.github/workflows/docker-publish.yml #15
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Use of this source code is governed by a BSD-style license. | |
| # | |
| # 镜像发布流水线：推送 v* 标签或手工触发（workflow_dispatch）时， | |
| # 构建并发布 manager/executor/gateway 三张服务镜像（多架构 linux/amd64 + linux/arm64）。 | |
| # | |
| # 支持两套镜像站、按阶段独立开关，配置哪套发哪套（本期阿里云 ACR，下期 Docker Hub）： | |
| # 阿里云 ACR：variables.ALI_REGISTRY + secrets.ALI_USERNAME / ALI_PASSWORD | |
| # Docker Hub：secrets.DOCKERHUB_USERNAME / DOCKERHUB_TOKEN | |
| # 两套可同时配置（同一份构建产物分别推送）；都未配置时流水线报错终止。 | |
| # | |
| # 前置配置（GitHub 仓库 Settings → Secrets and variables → Actions）： | |
| # - ACR（本期）： | |
| # Variable: ALI_REGISTRY = registry.cn-hangzhou.aliyuncs.com/<命名空间> | |
| # Secrets: ALI_USERNAME / ALI_PASSWORD（阿里云 ACR 控制台 → 访问凭证 → 固定密码） | |
| # - Docker Hub（下期）： | |
| # Secrets: DOCKERHUB_USERNAME / DOCKERHUB_TOKEN（建议用 Access Token） | |
| # | |
| # 版本与 :latest 策略： | |
| # - 标签触发：v1.9.0 → 版本 1.9.0；手动触发：版本取根 pom.xml 的 <version> | |
| # - :latest 仅在非预发布版本（无 -rc/-beta/-alpha/-SNAPSHOT 后缀）时打 | |
| on: | |
| push: | |
| tags: ["v*"] | |
| workflow_dispatch: {} | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| env: | |
| # 仅为让步骤 if 判断可用（secrets 上下文不允许直接出现在步骤 if 表达式中） | |
| HUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up QEMU（arm64 仿真） | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: 缓存 Maven 依赖 | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.m2 | |
| key: maven-${{ hashFiles('**/pom.xml') }} | |
| # 与 build.sh / build_and_push_image.sh 相同的前置：先烘 UI 进 manager resources，再全量打包 | |
| - name: 构建内置管理端 UI | |
| run: sh build-ui.sh | |
| - name: 全量打包（含测试门禁与发行版装配） | |
| # 等同 docker-maven-build.sh，但去掉其 docker run -it（CI 无 TTY 会失败） | |
| run: | | |
| docker run --rm \ | |
| -v ~/.m2:/opt/maven/localRepository \ | |
| -v "$PWD":/usr/src/mymaven \ | |
| -w /usr/src/mymaven \ | |
| --entrypoint /usr/share/maven/bin/mvn \ | |
| maven:3.9-eclipse-temurin-8 \ | |
| -s /usr/src/mymaven/docker-maven-settings.xml clean package | |
| - name: 同步镜像暂存目录并打 tarball | |
| run: | | |
| sh build-docker/sync_release_dir.sh | |
| tar zcf datapoly-release.tar.gz -C build-docker/datapoly datapoly-release | |
| mv datapoly-release.tar.gz build-docker/datapoly/datapoly-release.tar.gz | |
| - name: 计算版本与镜像 tag 列表（按已配置的镜像站生成） | |
| id: tags | |
| env: | |
| # HUB_USERNAME 已由 job 级 env 注入；ALI_REGISTRY 直接读 vars | |
| ALI_REGISTRY: ${{ vars.ALI_REGISTRY }} | |
| run: | | |
| if [ "$GITHUB_REF_TYPE" = "tag" ]; then | |
| V="${GITHUB_REF_NAME#v}" # v1.9.0 → 1.9.0 | |
| else | |
| V=$(grep -m1 '<version>' pom.xml | sed -E 's/.*<version>([^<]+)<\/version>.*/\1/') | |
| fi | |
| PRE=false | |
| printf '%s' "$V" | grep -Eq 'SNAPSHOT|-(rc|beta|alpha)' && PRE=true | |
| [ -n "$HUB_USERNAME" ] && HUB=1 || HUB=0 | |
| [ -n "$ALI_REGISTRY" ] && ALI=1 || ALI=0 | |
| # 登录域名与镜像前缀不同：ALI_REGISTRY 含命名空间（用于 tag），登录用其主机部分 | |
| ALI_HOST="${ALI_REGISTRY%%/*}" | |
| [ "$HUB" = "1" ] || [ "$ALI" = "1" ] || { | |
| echo "未配置任何镜像站：请设置 ALI_REGISTRY（与 ALI_USERNAME/ALI_PASSWORD）或 DOCKERHUB_USERNAME/TOKEN" >&2 | |
| exit 1 | |
| } | |
| for svc in manager executor gateway; do | |
| TAGS="" | |
| if [ "$HUB" = "1" ]; then | |
| TAGS="$(printf '%s\n' "$TAGS" "camilesing/datapoly-$svc:$V")" | |
| if [ "$PRE" = "false" ]; then TAGS="$(printf '%s\n' "$TAGS" "camilesing/datapoly-$svc:latest")"; fi | |
| fi | |
| if [ "$ALI" = "1" ]; then | |
| TAGS="$(printf '%s\n' "$TAGS" "$ALI_REGISTRY/datapoly-$svc:$V")" | |
| if [ "$PRE" = "false" ]; then TAGS="$(printf '%s\n' "$TAGS" "$ALI_REGISTRY/datapoly-$svc:latest")"; fi | |
| fi | |
| TAGS="$(printf '%s' "$TAGS" | sed '/^$/d')" | |
| { | |
| echo "tags_$svc<<EOF" | |
| echo "$TAGS" | sed '/^$/d' | |
| echo "EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| done | |
| echo "version=$V" >> "$GITHUB_OUTPUT" | |
| echo "ali_host=$ALI_HOST" >> "$GITHUB_OUTPUT" | |
| - name: Login Docker Hub（可选项，配置了才执行） | |
| if: env.HUB_USERNAME != '' | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Login 阿里云 ACR（本期） | |
| # 用 docker CLI 登录（login-action 的 registry 参数需纯主机名， | |
| # 而 ALI_REGISTRY 含命名空间，故这里用 tags 步骤推导出的主机部分） | |
| if: vars.ALI_REGISTRY != '' | |
| env: | |
| ALI_USER: ${{ secrets.ALI_USERNAME }} | |
| ALI_PWD: ${{ secrets.ALI_PASSWORD }} | |
| ALI_HOST: ${{ steps.tags.outputs.ali_host }} | |
| run: | | |
| echo "$ALI_PWD" | docker login -u "$ALI_USER" --password-stdin "$ALI_HOST" | |
| - name: Publish manager | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: build-docker/datapoly | |
| file: build-docker/datapoly/Dockerfile-manager | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| # ACR 不识别 attestation 产生的 OCI empty manifest（vnd.oci.empty.v1+json）， | |
| # 关闭 provenance/sbom 回退纯 docker-v2 清单 | |
| provenance: false | |
| sbom: false | |
| tags: ${{ steps.tags.outputs.tags_manager }} | |
| - name: Publish executor | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: build-docker/datapoly | |
| file: build-docker/datapoly/Dockerfile-executor | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| provenance: false | |
| sbom: false | |
| tags: ${{ steps.tags.outputs.tags_executor }} | |
| - name: Publish gateway | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: build-docker/datapoly | |
| file: build-docker/datapoly/Dockerfile-gateway | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| provenance: false | |
| sbom: false | |
| tags: ${{ steps.tags.outputs.tags_gateway }} |