tools-java/.github/workflows/docker_deploy.yml at master · spdx/tools-java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
# SPDX-FileContributor: Helio Chissini de Castro
# SPDX-FileContributor: Arthit Suriyawongkul
# SPDX-FileCopyrightText: 2023 Helio Chissini de Castro
# SPDX-FileCopyrightText: 2026 SPDX Contributors
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: Apache-2.0

name: Docker build & publish

on:
  workflow_dispatch:
  pull_request:
    paths:
      - Dockerfile
      - scripts/tools-java-wrapper.sh
      - .github/workflows/docker_deploy.yml
  push:
    tags:
      - 'v*'
env:
  REGISTRY: ghcr.io

jobs:
  smoke_test:
    name: Lint & smoke test Docker image
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read

    steps:
      - name: Checkout main repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Lint Dockerfile
        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
        with:
          dockerfile: Dockerfile
          failure-threshold: warning

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Build test image (single-arch, local load)
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          push: false
          load: true
          tags: tools-java:ci-test
          cache-from: type=gha,scope=tools_java_smoke
          cache-to: type=gha,scope=tools_java_smoke,mode=max

      - name: Smoke test - entrypoint runs without error
        run: |
          output=$(docker run --rm tools-java:ci-test 2>&1) || true
          echo "$output"
          if echo "$output" | grep -qi "Unable to access jarfile"; then
            echo "::error::Container failed to find its jar file"
            exit 1
          fi
          echo "$output" | grep -q "^Usage:" || { echo "::error::Expected usage banner not found"; exit 1; }

      - name: Smoke test - Version command
        run: |
          docker run --rm tools-java:ci-test Version \
            || { echo "::error::Version command failed"; exit 1; }

      - name: Smoke test - wrapper script version substitution
        run: |
          script=$(docker run --rm --entrypoint sh tools-java:ci-test -c 'cat /usr/bin/tools-java') || true
          echo "$script"
          if echo "$script" | grep -q '@@VERSION@@'; then
            echo "::error::Version placeholder was never substituted in wrapper script"
            exit 1
          fi
          if echo "$script" | grep -q -- '--jar-with-dependencies'; then
            echo "::error::Version was substituted with an empty string (double dash in jar name)"
            exit 1
          fi

      - name: Smoke test - referenced jar file exists
        run: |
          jar_path=$(docker run --rm --entrypoint sh tools-java:ci-test -c \
            "sed -n 's/.*-jar \\(\\/[^ ]*\\.jar\\).*/\\1/p' /usr/bin/tools-java")
          echo "Resolved jar path: $jar_path"
          [ -n "$jar_path" ] \
            || { echo "::error::Could not parse jar path from wrapper script"; exit 1; }
          docker run --rm --entrypoint sh tools-java:ci-test -c "test -f '$jar_path'" \
            || { echo "::error::Jar file referenced by wrapper script does not exist: $jar_path"; exit 1; }

  docker_push:
    name: Build Docker Image
    needs: smoke_test
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout main repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract components metadata
        id: meta_base
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ github.repository }}
          tags: |
            type=ref,event=tag
            type=semver,pattern={{version}}
          labels: org.opencontainers.image.licenses=Apache-2.0

      - name: Build image & push to ghcr.io
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          push: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') }}
          load: false
          platforms: linux/amd64,linux/arm64
          tags: |
            ${{ steps.meta_base.outputs.tags }}
          labels: ${{ steps.meta_base.outputs.labels }}
          cache-from: type=gha,scope=tools_java_release
          cache-to: type=gha,scope=tools_java_release,mode=max