions/cache@v4, with: { path: "/tmp/cicache", key: "ciarch-${{hashFiles ('misc/Dockerfile.arch')}}" } }
-    - run: |
-        misc/cirun build "/tmp/cicache"
+    - { uses: actions/[email protected], with: { fetch-depth: 0, submodules: recursive } }
+    - name: 'Fetch all tags'
+      run: |
+        sed 's,[email protected]:,https://github.com/,' -i .git/config	; # fetch without ssh creds
+        git fetch -f --tags && git describe --always --long		; # Fix actions/checkout#290
     - name: 'Configure build presets'
       run: |
         echo 'prefix=/' > config-defaults.mk	;# reset any previous config-defaults.mk
-        misc/cirun dir2vol .			;# copy current git to /cirun
     - name: 'Build Anklang'
       run: |
-        misc/cirun make GCC_COLORS="" -j`nproc` all
+        make GCC_COLORS="" -j`nproc` all
     - name: 'Run Tests'
       run: |
-        misc/cirun make -j`nproc` check
+        make -j`nproc` check
     - name: 'Run X11 GUI Tests'
       run: |
-        misc/cirun make x11test-v
-        misc/cirun vol2dir .			;# move /cirun out of docker volume
+        make x11test-v
     # Artifact upload from x11test
     - uses: actions/upload-artifact@v4
       if: ${{ always() }}
@@ -84,32 +79,31 @@ jobs:
   FocalClangTidy:
     if: ${{ ! contains(github.ref, 'refs/tags/') }}
     runs-on: ubuntu-latest
-    env: { CITAG: "focal" }
+    container: { image: 'ghcr.io/tim-janik/anklang-ci:focal-latest' }
     steps:
-    - { uses: actions/[email protected],	with: { fetch-depth: 0 } } # Fix actions/checkout#290
-    - run: git fetch -f --tags && git submodule update --init --recursive && git describe
-    - { uses: actions/cache@v4, with: { path: "/tmp/cicache", key: "cifocal-${{hashFiles ('misc/Dockerfile.focal')}}" } }
-    - run: |
-        misc/cirun build "/tmp/cicache"
+    - { uses: actions/[email protected], with: { fetch-depth: 0, submodules: recursive } }
+    - name: 'Fetch all tags'
+      run: |
+        sed 's,[email protected]:,https://github.com/,' -i .git/config	; # fetch without ssh creds
+        git fetch -f --tags && git describe --always --long		; # Fix actions/checkout#290
     - name: 'Configure build presets'
       run: |
         echo -e ' prefix=/\n CC=clang \n CXX=clang++ \n CLANG_TIDY=clang-tidy ' > config-defaults.mk
-        misc/cirun dir2vol .			;# copy current git to /cirun
     - run: |
-        misc/cirun make -j`nproc` all
+        make -j`nproc` all
     - run: |
-        misc/cirun make -j`nproc` check
+        make -j`nproc` check
     - name: 'Make clang-tidy'
       run: |
-        misc/cirun make -j`nproc` clang-tidy
+        make -j`nproc` clang-tidy
     # Artifact upload from clang-tidy
     - uses: actions/upload-artifact@v4
       with: { name: clang-tidy, path: out/clang-tidy/ }
     - name: 'Make branch-check'
       # Use non-0 exit status for a failing branch-check on PRs
       run: |
         test -z "${{ github.event.pull_request }}" || BRANCH_CHECK_EXIT=77
-        misc/cirun make branch-check BRANCH_CHECK_EXIT=$BRANCH_CHECK_EXIT
+        make branch-check BRANCH_CHECK_EXIT=$BRANCH_CHECK_EXIT
 
   Ping-IRC:
     if: ${{ always() }}

diff --git a/misc/Dockerfile.arch b/misc/Dockerfile.arch
@@ -27,11 +27,10 @@ RUN cd /tmp && git clone https://github.com/CastXML/CastXML.git && cd CastXML &&
 # Provide a fast JS package manager
 RUN npm install -g pnpm@latest
 
-# Become non-root
-RUN groupadd --gid 1000 builder \
-  && useradd --uid 1000 --gid 1000 --create-home --shell /bin/bash builder \
-  && echo "builder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/builder
-USER builder
+# Become non-root, use Github action VM user: uid=1001(runner) gid=127(docker)
+RUN groupadd -g 127 docker && useradd -u 1001 -g 127 -m -d /github/home -s /bin/bash runner \
+  && echo "runner ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/runner
+USER runner
 
-# docker build -t arch:latest -f misc/Dockerfile.arch misc
-# docker run -ti --rm -v $PWD:/anklang -w /anklang arch:latest
+# docker build -t ghcr.io/tim-janik/anklang-ci:arch-latest -f misc/Dockerfile.arch misc
+# docker run -ti --rm -v $PWD:/hostwd ghcr.io/tim-janik/anklang-ci:arch-latest
diff --git a/misc/Dockerfile.focal b/misc/Dockerfile.focal
@@ -100,11 +100,10 @@ RUN \
   make && make install \
   && apt-get autoremove -y
 
-# Become non-root
-RUN groupadd --gid 1000 ubuntu \
-  && useradd --uid 1000 --gid 1000 --create-home --shell /bin/bash ubuntu \
-  && echo "ubuntu ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/ubuntu
-USER ubuntu
+# Become non-root, use Github action VM user: uid=1001(runner) gid=127(docker)
+RUN groupadd -g 127 docker && useradd -u 1001 -g 127 -m -d /github/home -s /bin/bash runner \
+  && echo "runner ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/runner
+USER runner
 
-# docker build -t cirun:focal -f misc/Dockerfile.focal misc
-# docker run -ti --rm -v $PWD:/cirun -w /cirun cirun:focal
+# docker build -t ghcr.io/tim-janik/anklang-ci:focal-latest -f misc/Dockerfile.focal misc
+# docker run -ti --rm -v $PWD:/hostwd ghcr.io/tim-janik/anklang-ci:focal-latest
diff --git a/misc/cirun b/misc/cirun