-
-
Notifications
You must be signed in to change notification settings - Fork 9
229 lines (212 loc) · 9.69 KB
/
php_nightly.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
on:
schedule:
- cron: '0 0 * * 4'
workflow_dispatch:
inputs:
PHP_VCS_REF:
default: master
required: true
description: https://github.com/php/php-src/commits/master master branch commit id
name: PHP_nightly
defaults:
run:
shell: bash --noprofile --norc -exo pipefail {0}
jobs:
build:
name: Build
strategy:
max-parallel: 1
matrix:
# TYPE: [CLI, FPM, UNIT, COMPOSER, SWOOLE, PPM, SUPERVISORD]
TYPE: [CLI, FPM, COMPOSER, S6, UNIT, SWOOLE]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@main
with:
fetch-depth: 2
- run: |
env
docker --version
docker compose version
name: 'manifest'
- run: |
echo ${DOCKER_PASSWORD} | docker login -u ${DOCKER_USERNAME} --password-stdin
# echo ${DOCKER_PASSWORD} | docker login -u ${TENCENT_DOCKER_USERNAME} --password-stdin uswccr.ccs.tencentyun.com
echo ${DOCKER_PASSWORD} | docker login -u ${ALIYUN_DOCKER_USERNAME} --password-stdin registry.us-east-1.aliyuncs.com
echo ${GHCR_IO_TOKEN} | docker login -u khs1994 --password-stdin ghcr.io
echo ${CODING_DOCKER_PASSWORD} | docker login -u khs1994-1601432822176 --password-stdin pcit-docker.pkg.coding.net
name: 'Docker Login'
env:
DOCKER_PASSWORD: ${{secrets.DOCKER_PASSWORD}}
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
TENCENT_DOCKER_USERNAME: ${{secrets.TENCENT_DOCKER_USERNAME}}
ALIYUN_DOCKER_USERNAME: ${{secrets.ALIYUN_DOCKER_USERNAME}}
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
GHCR_IO_TOKEN: ${{secrets.GHCR_IO_TOKEN}}
CODING_DOCKER_PASSWORD: ${{secrets.CODING_DOCKER_PASSWORD}}
- uses: docker-practice/actions-setup-docker@master
with:
docker_channel: test
docker_version: "20.10"
- run: |
docker --version
docker compose version
docker buildx version
docker
name: 'install-after-manifest'
- run: |
cp .env.example .env
echo $GITHUB_REF | grep -q 'refs/tags/' && IS_TAG_EVENT=1 || true
if ! [ -n "${IS_TAG_EVENT}" -o "${GITHUB_EVENT_NAME}" = 'workflow_dispatch' ];then \
export PLATFORM=linux/amd64; \
if [ "$PHP_VERSION" = 8_X_X -o "$PHP_VERSION" = nightly ];then \
export PLATFORM=linux/amd64,linux/arm64; \
IS_PUSH=--push; \
mirror="${add_mirror}"; \
else \
true; \
fi; \
else \
IS_PUSH=--push \
&& mirror="${add_mirror}"; \
fi
VCS_REF=`git rev-parse --short HEAD`
CACHE_IMAGE=ghcr.io/${DOCKER_HUB_USERNAME}/php-cache
# CACHE_IMAGE=${DOCKER_HUB_USERNAME}/php
if [ -z "${PHP_VCS_REF}" -o "${PHP_VCS_REF}" = 'master' ];then
git clone --depth=1 https://github.com/php/php-src $HOME/php-src
PHP_VCS_REF=`git -C $HOME/php-src rev-parse --short HEAD`
fi
options="--build-arg VCS_REF=$VCS_REF \
--build-arg PHP_VCS_REF=$PHP_VCS_REF \
--build-arg PHP_VERSION=$PHP_TAG_VERSION \
--cache-from=${CACHE_IMAGE}:${FOLDER}-${TYPE,,}-cache \
--cache-to=${CACHE_IMAGE}:${FOLDER}-${TYPE,,}-cache"
echo $options
if [ "$TYPE" = "UNIT" ];then
echo "type=unit" >> $GITHUB_OUTPUT
echo "image=$DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-unit-alpine" >> $GITHUB_OUTPUT
echo ::group::Build $TYPE
docker buildx build $options \
--build-arg ALPINE_URL=${ALPINE_URL:-dl-cdn.alpinelinux.org} \
-t $DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-unit-alpine \
$(for item in `echo $mirror`;do echo " -t ${item}:${PHP_TAG_VERSION}-unit-alpine ";done) \
--platform ${PLATFORM} ${IS_PUSH} ${FOLDER}/unit
echo ::endgroup::
fi
if [ "$TYPE" = "SUPERVISORD" ];then
echo "type=supervisord" >> $GITHUB_OUTPUT
echo "image=$DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-supervisord-alpine" >> $GITHUB_OUTPUT
echo ::group::Build $TYPE
docker buildx build $options \
--build-arg ALPINE_URL=${ALPINE_URL:-dl-cdn.alpinelinux.org} \
-t $DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-supervisord-alpine \
$(for item in `echo $mirror`;do echo " -t ${item}:${PHP_TAG_VERSION}-supervisord-alpine ";done) \
--platform ${PLATFORM} ${IS_PUSH} ${FOLDER}/supervisord
echo ::endgroup::
fi
if [ "$TYPE" = "COMPOSER" ];then
echo "type=composer" >> $GITHUB_OUTPUT
echo "image=$DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-composer-alpine" >> $GITHUB_OUTPUT
echo ::group::Build $TYPE
docker buildx build $options \
--build-arg ALPINE_URL=${ALPINE_URL:-dl-cdn.alpinelinux.org} \
-t $DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-composer-alpine \
$(for item in `echo $mirror`;do echo " -t ${item}:${PHP_TAG_VERSION}-composer-alpine ";done) \
--platform ${PLATFORM} ${IS_PUSH} ${FOLDER}/composer
echo ::endgroup::
fi
if [ "$TYPE" = "SINGLE" ];then
echo "type=single" >> $GITHUB_OUTPUT
echo "image=$DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-single-alpine" >> $GITHUB_OUTPUT
echo ::group::Build $TYPE
docker buildx build $options \
--build-arg ALPINE_URL=${ALPINE_URL:-dl-cdn.alpinelinux.org} \
-t $DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-single-alpine \
${IS_PUSH} ${FOLDER}/single
echo ::endgroup::
fi
if [ "$TYPE" = "SWOOLE" ];then
echo "type=swoole" >> $GITHUB_OUTPUT
echo "image=$DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-swoole-alpine" >> $GITHUB_OUTPUT
echo ::group::Build $TYPE
docker buildx build $options \
--build-arg ALPINE_URL=${ALPINE_URL:-dl-cdn.alpinelinux.org} \
-t $DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-swoole-alpine \
$(for item in `echo $mirror`;do echo " -t ${item}:${PHP_TAG_VERSION}-swoole-alpine ";done) \
--platform ${PLATFORM} ${IS_PUSH} ${FOLDER}/swoole
echo ::endgroup::
fi
if [ "$TYPE" = "FPM" ];then
echo "type=fpm" >> $GITHUB_OUTPUT
echo "image=$DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-fpm-alpine" >> $GITHUB_OUTPUT
echo ::group::Build $TYPE
docker buildx build $options \
--build-arg ALPINE_URL=${ALPINE_URL:-dl-cdn.alpinelinux.org} \
--target=php -t $DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-fpm-alpine \
$(for item in `echo $mirror`;do echo " -t ${item}:${PHP_TAG_VERSION}-fpm-alpine ";done) \
${fpmTagOptions} \
--platform ${PLATFORM} ${IS_PUSH} ${FOLDER}/fpm
echo ::endgroup::
fi
if [ "$TYPE" = "CLI" ];then
echo "type=cli" >> $GITHUB_OUTPUT
echo "image=$DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-cli-alpine" >> $GITHUB_OUTPUT
echo ::group::Build $TYPE
docker buildx build $options \
--build-arg ALPINE_URL=${ALPINE_URL:-dl-cdn.alpinelinux.org} \
-t $DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-cli-alpine \
$(for item in `echo $mirror`;do echo " -t ${item}:${PHP_TAG_VERSION}-cli-alpine ";done) \
--platform ${PLATFORM} ${IS_PUSH} ${FOLDER}/cli
echo ::endgroup::
fi
if [ "$TYPE" = "S6" ];then
echo "type=s6" >> $GITHUB_OUTPUT
echo "image=$DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-s6-alpine" >> $GITHUB_OUTPUT
echo ::group::Build $TYPE
docker buildx build $options \
--build-arg ALPINE_URL=${ALPINE_URL:-dl-cdn.alpinelinux.org} \
-t $DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-s6-alpine \
$(for item in `echo $mirror`;do echo " -t ${item}:${PHP_TAG_VERSION}-s6-alpine ";done) \
--platform ${PLATFORM} ${IS_PUSH} ${FOLDER}/s6
echo ::endgroup::
fi
if [ "$TYPE" = "PPM" ];then
echo ::group::Build $TYPE
docker buildx build $options \
--build-arg ALPINE_URL=${ALPINE_URL:-dl-cdn.alpinelinux.org} \
-t $DOCKER_HUB_USERNAME/php:${PHP_TAG_VERSION}-ppm-alpine \
$(for item in `echo $mirror`;do echo " -t ${item}:${PHP_TAG_VERSION}-ppm-alpine ";done) \
--platform ${PLATFORM} ${IS_PUSH} ${FOLDER}/ppm
echo ::endgroup::
fi
env:
GITHUB_EVENT_NAME: ${{github.event_name}}
DOCKER_HUB_USERNAME: khs1994
DOCKER_HUB_USERNAME_TEST: lrew
PLATFORM: linux/amd64,linux/arm64 #,linux/arm/v7
PHP_VERSION: nightly
FOLDER: nightly
PHP_TAG_VERSION: nightly
TYPE: ${{ matrix.TYPE }}
add_mirror: registry.us-east-1.aliyuncs.com/khs1994-us/php pcit-docker.pkg.coding.net/khs1994-docker/khs1994/php ghcr.io/khs1994/php
PHP_VCS_REF: ${{ github.event.inputs.PHP_VCS_REF }}
name: 'Build Image'
id: build
- name: Run Snyk to check Docker image for vulnerabilities
# Snyk can be used to break the build when it detects vulnerabilities.
# In this case we want to upload the issues to GitHub Code Scanning
continue-on-error: true
uses: snyk/actions/docker@master
env:
# In order to use the Snyk Action you will need to have a Snyk API token.
# More details in https://github.com/snyk/actions#getting-your-snyk-token
# or you can signup for free at https://snyk.io/login
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
image: ${{ steps.build.outputs.image }}
args: --file=nightly/${{ steps.build.outputs.type }}/Dockerfile
- name: Upload result to GitHub Code Scanning
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: snyk.sarif