feat(build): multi-arch builds + pinned actions#28
Open
Ayesh wants to merge 2 commits into
Open
Conversation
This is a rather large commit that makes several improvements to how the `php-docker-base` images are built and cleaned up. Multi-arch images ================= Although these images are used in linux x64 servers, developers could be running on other CPU architectures. For example, some of our friends and colleagues (and @Ayesh himself after he spilled water on his X64 laptop) use Mac Books that lately use Arm64 CPUs (Apple Sillicon M series). Right now, downstream projects such as Onatal, Onatal-API, Plaza, Peri-connect, etc use this image, but on Arm64, it has to emulate Amd64 (x64), which can be slow. On M series, this has no noticeable slow down, but the author of this PR has too much time on his rainy Sunday evening, and this PR proposes to build Amd64 and Arm64 images using native GitHub runners, and merge those images and tag them. This ensures that once the images are rebuilt, on the next fresh, any consumer that use the `php-docker-base` image will pull an Arm64 image instead of emulating the Amd64 image. Pinning third-part action SHAs ============================== This combines the external actions in the `production.yaml` workflow to the pinned versions. They are identical versions used in linkorb/repo-ansible as at v0.25.0. Checkout with `persist-credentials: false` ========================================= Combines security improvement suggested in linkorb/repo-ansible#165. Using `docker/*` actions ======================== Instead of calling `docker` commands directly in bash, this PR suggests to use relevant `docker/` GitHub reusable actions. The same version+shasums are used here as repo-ansible. Why a big PR? ============= This combines SHA pinning + `docker/` action migration, and multi-arch builds in one PR. If I were to do this one by one, it will have to be in a merge queue, increasing the merge and review times. This also aims to bring us to the final goal immediately, instead of doin it in smaller steps that cannot convey the final goal that easily.
Member
Author
|
Build matrix: 
GHCR multi-arch images: 
Sample Run log (from fork): https://github.com/Ayesh/php-docker-base/actions/runs/28750759020 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a rather large commit that makes several improvements to how the
php-docker-baseimages are built and cleaned up.Multi-arch images
Although these images are used in linux x64 servers, developers could be running on other CPU architectures. For example, some of our friends and colleagues (and @Ayesh himself after he spilled water on his X64 laptop) use Mac Books that lately use Arm64 CPUs (Apple Sillicon M series).
Right now, downstream projects such as Onatal, Onatal-API, Plaza, Peri-connect, etc use this image, but on Arm64, it has to emulate Amd64 (x64), which can be slow. On M series, this has no noticeable slow down, but the author of this PR has too much time on his rainy Sunday evening, and this PR proposes to build Amd64 and Arm64 images using native GitHub runners, and merge those images and tag them.
This ensures that once the images are rebuilt, on the next fresh, any consumer that use the
php-docker-baseimage will pull an Arm64 image instead of emulating the Amd64 image.Pinning third-part action SHAs
This combines the external actions in the
production.yamlworkflow to the pinned versions. They are identical versions used in linkorb/repo-ansible as at v0.25.0.Checkout with
persist-credentials: falseCombines security improvement suggested in linkorb/repo-ansible#165.
Using
docker/*actionsInstead of calling
dockercommands directly in bash, this PR suggests to use relevantdocker/GitHub reusable actions.The same version+shasums are used here as repo-ansible.
Why a big PR?
This combines SHA pinning +
docker/action migration, and multi-arch builds in one PR. If I were to do this one by one, it will have to be in a merge queue, increasing the merge and review times.This also aims to bring us to the final goal immediately, instead of doin it in smaller steps that cannot convey the final goal that easily.
Checklist