feat: rework containers to build zsh and use debian trixie
#292
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Docker images | |
| on: | |
| workflow_dispatch: {} | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| schedule: | |
| - cron: "46 2 * * 1" | |
| permissions: | |
| contents: read | |
| env: | |
| REGISTRY: "docker.io" | |
| DOCKERHUB_ORG: "ohmyzsh" | |
| PLATFORMS: "linux/amd64,linux/arm64" | |
| LATEST_ZSH: "5.9.2" | |
| LATEST_OMZ: "master" # TODO: we need to change master with main when migrating the branch | |
| ZSH_VERSIONS: '["master","5.9.2","5.9.1","5.9","5.8.1","5.8","5.7.1","5.7","5.6.2","5.6.1","5.6","5.5.1","5.5","5.4.2","5.4.1","5.4","5.3.1","5.3","5.2","5.1.1","5.1","5.0.8","5.0.7","5.0.6","5.0.5","5.0.4","5.0.3","5.0.2","5.0.1","5.0.0","4.3.17","4.3.16","4.3.15","4.3.14","4.3.13","4.3.12","4.3.11","4.3.10"]' | |
| jobs: | |
| get-omz-versions: | |
| name: Get Oh My Zsh versions | |
| runs-on: ubuntu-latest | |
| outputs: | |
| non_latest_versions: ${{ steps.versions.outputs.non_latest_versions }} | |
| zsh_versions: ${{ steps.versions.outputs.zsh_versions }} | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Get Oh My Zsh versions | |
| id: versions | |
| run: | | |
| OMZ_TAGS="$(curl -sL https://api.github.com/repos/ohmyzsh/ohmyzsh/tags)" | |
| NON_LATEST_OMZ_VERSIONS="$(printf '%s' "$OMZ_TAGS" | jq -c --arg latest "${{ env.LATEST_OMZ }}" 'map(.name) | map(select(. != $latest))')" | |
| echo "non_latest_versions=$NON_LATEST_OMZ_VERSIONS" >> "$GITHUB_OUTPUT" | |
| echo 'zsh_versions=${{ env.ZSH_VERSIONS }}' >> "$GITHUB_OUTPUT" | |
| build-zsh-and-latest-omz: | |
| name: Build Zsh and latest Oh My Zsh Docker images | |
| runs-on: ubuntu-24.04 | |
| needs: | |
| - get-omz-versions | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| zsh-version: ${{ fromJSON(needs.get-omz-versions.outputs.zsh_versions) }} | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Start local registry | |
| run: | | |
| mkdir -p "${{ runner.temp }}/registry" | |
| docker run -d -p 5000:5000 --restart=always --name registry \ | |
| -v "${{ runner.temp }}/registry:/var/lib/registry" \ | |
| registry:3 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 | |
| with: | |
| platforms: arm64 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 | |
| with: | |
| platforms: ${{ env.PLATFORMS }} | |
| driver-opts: network=host | |
| - name: Log in to Docker Hub | |
| if: ${{ github.event_name != 'pull_request' }} | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USER }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Get Zsh tags | |
| id: zsh-tags | |
| run: | | |
| image_name="${{ env.DOCKERHUB_ORG }}/zsh" | |
| local_image="localhost:5000/${image_name}:${{ matrix.zsh-version }}" | |
| tags="${image_name}:${{ matrix.zsh-version }}" | |
| tags="${tags},${{ env.REGISTRY }}/${image_name}:${{ matrix.zsh-version }}" | |
| if [ "${{ matrix.zsh-version }}" = "${{ env.LATEST_ZSH }}" ]; then | |
| tags="${tags},${image_name}:latest" | |
| tags="${tags},${{ env.REGISTRY }}/${image_name}:latest" | |
| fi | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| base_image="$local_image" | |
| else | |
| base_image="${{ env.REGISTRY }}/${image_name}:${{ matrix.zsh-version }}" | |
| fi | |
| echo "local_image=$local_image" >> "$GITHUB_OUTPUT" | |
| echo "base_image=$base_image" >> "$GITHUB_OUTPUT" | |
| echo "publish_tags=$tags" >> "$GITHUB_OUTPUT" | |
| - name: Build Zsh image and publish Docker Hub tags | |
| if: ${{ github.event_name != 'pull_request' }} | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 | |
| with: | |
| context: zsh | |
| platforms: ${{ env.PLATFORMS }} | |
| push: true | |
| build-args: "ZSH_VERSION=${{ matrix.zsh-version }}" | |
| tags: ${{ steps.zsh-tags.outputs.local_image }},${{ steps.zsh-tags.outputs.publish_tags }} | |
| provenance: mode=max | |
| sbom: true | |
| - name: Build Zsh image for local Oh My Zsh base only | |
| if: ${{ github.event_name == 'pull_request' }} | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 | |
| with: | |
| context: zsh | |
| platforms: ${{ env.PLATFORMS }} | |
| push: true | |
| build-args: "ZSH_VERSION=${{ matrix.zsh-version }}" | |
| tags: ${{ steps.zsh-tags.outputs.local_image }} | |
| - name: Archive latest Zsh image for historical Oh My Zsh builds | |
| if: ${{ github.event_name == 'pull_request' && matrix.zsh-version == env.LATEST_ZSH }} | |
| run: | | |
| docker stop registry | |
| tar -C "${{ runner.temp }}/registry" \ | |
| -cf "${{ runner.temp }}/zsh-base-registry.tar" . | |
| docker start registry | |
| - name: Upload latest Zsh image | |
| if: ${{ github.event_name == 'pull_request' && matrix.zsh-version == env.LATEST_ZSH }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: pr-zsh-base-registry | |
| path: ${{ runner.temp }}/zsh-base-registry.tar | |
| compression-level: 0 | |
| retention-days: 1 | |
| - name: Get latest Oh My Zsh tags | |
| id: latest-omz-tags | |
| run: | | |
| image_name="${{ env.DOCKERHUB_ORG }}/ohmyzsh" | |
| tags="${image_name}:${{ matrix.zsh-version }}-${{ env.LATEST_OMZ }}" | |
| tags="${tags},${{ env.REGISTRY }}/${image_name}:${{ matrix.zsh-version }}-${{ env.LATEST_OMZ }}" | |
| if [ "${{ matrix.zsh-version }}" = "${{ env.LATEST_ZSH }}" ]; then | |
| tags="${tags},${image_name}:${{ env.LATEST_OMZ }}" | |
| tags="${tags},${{ env.REGISTRY }}/${image_name}:${{ env.LATEST_OMZ }}" | |
| tags="${tags},${image_name}:latest" | |
| tags="${tags},${{ env.REGISTRY }}/${image_name}:latest" | |
| fi | |
| echo "tags=$tags" >> "$GITHUB_OUTPUT" | |
| - name: Build latest Oh My Zsh images | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 | |
| with: | |
| context: ohmyzsh | |
| platforms: ${{ env.PLATFORMS }} | |
| push: ${{ github.event_name != 'pull_request' }} | |
| build-args: | | |
| OMZ_VERSION=${{ env.LATEST_OMZ }} | |
| ZSH_BASE_IMAGE=${{ steps.zsh-tags.outputs.base_image }} | |
| tags: ${{ steps.latest-omz-tags.outputs.tags }} | |
| provenance: mode=max | |
| sbom: true | |
| build-omz-versions: | |
| name: Build Oh My Zsh versioned Docker images | |
| if: ${{ needs.get-omz-versions.outputs.non_latest_versions != '[]' }} | |
| runs-on: ubuntu-24.04 | |
| needs: | |
| - get-omz-versions | |
| - build-zsh-and-latest-omz | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| omz-version: ${{ fromJSON(needs.get-omz-versions.outputs.non_latest_versions) }} | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Download latest Zsh image | |
| if: ${{ github.event_name == 'pull_request' }} | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: pr-zsh-base-registry | |
| path: ${{ runner.temp }} | |
| - name: Start local registry | |
| if: ${{ github.event_name == 'pull_request' }} | |
| run: | | |
| mkdir -p "${{ runner.temp }}/registry" | |
| tar -C "${{ runner.temp }}/registry" \ | |
| -xf "${{ runner.temp }}/zsh-base-registry.tar" | |
| docker run -d -p 5000:5000 --restart=always --name registry \ | |
| -v "${{ runner.temp }}/registry:/var/lib/registry" \ | |
| registry:3 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 | |
| with: | |
| platforms: arm64 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 | |
| with: | |
| platforms: ${{ env.PLATFORMS }} | |
| driver-opts: network=host | |
| - name: Log in to Docker Hub | |
| if: ${{ github.event_name != 'pull_request' }} | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USER }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Select Zsh base image | |
| run: | | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| echo "ZSH_BASE_IMAGE=localhost:5000/${{ env.DOCKERHUB_ORG }}/zsh:${{ env.LATEST_ZSH }}" >> "$GITHUB_ENV" | |
| else | |
| echo "ZSH_BASE_IMAGE=${{ env.REGISTRY }}/${{ env.DOCKERHUB_ORG }}/zsh:${{ env.LATEST_ZSH }}" >> "$GITHUB_ENV" | |
| fi | |
| - name: Get Oh My Zsh tags | |
| id: omz-tags | |
| run: | | |
| image_name="${{ env.DOCKERHUB_ORG }}/ohmyzsh" | |
| tags="${image_name}:${{ env.LATEST_ZSH }}-${{ matrix.omz-version }}" | |
| tags="${tags},${{ env.REGISTRY }}/${image_name}:${{ env.LATEST_ZSH }}-${{ matrix.omz-version }}" | |
| tags="${tags},${image_name}:${{ matrix.omz-version }}" | |
| tags="${tags},${{ env.REGISTRY }}/${image_name}:${{ matrix.omz-version }}" | |
| echo "tags=$tags" >> "$GITHUB_OUTPUT" | |
| - name: Build Oh My Zsh images | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 | |
| with: | |
| context: ohmyzsh | |
| platforms: ${{ env.PLATFORMS }} | |
| push: ${{ github.event_name != 'pull_request' }} | |
| build-args: | | |
| OMZ_VERSION=${{ matrix.omz-version }} | |
| ZSH_BASE_IMAGE=${{ env.ZSH_BASE_IMAGE }} | |
| tags: ${{ steps.omz-tags.outputs.tags }} | |
| provenance: mode=max | |
| sbom: true | |
| update-image-readme: | |
| needs: | |
| - build-zsh-and-latest-omz | |
| - build-omz-versions | |
| runs-on: ubuntu-latest | |
| if: >- | |
| ${{ | |
| always() && | |
| github.event_name != 'pull_request' && | |
| needs.build-zsh-and-latest-omz.result == 'success' && | |
| (needs.build-omz-versions.result == 'success' || | |
| needs.build-omz-versions.result == 'skipped') | |
| }} | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Update image READMEs | |
| env: | |
| DH_USERNAME: ${{ secrets.DOCKERHUB_USER }} | |
| DH_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }} | |
| run: | | |
| for image in */Dockerfile; do | |
| image="$(basename $(dirname $image))" | |
| if ! test -f "$image/README.md"; then | |
| echo "::warning ::missing README.md file at /$image" | |
| continue | |
| fi | |
| node .github/scripts/update-image-readme.js "${{ env.DOCKERHUB_ORG }}/$image" "$image/README.md" | |
| done |