From 94004561da078f67832f216fb74e1dcebc241336 Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 13 May 2024 20:42:47 +0200 Subject: [PATCH 01/14] Add APP_KEY, APP_VERSION and DOCKER_REPO env keys --- docker-compose.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 7691d2b5..f6753cc5 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -10,10 +10,7 @@ services: - POSTGRES_PASSWORD=postgres restart: always cachet: - build: - context: . - args: - - cachet_ver=2.4 + image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-main} ports: - 80:8000 links: From df4bb007320c855e0fae4bd6433afcba33540e9b Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 13 May 2024 20:43:43 +0200 Subject: [PATCH 02/14] Created GitHub Workflow to build multi-arg docker image when we make a new tag. --- .github/workflows/docker-publish.yml | 86 ++++++++++++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 .github/workflows/docker-publish.yml diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml new file mode 100644 index 00000000..021c446b --- /dev/null +++ b/.github/workflows/docker-publish.yml @@ -0,0 +1,86 @@ +name: Docker + +on: + push: + tags: [ 'v*.*.*' ] + +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }} + + +jobs: + build: + + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + # This is used to complete the identity challenge + # with sigstore/fulcio when running outside of PRs. + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # Install the cosign tool except on PR + # https://github.com/sigstore/cosign-installer + - name: Install cosign + if: github.event_name != 'pull_request' + uses: sigstore/cosign-installer@v3.5.0 + with: + cosign-release: 'v2.2.4' + + # Set up BuildKit Docker container builder to be able to build + # multi-platform images and export cache + # https://github.com/docker/setup-buildx-action + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 + + # Login against a Docker registry except on PR + # https://github.com/docker/login-action + - name: Log into registry ${{ env.REGISTRY }} + if: github.event_name != 'pull_request' + uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + # Extract metadata (tags, labels) for Docker + # https://github.com/docker/metadata-action + - name: Extract Docker metadata + id: meta + uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + + # Build and push Docker image with Buildx (don't push on PR) + # https://github.com/docker/build-push-action + - name: Build and push Docker image + id: build-and-push + uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 + with: + context: . + platforms: linux/amd64,linux/arm64 + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + + # Sign the resulting Docker image digest except on PRs. + # This will only write to the public Rekor transparency log when the Docker + # repository is public to avoid leaking data. If you would like to publish + # transparency data even for private images, pass --force to cosign below. + # https://github.com/sigstore/cosign + - name: Sign the published Docker image + if: ${{ github.event_name != 'pull_request' }} + env: + # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable + TAGS: ${{ steps.meta.outputs.tags }} + DIGEST: ${{ steps.build-and-push.outputs.digest }} + # This step uses the identity token to provision an ephemeral certificate + # against the sigstore community Fulcio instance. + run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} From e9d330ee676ef046609e4c877ca18368301139cc Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 13 May 2024 20:44:11 +0200 Subject: [PATCH 03/14] Changes PostgreSQL 9.x to 12.z --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 6c8198a1..ff8e50b4 100644 --- a/Makefile +++ b/Makefile @@ -3,7 +3,7 @@ SILENT : update-dependencies: docker pull curlimages/curl:latest - docker pull postgres:9.5 + docker pull postgres:12-alpine test: bats test From 57cd79c54d7ca9b48a0b9ae51c5a9872cff5d8eb Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 13 May 2024 20:44:41 +0200 Subject: [PATCH 04/14] Add PHPStorm and .env files in .gitignore --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 00000000..cdc4675b --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +/.env +/.idea From 1e77d6d7f1e71910628660c6ec6bbb6359aa5841 Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 13 May 2024 21:04:32 +0200 Subject: [PATCH 05/14] Change default tag to latest and add ENV variables to Workflow --- .github/workflows/blank.yml | 11 +++++++++-- docker-compose.yml | 2 +- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/blank.yml b/.github/workflows/blank.yml index 9f4d3dc2..0e4babf5 100644 --- a/.github/workflows/blank.yml +++ b/.github/workflows/blank.yml @@ -2,7 +2,7 @@ name: CI -# Controls when the action will run. +# Controls when the action will run. on: # Triggers the workflow on push or pull request events but only for the main branch push: @@ -13,6 +13,10 @@ on: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: +env: + APP_KEY: ${{ vars.APP_KEY }} + DOCKER_REPO: ${{ vars.DOCKER_REPO }} + # A workflow run is made up of one or more jobs that can run sequentially or in parallel jobs: # This workflow contains a single job called "build" @@ -24,7 +28,7 @@ jobs: steps: - name: Install bats run: sudo apt-get install bats - + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - uses: actions/checkout@v2 @@ -35,3 +39,6 @@ jobs: bats test/test.full.bats bats test/test.mysql.bats bats test/test.sqlite.bats + env: + APP_KEY: ${{ vars.APP_KEY }} + DOCKER_REPO: ${{ vars.DOCKER_REPO }} diff --git a/docker-compose.yml b/docker-compose.yml index f6753cc5..58b2484d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -10,7 +10,7 @@ services: - POSTGRES_PASSWORD=postgres restart: always cachet: - image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-main} + image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-latest} ports: - 80:8000 links: From 2f89943b807067e79960257af3e7273270da054c Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 13 May 2024 21:11:43 +0200 Subject: [PATCH 06/14] Upgrade MariaDB from 10.4 to 11 --- test/docker-compose-mysql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/docker-compose-mysql.yml b/test/docker-compose-mysql.yml index e1e87d8c..b5e78259 100644 --- a/test/docker-compose-mysql.yml +++ b/test/docker-compose-mysql.yml @@ -2,7 +2,7 @@ version: "3" services: mysql: - image: mariadb:10.4 + image: mariadb:11 environment: - MYSQL_ROOT_PASSWORD=mysql - MYSQL_USER=mysql From d9d63f11a3d4e9e98434d73273dbd38e396c9deb Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 13 May 2024 21:16:44 +0200 Subject: [PATCH 07/14] Change image to GitHub repo --- test/docker-compose-mysql.yml | 2 +- test/docker-compose-sqlite.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/test/docker-compose-mysql.yml b/test/docker-compose-mysql.yml index b5e78259..7005de6b 100644 --- a/test/docker-compose-mysql.yml +++ b/test/docker-compose-mysql.yml @@ -10,7 +10,7 @@ services: - MYSQL_DATABASE=mysql - DEBUG=false cachet: - image: docker_cachet + image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-latest} ports: - 80:8000 links: diff --git a/test/docker-compose-sqlite.yml b/test/docker-compose-sqlite.yml index c378e6ec..564984bd 100644 --- a/test/docker-compose-sqlite.yml +++ b/test/docker-compose-sqlite.yml @@ -2,7 +2,7 @@ version: "3" services: cachet: - image: docker_cachet + image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-latest} ports: - 80:8000 environment: From fa3b26920a4223efbd14774b4b9a5f5829b23d2d Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 13 May 2024 21:53:37 +0200 Subject: [PATCH 08/14] Change test string to "mariadbd: ready for connections." --- test/test.mysql.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/test.mysql.bats b/test/test.mysql.bats index 2ea73a96..7966fa31 100755 --- a/test/test.mysql.bats +++ b/test/test.mysql.bats @@ -13,7 +13,7 @@ load "lib/output" } @test "[$TEST_FILE] check for database startup" { - docker_wait_for_log test_mysql_1 120 "mysqld: ready for connections." + docker_wait_for_log test_mysql_1 120 "mariadbd: ready for connections." } @test "[$TEST_FILE] check for empty sessions table" { From b78b88ed50813dc0f425ab74f5e466f6df99339b Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 13 May 2024 21:58:22 +0200 Subject: [PATCH 09/14] Upgrade actions/checkout@v2 to actions/checkout@v4 (nodejs 20 message) --- .github/workflows/blank.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/blank.yml b/.github/workflows/blank.yml index 0e4babf5..bceed720 100644 --- a/.github/workflows/blank.yml +++ b/.github/workflows/blank.yml @@ -30,7 +30,7 @@ jobs: run: sudo apt-get install bats # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 # Runs a set of commands using the runners shell - name: Run bash automated test suite (bats) From cb81475c2b8e8b1e79da81c7323a50b096006ccb Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 13 May 2024 23:44:31 +0200 Subject: [PATCH 10/14] Changed Workflow to use tagname for downloading the right archive. Add support for Docker Hub repo. --- .github/workflows/docker-publish.yml | 44 +++++++++++++++++++++++----- 1 file changed, 37 insertions(+), 7 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 021c446b..e92f17aa 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -24,6 +24,24 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + - name: Set Versions + uses: actions/github-script@v4 + id: set_version + with: + script: | + const tag = context.ref.substring(10) + const no_v = tag.replace('v', '') + const dash_index = no_v.lastIndexOf('-') + const no_dash = (dash_index > -1) ? no_v.substring(0, dash_index) : no_v + core.setOutput('tag', tag) + core.setOutput('no-v', no_v) + core.setOutput('no-dash', no_dash) + + - id: lower-repo + name: Repository to lowercase + run: | + echo "repository=${GITHUB_REPOSITORY@L}" >> $GITHUB_OUTPUT + # Install the cosign tool except on PR # https://github.com/sigstore/cosign-installer - name: Install cosign @@ -36,13 +54,19 @@ jobs: # multi-platform images and export cache # https://github.com/docker/setup-buildx-action - name: Set up Docker Buildx - uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 + uses: docker/setup-buildx-action@v3 # v3.0.0 - # Login against a Docker registry except on PR + # Login against Docker Hub registry + - name: Login to Docker Hub + uses: docker/login-action@v3 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + # Login against a GitHub Docker registry # https://github.com/docker/login-action - name: Log into registry ${{ env.REGISTRY }} - if: github.event_name != 'pull_request' - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -52,7 +76,7 @@ jobs: # https://github.com/docker/metadata-action - name: Extract Docker metadata id: meta - uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 + uses: docker/metadata-action@v5 # v5.0.0 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} @@ -60,12 +84,18 @@ jobs: # https://github.com/docker/build-push-action - name: Build and push Docker image id: build-and-push - uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 + uses: docker/build-push-action@v5 # v5.0.0 with: context: . + build-args: | + "cachet_ver=${{ github.ref_name }}" platforms: linux/amd64,linux/arm64 push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} + tags: | + cachethq/docker:latest + cachethq/docker:${{steps.set_version.outputs.no-dash}} + ghcr.io/${{ steps.lower-repo.outputs.repository }}:latest + ghcr.io/${{ steps.lower-repo.outputs.repository }}:${{steps.set_version.outputs.no-dash}} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max From bbcc09f601898d8cde8275f0ae5fbbba91b014eb Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 20 May 2024 12:44:16 +0200 Subject: [PATCH 11/14] Fix: tests must build the image locally first --- test/docker-compose-full.yml | 36 ++++++++++++++++++++++++++++++++++ test/docker-compose-mysql.yml | 3 +++ test/docker-compose-sqlite.yml | 3 +++ test/test.full.bats | 10 +++++----- 4 files changed, 47 insertions(+), 5 deletions(-) create mode 100644 test/docker-compose-full.yml diff --git a/test/docker-compose-full.yml b/test/docker-compose-full.yml new file mode 100644 index 00000000..3a0f8c68 --- /dev/null +++ b/test/docker-compose-full.yml @@ -0,0 +1,36 @@ +version: "3" + +services: + postgres: + image: postgres:12-alpine + volumes: + - /var/lib/postgresql/data + environment: + - POSTGRES_USER=postgres + - POSTGRES_PASSWORD=postgres + restart: always + cachet: + image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-latest} + build: + context: .. + dockerfile: Dockerfile + ports: + - 8000:8000 + links: + - postgres:postgres + environment: + - DB_DRIVER=pgsql + - DB_HOST=postgres + - DB_PORT=5432 + - DB_DATABASE=postgres + - DB_USERNAME=postgres + - DB_PASSWORD=postgres + - DB_PREFIX=chq_ + - APP_KEY=${APP_KEY:-null} + - APP_LOG=errorlog + - APP_ENV=${APP_ENV:-production} + - APP_DEBUG=false + - DEBUG=false + depends_on: + - postgres + restart: on-failure diff --git a/test/docker-compose-mysql.yml b/test/docker-compose-mysql.yml index 7005de6b..35bd1f06 100644 --- a/test/docker-compose-mysql.yml +++ b/test/docker-compose-mysql.yml @@ -11,6 +11,9 @@ services: - DEBUG=false cachet: image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-latest} + build: + context: .. + dockerfile: Dockerfile ports: - 80:8000 links: diff --git a/test/docker-compose-sqlite.yml b/test/docker-compose-sqlite.yml index 564984bd..b66a6f9c 100644 --- a/test/docker-compose-sqlite.yml +++ b/test/docker-compose-sqlite.yml @@ -3,6 +3,9 @@ version: "3" services: cachet: image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-latest} + build: + context: .. + dockerfile: Dockerfile ports: - 80:8000 environment: diff --git a/test/test.full.bats b/test/test.full.bats index 38ba0e8e..406f8728 100755 --- a/test/test.full.bats +++ b/test/test.full.bats @@ -5,11 +5,11 @@ load "lib/batslib" load "lib/output" @test "[$TEST_FILE] testing Cachet Docker image build" { - command docker-compose build --no-cache cachet + command docker-compose -f test/docker-compose-full.yml build --no-cache cachet } @test "[$TEST_FILE] testing Cachet docker-compose up" { - command docker-compose up -d + command docker-compose -f test/docker-compose-full.yml up -d } @test "[$TEST_FILE] check for container init" { @@ -79,9 +79,9 @@ load "lib/output" } @test "[$TEST_FILE] restart cachet" { - command docker-compose stop cachet - command docker-compose rm -f cachet - command docker-compose up -d + command docker-compose -f test/docker-compose-full.yml stop cachet + command docker-compose -f test/docker-compose-full.yml rm -f cachet + command docker-compose -f test/docker-compose-full.yml up -d docker_wait_for_log docker_cachet_1 15 "INFO success: nginx entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)" } From 75e91cbf3bd048b2d6cf8d2f33bfb3481bca7f30 Mon Sep 17 00:00:00 2001 From: Stephan Eizinga Date: Mon, 20 May 2024 12:45:15 +0200 Subject: [PATCH 12/14] Add image information for GitHub and Docker Hub repo's --- Dockerfile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 36633d2d..b9e31398 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,9 @@ FROM nginx:1.17.8-alpine - +LABEL org.opencontainers.image.description="Cachet is a beautiful and powerful open source status page system." \ + org.opencontainers.image.authors="CachetHQ" \ + org.opencontainers.image.url="https://cachethq.io" \ + org.opencontainers.image.documentation="https://docs.cachethq.io" \ + org.opencontainers.image.source="https://github.com/cachethq/cachet" EXPOSE 8000 CMD ["/sbin/entrypoint.sh"] From 6463e8bf4c344c29380d43a729c30e17f93506f0 Mon Sep 17 00:00:00 2001 From: steffjenl Date: Mon, 20 May 2024 14:50:32 +0200 Subject: [PATCH 13/14] Delete .github/workflows/blank.yml because is does not work any more --- .github/workflows/blank.yml | 44 ------------------------------------- 1 file changed, 44 deletions(-) delete mode 100644 .github/workflows/blank.yml diff --git a/.github/workflows/blank.yml b/.github/workflows/blank.yml deleted file mode 100644 index bceed720..00000000 --- a/.github/workflows/blank.yml +++ /dev/null @@ -1,44 +0,0 @@ -# This is a basic workflow to help you get started with Actions - -name: CI - -# Controls when the action will run. -on: - # Triggers the workflow on push or pull request events but only for the main branch - push: - branches: [ main ] - pull_request: - branches: [ main ] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -env: - APP_KEY: ${{ vars.APP_KEY }} - DOCKER_REPO: ${{ vars.DOCKER_REPO }} - -# A workflow run is made up of one or more jobs that can run sequentially or in parallel -jobs: - # This workflow contains a single job called "build" - build: - # The type of runner that the job will run on - runs-on: ubuntu-latest - - # Steps represent a sequence of tasks that will be executed as part of the job - steps: - - name: Install bats - run: sudo apt-get install bats - - # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v4 - - # Runs a set of commands using the runners shell - - name: Run bash automated test suite (bats) - run: | - docker pull curlimages/curl:latest - bats test/test.full.bats - bats test/test.mysql.bats - bats test/test.sqlite.bats - env: - APP_KEY: ${{ vars.APP_KEY }} - DOCKER_REPO: ${{ vars.DOCKER_REPO }} From 3fa6e0927692674cdd3ef5f743c2c366a7bca3ef Mon Sep 17 00:00:00 2001 From: steffjenl Date: Sat, 1 Jun 2024 13:34:24 +0200 Subject: [PATCH 14/14] Update docker-publish.yml --- .github/workflows/docker-publish.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index e92f17aa..25b99a69 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -3,10 +3,13 @@ name: Docker on: push: tags: [ 'v*.*.*' ] + branches: + - main, feature/* env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} + DOCKER_REPO: ${{ vars.DOCKER_REPO || 'cachethq/docker' }} jobs: @@ -92,9 +95,7 @@ jobs: platforms: linux/amd64,linux/arm64 push: ${{ github.event_name != 'pull_request' }} tags: | - cachethq/docker:latest - cachethq/docker:${{steps.set_version.outputs.no-dash}} - ghcr.io/${{ steps.lower-repo.outputs.repository }}:latest + ${{ env.DOCKER_REPO }}:${{steps.set_version.outputs.no-dash}} ghcr.io/${{ steps.lower-repo.outputs.repository }}:${{steps.set_version.outputs.no-dash}} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha