publish-docker.yaml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: publish-docker

# Two kinds of image come out of this workflow:
#
#   push to main   -> per-commit development images, tagged with the commit SHA,
#                     pushed to GitHub Container Registry.
#   release        -> the official versioned images for a passed release vote,
#                     tagged x.y.z-<base>, pushed to Docker Hub as
#                     apache/skywalking-java-agent.
#
# Releases publish by dispatch, deliberately, rather than by a `release` trigger.
# For a `release` event GitHub runs the workflow as it exists **at the tag**, and
# the tag is cut at `prepare` while the GitHub Release is published at
# `vote-passed`, at least 72 hours later. Anything changed here in between would
# silently not apply to the release in flight - that window is how 9.7.0 shipped
# with no workflow run at all. A dispatch always runs the workflow from the
# default branch, so what is on main is what publishes.
#
# `release.sh github-release` creates the Release and then dispatches this
# workflow, so this stays automatic; running it by hand from the Actions tab is
# how you retry a release whose images failed to push.
on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version to publish to Docker Hub, e.g. 9.7.0. Leave blank to build a development image from main.'
        required: false
        default: ''

env:
  SKIP_TEST: true
  # Non-empty exactly when this run publishes an official release. Everything
  # below keys off this rather than the event name.
  RELEASE_TAG: ${{ github.event.inputs.version }}

jobs:
  # One agent package feeds every image. The variants differ only in the JRE they
  # sit on: the Dockerfile takes BASE_IMAGE and ADDs the same DIST directory, and
  # the agent itself is Java 8 bytecode that runs on all of them. So this is built
  # (or downloaded) exactly once and handed to the matrix below as an artifact,
  # rather than each variant fetching its own copy.
  agent-package:
    if: github.repository == 'apache/skywalking-java'
    name: Prepare Agent Package
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v2
        with:
          submodules: true

      # Development images are compiled from the branch.
      - name: Cache local Maven repository
        if: env.RELEASE_TAG == ''
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-publish-docker-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-maven-publish-docker-
      - uses: actions/setup-java@v2
        if: env.RELEASE_TAG == ''
        with:
          distribution: temurin
          java-version: 17
      - name: Build Agent
        if: env.RELEASE_TAG == ''
        run: make build

      # A release is never rebuilt. The published image has to carry the artifact
      # the PMC voted on, so take it from the Apache distribution area and prove
      # it is that one: the sha512 rules out a truncated download, and verifying
      # the detached signature against the project KEYS file rules out anything
      # the release manager did not sign. `release.sh promote` does the svn mv
      # from dist/dev to dist/release immediately before the GitHub Release that
      # triggers this workflow, so the file is in place by the time this runs.
      - name: Download the released agent package
        if: env.RELEASE_TAG != ''
        run: |
          set -euo pipefail
          VERSION=${RELEASE_TAG#v}
          BASE="https://dist.apache.org/repos/dist/release/skywalking/java-agent/${VERSION}"
          TARBALL="apache-skywalking-java-agent-${VERSION}.tgz"

          curl -fsSL --retry 5 --retry-delay 10 -O "${BASE}/${TARBALL}"
          curl -fsSL --retry 5 --retry-delay 10 -O "${BASE}/${TARBALL}.asc"
          curl -fsSL --retry 5 --retry-delay 10 -O "${BASE}/${TARBALL}.sha512"

          sha512sum -c "${TARBALL}.sha512"

          curl -fsSL --retry 5 --retry-delay 10 https://downloads.apache.org/skywalking/KEYS | gpg --import
          gpg --verify "${TARBALL}.asc" "${TARBALL}"

          tar -xzf "${TARBALL}"
          # The Makefile passes this directory to the Dockerfile as ARG DIST.
          test -d skywalking-agent

      - uses: actions/upload-artifact@v4
        name: Upload Agent
        with:
          name: skywalking-agent
          path: skywalking-agent

  build-docker:
    if: github.repository == 'apache/skywalking-java'
    needs: [ agent-package ]
    name: Build and Push Docker
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    timeout-minutes: 60
    strategy:
      matrix:
        # A release publishes the complete set the previous manual `make
        # docker.push.*` produced, alpine included. Per-commit development
        # images keep the existing JRE-only set.
        base: ${{ github.event.inputs.version && fromJSON('["alpine","java8","java11","java17","java21","java25"]') || fromJSON('["java8","java11","java17","java21","java25"]') }}
    steps:
      - uses: actions/checkout@v2
        with:
          submodules: true
      # The workflow file necessarily comes from the default branch on a
      # dispatch - that is the point, it is what makes the run deterministic. The
      # tree it builds must not. Dockerfile and Makefile decide what the image
      # actually is, so for a release take them from the tag, exactly as the
      # release:perform build and the source tarball did.
      - name: Check out the released tag
        if: env.RELEASE_TAG != ''
        run: |
          set -euo pipefail
          VERSION=${RELEASE_TAG#v}
          git fetch --depth 1 origin "refs/tags/v${VERSION}:refs/tags/v${VERSION}"
          git checkout "refs/tags/v${VERSION}"
          git submodule update --init --depth 1
          git --no-pager log -1 --format='building from %h %d'
      - uses: actions/download-artifact@v4
        with:
          name: skywalking-agent
          path: skywalking-agent
      - name: Set environment variables
        run: |
          if [[ -n "${RELEASE_TAG}" ]]; then
            # Provisioned by ASF INFRA on request, as for apache/skywalking.
            # Without them docker/login-action fails with an opaque error, so say
            # what is actually missing.
            if [[ -z "${{ secrets.DOCKERHUB_USER }}" || -z "${{ secrets.DOCKERHUB_TOKEN }}" ]]; then
              echo "::error::DOCKERHUB_USER / DOCKERHUB_TOKEN are not set on this repository."
              echo "::error::Ask ASF INFRA to add them (see docs/en/contribution/release-java-agent.md),"
              echo "::error::or publish from a workstation with './tools/releasing/release.sh docker <version>'."
              exit 1
            fi
            # apache/skywalking-java-agent:x.y.z-<base> on Docker Hub.
            # NAME differs from the development images, which is why it is set
            # here rather than left to the Makefile default.
            echo "HUB=apache" >> $GITHUB_ENV
            echo "NAME=skywalking-java-agent" >> $GITHUB_ENV
            echo "DOCKER_REGISTRY=docker.io" >> $GITHUB_ENV
            echo "DOCKER_USERNAME=${{ secrets.DOCKERHUB_USER }}" >> $GITHUB_ENV
            echo "DOCKER_PASSWORD=${{ secrets.DOCKERHUB_TOKEN }}" >> $GITHUB_ENV
            echo "TAG=${RELEASE_TAG#v}" >> $GITHUB_ENV
          else
            echo "HUB=ghcr.io/apache/skywalking-java" >> $GITHUB_ENV
            echo "DOCKER_REGISTRY=ghcr.io" >> $GITHUB_ENV
            echo "DOCKER_USERNAME=${{ github.actor }}" >> $GITHUB_ENV
            echo "DOCKER_PASSWORD=${{ secrets.GITHUB_TOKEN }}" >> $GITHUB_ENV
            echo "TAG=${{ github.sha }}" >> $GITHUB_ENV
          fi
      - name: Disable containerd image store
        run: |
          DAEMON_JSON="/etc/docker/daemon.json"
          if [ -f "$DAEMON_JSON" ]; then
            sudo jq '. + {"features": {"containerd-snapshotter": false}}' "$DAEMON_JSON" \
              | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
            sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
          else
            echo '{"features": {"containerd-snapshotter": false}}' \
              | sudo tee "$DAEMON_JSON" > /dev/null
          fi
          sudo systemctl restart docker
          docker version
          docker info
          echo "DOCKER_API_VERSION=$(docker version --format '{{.Server.APIVersion}}')" >> "$GITHUB_ENV"
      - name: Log in to the Container registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.DOCKER_REGISTRY }}
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ env.DOCKER_PASSWORD }}
      # The Makefile builds linux/amd64 and linux/arm64, which needs emulation
      # and the docker-container buildx driver.
      - name: Set up QEMU
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
      - name: Build and push docker image
        run: make docker.push.${{ matrix.base }} || make docker.push.${{ matrix.base }}