ci.yml

name: ci

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  schedule:
    - cron: '0 8 */6 * *' # every 6 days
  workflow_dispatch:
  push:
    branches:
      - master
  pull_request:

env:
  REPO_SLUG: tonistiigi/binfmt
  CACHE_GHA_SCOPE: binfmt
  CACHE_GHA_SCOPE_CROSS: binfmt-cross

jobs:
  prepare:
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        target:
          - mainline
          - buildkit
          - desktop
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Expose GitHub Runtime
        uses: crazy-max/ghaction-github-runtime@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Warm cache
        run: |
          ./hack/warm-cache ${{ matrix.target }}
        env:
          CACHE_FROM: type=gha,scope=${{ env.CACHE_GHA_SCOPE }}-${{ matrix.target }}
          CACHE_TO: type=gha,scope=${{ env.CACHE_GHA_SCOPE }}-${{ matrix.target }}

  validate:
    runs-on: ubuntu-24.04
    needs:
      - prepare
    strategy:
      fail-fast: false
      matrix:
        script:
          - ./hack/lint
          - ./hack/validate-vendor
          - ./hack/install-and-test
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Expose GitHub Runtime
        uses: crazy-max/ghaction-github-runtime@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Run
        run: |
          ${{ matrix.script }}
        env:
          CACHE_FROM: type=gha,scope=${{ env.CACHE_GHA_SCOPE }}-mainline

  test:
    runs-on: ubuntu-24.04
    needs:
      - prepare
    strategy:
      fail-fast: false
      matrix:
        target:
          - mainline
          - buildkit
          - desktop
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Test buildkit
        if: matrix.target == 'buildkit'
        uses: docker/bake-action@v5
        with:
          targets: buildkit-test
          set: |
            *.cache-from=type=gha,scope=${{ env.CACHE_GHA_SCOPE }}-${{ matrix.target }}
      -
        name: Load mainline for testing
        if: matrix.target == 'mainline'
        uses: docker/bake-action@v5
        with:
          targets: mainline
          load: true
          set: |
            *.cache-from=type=gha,scope=${{ env.CACHE_GHA_SCOPE }}-${{ matrix.target }}
            mainline.tags=tonistiigi/binfmt:test
      -
        name: Test mainline
        if: matrix.target == 'mainline'
        run: |
          docker run --rm --privileged tonistiigi/binfmt:test --uninstall qemu-*
          docker run --rm --privileged tonistiigi/binfmt:test --install all
          docker run --rm --platform linux/arm64 alpine uname -a
          docker run --rm --platform linux/arm/v7 alpine uname -a
          docker run --rm --platform linux/ppc64le alpine uname -a
          docker run --rm --platform linux/s390x alpine uname -a
          docker run --rm --platform linux/riscv64 alpine uname -a
          docker run --rm --platform linux/loong64 registry.alpinelinux.org/img/alpine uname -a
          docker run --rm --platform linux/s390x ubuntu apt update
          docker run --rm --platform linux/ppc64le ubuntu apt update
          docker run --rm --platform linux/arm64 ubuntu apt update
      -
        name: Test Syscalls
        if: matrix.target == 'mainline'
        run: |
          set -x
          docker buildx build --platform=linux/amd64,linux/arm64,linux/386,linux/arm,linux/ppc64le,linux/s390x --target=run --allow security.insecure --build-arg CONFIG_RT_GROUP_SCHED=false ./test

  e2e:
    runs-on: ubuntu-24.04
    needs:
      - prepare
    strategy:
      fail-fast: false
      matrix:
        target:
          - mainline
          - desktop
        dockerfile:
          - pip-youtube-dl
          - webpack
        platform:
          - linux/arm/v7
        include:
          - target: mainline
            dockerfile: libc-bin
            platform: linux/arm64
          - target: desktop
            dockerfile: tini
            platform: linux/arm64
            run_args: --rm
          - target: desktop
            dockerfile: postgis
            platform: linux/arm64
            run_args: -d --name postgis
            logs_ctn_name: postgis
            logs_check: "UTC [1] LOG:  database system is ready to accept connections"
    steps:
      - name: Prepare
        run: |
          if [ "$RUNNER_DEBUG" = "1" ]; then
            echo "QEMU_STRACE=1" >> $GITHUB_ENV
          fi
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Load for testing
        uses: docker/bake-action@v5
        with:
          targets: ${{ matrix.target }}
          load: true
          set: |
            *.cache-from=type=gha,scope=${{ env.CACHE_GHA_SCOPE }}-${{ matrix.target }}
            *.tags=tonistiigi/binfmt:test
      -
        name: Set up QEMU
        run: |
          docker run --privileged --rm tonistiigi/binfmt --uninstall qemu-*
          docker run --rm --privileged tonistiigi/binfmt:test --install all
      -
        name: Test
        working-directory: test/dockerfiles/${{ matrix.dockerfile }}
        run: |
          docker buildx build --build-arg QEMU_STRACE --platform ${{ matrix.platform }} --output type=cacheonly .
      -
        name: Load image
        if: ${{ matrix.run_args != '' }}
        working-directory: test/dockerfiles/${{ matrix.dockerfile }}
        run: |
          docker buildx build --build-arg QEMU_STRACE --platform ${{ matrix.platform }} -t ${{ matrix.dockerfile }}:local --load .
      -
        name: Run
        if: ${{ matrix.run_args != '' }}
        working-directory: test/dockerfiles/${{ matrix.dockerfile }}
        run: |
          docker run ${{ matrix.run_args }} --env QEMU_STRACE --platform ${{ matrix.platform }} ${{ matrix.dockerfile }}:local
      -
        name: Check container logs
        if: ${{ matrix.logs_ctn_name != '' && matrix.logs_check != '' }}
        uses: crazy-max/.github/.github/actions/container-logs-check@main
        with:
          container_name: ${{ matrix.logs_ctn_name }}
          log_check: ${{ matrix.logs_check }}
          timeout: 120

  prepare-build:
    runs-on: ubuntu-24.04
    outputs:
      matrix: ${{ steps.platforms.outputs.matrix }}
    strategy:
      fail-fast: false
      matrix:
        target:
          - mainline
          - buildkit
          - desktop
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Create matrix
        id: platforms
        run: |
          echo "matrix=$(docker buildx bake ${{ matrix.target }}-all --print | jq -cr '.target."${{ matrix.target }}-all".platforms')" >>${GITHUB_OUTPUT}
      -
        name: Show matrix
        run: |
          echo ${{ steps.platforms.outputs.matrix }}
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REPO_SLUG }}
          tags: |
            type=ref,event=branch,enable=${{ matrix.target == 'mainline' }}
            type=ref,event=branch,prefix=${{ matrix.target }}-,enable=${{ matrix.target != 'mainline' }}
          flavor: |
            latest=false
          labels: |
            org.opencontainers.image.title=Binfmt
            org.opencontainers.image.description=Cross-platform emulator collection distributed with Docker images
          bake-target: meta-helper
      -
        name: Rename meta bake definition file
        run: |
          mv "${{ steps.meta.outputs.bake-file }}" "${{ runner.temp }}/bake-meta.json"
      -
        name: Upload meta bake definition
        uses: actions/upload-artifact@v4
        with:
          name: bake-meta-${{ matrix.target }}
          path: ${{ runner.temp }}/bake-meta.json
          if-no-files-found: error
          retention-days: 1

  build:
    runs-on: ubuntu-24.04
    needs:
      - validate
      - test
      - e2e
      - prepare-build
    strategy:
      fail-fast: false
      matrix:
        target:
          - mainline
          - buildkit
          - desktop
        platform: ${{ fromJson(needs.prepare-build.outputs.matrix) }}
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Prepare
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
      -
        name: Download meta bake definition
        uses: actions/download-artifact@v4
        with:
          name: bake-meta-${{ matrix.target }}
          path: ${{ runner.temp }}
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-config: .github/buildkit.toml
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      -
        name: Login to DockerHub
        if: startsWith(github.ref, 'refs/heads/')
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERIO_USERNAME }}
          password: ${{ secrets.DOCKERIO_PASSWORD }}
      -
        name: Build
        id: bake
        uses: docker/bake-action@v5
        with:
          files: |
            ./docker-bake.hcl
            ${{ steps.meta.outputs.bake-file }}
          targets: ${{ matrix.target }}-all
          set: |
            *.tags=
            *.platform=${{ matrix.platform }}
            *.output=type=image,"name=${{ env.REPO_SLUG }}",push-by-digest=true,name-canonical=true,push=${{ startsWith(github.ref, 'refs/heads/') }}
            *.cache-from=type=gha,scope=${{ env.CACHE_GHA_SCOPE }}-${{ matrix.target }}
            *.cache-from=type=gha,scope=${{ env.CACHE_GHA_SCOPE_CROSS }}-${{ matrix.target }}-${{ env.PLATFORM_PAIR }}
            *.cache-to=type=gha,scope=${{ env.CACHE_GHA_SCOPE_CROSS }}-${{ matrix.target }}-${{ env.PLATFORM_PAIR }}
      -
        name: Export digest
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const path = require('path');
            const digestsDir = '${{ runner.temp }}/digests';
            if (!fs.existsSync(digestsDir)) {
              fs.mkdirSync(digestsDir, { recursive: true });
            }
            const metadata = JSON.parse(process.env.BAKE_METADATA);
            const digest = metadata[`${{ matrix.target }}-all`]['containerimage.digest'];
            const digestFile = path.join(digestsDir, digest.replace('sha256:', ''));
            fs.closeSync(fs.openSync(digestFile, 'w'));
        env:
          BAKE_METADATA: ${{ steps.bake.outputs.metadata }}
      -
        name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ matrix.target }}-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    runs-on: ubuntu-24.04
    if: startsWith(github.ref, 'refs/heads/')
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        target:
          - mainline
          - buildkit
          - desktop
    steps:
      -
        name: Download meta bake definition
        uses: actions/download-artifact@v4
        with:
          name: bake-meta-${{ matrix.target }}
          path: ${{ runner.temp }}
      -
        name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-${{ matrix.target }}-*
          merge-multiple: true
      -
        name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERIO_USERNAME }}
          password: ${{ secrets.DOCKERIO_PASSWORD }}
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
          docker buildx imagetools create $(jq -cr '.target."meta-helper".tags | map(select(startswith("${{ env.REPO_SLUG }}")) | "-t " + .) | join(" ")' ${{ runner.temp }}/bake-meta.json) \
            $(printf '${{ env.REPO_SLUG }}@sha256:%s ' *)
      -
        name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ env.REPO_SLUG }}:$(jq -r '.target."meta-helper".args.DOCKER_META_VERSION' ${{ runner.temp }}/bake-meta.json)