Streamline/refactor GH pipelines

.github/workflows/ci.yml

@@ -12,66 +12,56 @@ on:
 
 jobs:
   check-license-headers:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Check license headers
       run: |
         ./hack/check-license-headers.sh
 
   rustfmt:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Install Rust toolchain
-      uses: actions-rs/toolchain@v1
-      with:
-        profile: minimal
-        toolchain: stable
-        override: true
-        components: rustfmt
+      run: |
+        rustup toolchain install stable --profile minimal --no-self-update --component rustfmt
+        rustup default stable
 
     - name: cargo fmt
-      uses: actions-rs/cargo@v1
-      with:
-        command: fmt
-        args: --all -- --check
+      run: cargo fmt --all -- --check
 
   clippy:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Install Rust toolchain
-      uses: actions-rs/toolchain@v1
-      with:
-        profile: minimal
-        toolchain: stable
-        override: true
-        components: clippy
+      run: |
+        rustup toolchain install stable --profile minimal --no-self-update --component clippy
+        rustup default stable
 
     - name: cargo clippy
-      uses: actions-rs/clippy-check@v1
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        args: --workspace --lib --bins --tests --all-targets -- -Dwarnings
+      run: cargo clippy --workspace --lib --bins --tests --all-targets -- -Dwarnings
 
   yamllint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: yamllint
-      uses: ibiqlik/[email protected]
+      run: |
+        pip install yamllint
+        yamllint .
 
   build-and-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     continue-on-error: ${{ matrix.continue-on-error }}
 
     strategy:
@@ -97,32 +87,28 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Retrieve cache
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: |
           ~/.cargo/registry
           ~/.cargo/git
           target
         key: ${{ runner.os }}-cargo-ci-${{ hashFiles('**/Cargo.lock') }}
     - name: Install Rust toolchain
-      uses: actions-rs/toolchain@v1
-      with:
-        profile: minimal
-        toolchain: ${{ matrix.rust }}
-        override: true
+      run: |
+        rustup toolchain install ${{ matrix.rust }} --profile minimal --no-self-update
+        rustup default ${{ matrix.rust }}
+        if [ -n "${{ matrix.target }}" ]; then
+          rustup target add ${{ matrix.target }}
+        fi
 
     - name: cargo build
-      uses: actions-rs/cargo@v1
-      with:
-        command: build
+      run: cargo build
       env:
         TARGET: ${{ matrix.target }}
     - name: cargo test
-      uses: actions-rs/cargo@v1
-      with:
-        command: test
-        args: -- --nocapture
+      run: cargo test -- --nocapture
       env:
         TARGET: ${{ matrix.target }}

.github/workflows/docker.yml

@@ -10,81 +10,162 @@ on:
     branches:
     - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
-  build-and-push-docker-image:
+  build-per-architecture:
     if: github.repository_owner == 'pitkley' && github.actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+        - platform: linux/amd64
+          runner: ubuntu-24.04
+          arch: amd64
+        - platform: linux/arm64
+          runner: ubuntu-24.04-arm
+          arch: arm64
+        - platform: linux/arm/v7
+          runner: ubuntu-24.04 #-arm
+          arch: armv7
 
     steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Set up QEMU
+      if: matrix.arch == 'armv7'
+      uses: docker/setup-qemu-action@v3
+      with:
+        platforms: arm
+
     - name: Set up Docker Buildx
-      id: buildx
-      uses: docker/setup-buildx-action@v1
+      uses: docker/setup-buildx-action@v3
 
-    - name: Setup connection to arm64-capable runner
-      run: |
-        echo "::group::ssh-agent: launch and export"
-        eval "$(ssh-agent)"
-        echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> $GITHUB_ENV
-        echo "SSH_AGENT_PID=$SSH_AGENT_PID" >> $GITHUB_ENV
-        echo "::endgroup::"
-
-        echo "::group::ssh-agent: load private key"
-        ssh-add - <<< "${{ secrets.ARMRUNNER1_SSH_PRIVATE_KEY }}"
-        echo "::endgroup::"
-
-        echo "::group::ssh: pin runner public key"
-        mkdir ~/.ssh && chmod 0700 ~/.ssh || :
-        echo "[${{ secrets.ARMRUNNER1_HOSTNAME }}]:${{ secrets.ARMRUNNER1_SSH_PORT }} ${{ secrets.ARMRUNNER1_SSH_HOSTKEY }}" > ~/.ssh/known_hosts
-        echo "::endgroup::"
-
-    - name: Register arm64-capable runner with Buildx
-      env:
-        DOCKER_HOST: ssh://github-actions@${{ secrets.ARMRUNNER1_HOSTNAME }}:${{ secrets.ARMRUNNER1_SSH_PORT }}
-      run: docker buildx create --append --name ${{ steps.buildx.outputs.name }} --bootstrap
+    - name: Login to ghcr.io
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.repository_owner }}
+        password: ${{ github.token }}
 
-    - name: Checkout
-      uses: actions/checkout@v2
+    - name: Build and push by digest to GHCR
+      id: build
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        platforms: ${{ matrix.platform }}
+        outputs: type=image,name=ghcr.io/pitkley/dfw,push-by-digest=true,name-canonical=true,push=true
+        cache-from: type=gha,scope=${{ github.repository }}-${{ github.ref_name }}-${{ matrix.platform }}
+        cache-to: type=gha,scope=${{ github.repository }}-${{ github.ref_name }}-${{ matrix.platform }}
 
-    - name: Prepare Docker image tags
-      id: docker-image-tags
-      uses: haya14busa/action-cond@v1
+    - name: Export digest
+      run: |
+        mkdir -p /tmp/digests
+        digest="${{ steps.build.outputs.digest }}"
+        touch "/tmp/digests/${digest#sha256:}"
+
+    - name: Upload digest
+      uses: actions/upload-artifact@v4
       with:
-        cond: ${{ github.event_name == 'push' }}
-        if_true: |
-          pitkley/dfw
-          ghcr.io/pitkley/dfw
-        if_false: |
-          ghcr.io/pitkley/dfw
-    - name: Prepare Docker image metadata
-      id: meta
-      uses: docker/metadata-action@v3
+        name: digests-${{ matrix.arch }}
+        path: /tmp/digests/*
+        if-no-files-found: error
+        retention-days: 1
+
+  merge-manifests:
+    if: github.repository_owner == 'pitkley' && github.actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    runs-on: ubuntu-24.04
+    needs: build-per-architecture
+
+    steps:
+    - name: Download digests
+      uses: actions/download-artifact@v4
       with:
-        images: ${{ steps.docker-image-tags.outputs.value }}
-        tags: |
-          type=ref,event=branch
-          type=ref,event=pr
-          type=semver,pattern={{version}}
-          type=semver,pattern={{major}}.{{minor}}
-          type=semver,pattern={{major}}
+        path: /tmp/digests
+        pattern: digests-*
+        merge-multiple: true
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
 
     - name: Login to Docker Hub
       if: github.event_name == 'push'
-      uses: docker/login-action@v1
+      uses: docker/login-action@v3
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_ACCESSTOKEN }}
+
     - name: Login to ghcr.io
-      uses: docker/login-action@v1
+      uses: docker/login-action@v3
       with:
         registry: ghcr.io
         username: ${{ github.repository_owner }}
         password: ${{ github.token }}
 
-    - name: Build and push Docker image
-      uses: docker/build-push-action@v2
+    - name: Prepare Docker image metadata
+      id: meta
+      uses: docker/metadata-action@v5
       with:
-        context: .
-        platforms: linux/amd64,linux/arm64,linux/arm/v7
-        push: true
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
+        images: |
+          ${{ github.event_name == 'push' && 'pitkley/dfw' || '' }}
+          ghcr.io/pitkley/dfw
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=semver,pattern={{version}}
+          type=semver,pattern={{major}}.{{minor}}
+          type=semver,pattern={{major}}
+
+    - name: Get execution timestamp with RFC3339 format
+      id: timestamp
+      run: |
+        echo "timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_OUTPUT
+
+    - name: Create manifest list and push to GHCR
+      working-directory: /tmp/digests
+      run: |
+        docker buildx imagetools create \
+          $(jq -cr '.tags | map(select(startswith("ghcr.io"))) | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          --annotation='index:org.opencontainers.image.description=${{ github.event.repository.description }}' \
+          --annotation='index:org.opencontainers.image.created=${{ steps.timestamp.outputs.timestamp }}' \
+          --annotation='index:org.opencontainers.image.source=${{ github.event.repository.html_url }}' \
+          $(printf 'ghcr.io/pitkley/dfw@sha256:%s ' *)
+
+    - name: Inspect GHCR image
+      run: |
+        docker buildx imagetools inspect ghcr.io/pitkley/dfw:${{ steps.meta.outputs.version }}
+
+    - name: Copy multi-arch image from GHCR to Docker Hub
+      if: github.event_name == 'push'
+      run: |
+        # Extract all Docker Hub tags from metadata
+        dockerhub_tags=$(jq -cr '.tags | map(select(startswith("pitkley/dfw"))) | .[]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
+
+        # Copy the merged image from GHCR to Docker Hub for each tag
+        for tag in $dockerhub_tags; do
+          echo "Copying to $tag"
+          docker buildx imagetools create \
+            --tag "$tag" \
+            ghcr.io/pitkley/dfw:${{ steps.meta.outputs.version }}
+        done
+
+    - name: Inspect Docker Hub image
+      if: github.event_name == 'push'
+      run: |
+        docker buildx imagetools inspect pitkley/dfw:${{ steps.meta.outputs.version }}