Migrate neco-admission to ghcr.io

Signed-off-by: Daichi Sakaue <[email protected]>

.github/actions/build_admission/action.yaml

@@ -0,0 +1,33 @@
+name: "Build admission"
+description: "Build admission"
+inputs:
+  github_token:
+    description: "GitHub Token"
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Setup build environment
+      uses: ./.github/actions/setup
+      with:
+        github_token: ${{ inputs.github_token }}
+        go-version: "1.21"
+    - id: extract
+      name: Extract targets
+      uses: ./.github/actions/extract_tags
+      with:
+        container-image: admission
+        github_token: ${{ inputs.github_token }}
+    - name: Run check-generate
+      if: ${{ steps.extract.outputs.build }}
+      shell: bash
+      run: make check-generate
+      working-directory: admission
+    - name: Test
+      if: ${{ steps.extract.outputs.build }}
+      uses: docker/build-push-action@v5
+      with:
+        context: admission
+        platforms: "linux/amd64"
+        target: test
+        push: false

.github/actions/extract_tags/action.yaml

@@ -0,0 +1,66 @@
+name: "Extract tags"
+description: "Extract tags to use for the new image"
+inputs:
+  dir:
+    description: "working directory"
+    required: false
+    default: ""
+  container-image:
+    description: "container image"
+    required: true
+  github_token:
+    description: "GitHub Token"
+    required: true
+outputs:
+  branch:
+    description: "branch"
+    value: ${{ steps.extract.outputs.branch }}
+  tag:
+    description: "tag"
+    value: ${{ steps.extract.outputs.tag }}
+  build:
+    description: "build is needed"
+    value: ${{ steps.extract.outputs.build }}
+  push:
+    description: "push is needed"
+    value: ${{ steps.extract.outputs.push }}
+
+runs:
+  using: composite
+  steps:
+    - id: extract
+      name: Extract targets
+      shell: bash
+      run: |
+        DIR=${{ inputs.dir }}
+        if [ "${DIR}" = "" ]; then DIR=${{ inputs.container-image }}; fi
+        IMAGE=${{ inputs.container-image }}
+        TAG=$(cat ${DIR}/TAG)
+        FOUND=$(container-tag-exists ghcr.io/cybozu/${IMAGE} ${TAG})
+        # The stdout should be either "" or "found".
+        if [ "${FOUND}" = "" ]; then
+            echo "tag=ghcr.io/cybozu/${IMAGE}:${TAG}" >> $GITHUB_OUTPUT
+            # echo "build=true" >> $GITHUB_OUTPUT
+            # if [ "${EVENT_NAME}" != "pull_request" ]; then
+            #   echo "push=true" >> $GITHUB_OUTPUT
+            # fi
+
+            if [ -f ${DIR}/BRANCH ]; then
+              if echo ${TAG} | grep -q -e - ; then
+                echo ===== Skip pushing branch tags for pre-release ${TAG} =====
+              else
+                BRANCH=$(cat ${DIR}/BRANCH)
+                echo "branch=ghcr.io/cybozu/${IMAGE}:${BRANCH}" >> $GITHUB_OUTPUT
+              fi
+            fi
+        fi
+      env:
+        EVENT_NAME: ${{ github.event_name }}
+        GITHUB_TOKEN: ${{ inputs.github_token }}
+    - name: Validate consistency between BRANCH and TAG
+      shell: bash
+      run: |
+        DIR=${{ inputs.dir }}
+        if [ "${DIR}" = "" ]; then DIR=${{ inputs.container-image }}; fi
+        if [ -e "${DIR}/NO_TAG_BRANCH_CONSISTENCY" ]; then exit 0; fi
+        ./tag_branch_consistency ${DIR}

.github/workflows/main.yaml

@@ -183,3 +183,12 @@ jobs:
           enable_arm64: ${{ matrix.job.enable_arm64 }}
           make_test: ${{ matrix.job.make_test }}
           scan: ${{ matrix.job.scan }}
+
+  build_admission:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build binary
+        uses: ./.github/actions/build_admission
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}

admission/.dockerignore

@@ -1,2 +1,2 @@
-*
-!workspace
+bin
+*.md

admission/Dockerfile

@@ -1,7 +1,12 @@
-FROM scratch
+FROM quay.io/cybozu/golang:1.20-jammy AS test
+COPY . /work
+RUN make test
 
-COPY workspace/neco-admission /neco-admission
+FROM quay.io/cybozu/golang:1.20-jammy AS build
+COPY . /work
+RUN make build
 
+FROM scratch
+COPY --from=build /work/bin/neco-admission /neco-admission
 USER 10000:10000
-
 ENTRYPOINT ["/neco-admission"]