From 4af25c12d5edba0a48319c9a5ee0df83014f3232 Mon Sep 17 00:00:00 2001 From: Jeremy Bernard Date: Tue, 13 Oct 2026 11:10:17 +0200 Subject: [PATCH] chore(docker-build-cloud): remove docker-build-cloud workflow --- .github/workflows/docker-build-cloud.yml | 90 ------------------------ .release-please-manifest.json | 1 - README.md | 4 -- docker-build-cloud/CHANGELOG.md | 32 --------- docker-build-cloud/README.md | 75 -------------------- docker-build-cloud/version.txt | 1 - docker-build-cloud/workflow-sha256 | 1 - release-please-config.json | 4 -- scripts/check-release-please-config.sh | 2 +- 9 files changed, 1 insertion(+), 209 deletions(-) delete mode 100644 .github/workflows/docker-build-cloud.yml delete mode 100644 docker-build-cloud/CHANGELOG.md delete mode 100644 docker-build-cloud/README.md delete mode 100644 docker-build-cloud/version.txt delete mode 100644 docker-build-cloud/workflow-sha256 diff --git a/.github/workflows/docker-build-cloud.yml b/.github/workflows/docker-build-cloud.yml deleted file mode 100644 index a015299..0000000 --- a/.github/workflows/docker-build-cloud.yml +++ /dev/null @@ -1,90 +0,0 @@ -name: Build and Push Multi-Platform Docker Image via Docker Build Cloud - -on: - workflow_call: - inputs: - image-name: - description: "Name of Docker Image (fully qualified, e.g. 'iexechub/my-image')" - required: true - type: string - image-tag: - description: "Tag to apply to the built image (e.g. '1.0.0', no v prefix)" - required: true - type: string - platforms: - description: "Comma-separated build platforms (e.g. 'linux/amd64,linux/arm64')" - required: true - type: string - cloud-builder-endpoint: - description: "Docker Build Cloud endpoint, format '/'" - required: true - type: string - dockerfile: - description: "Path to the Dockerfile (e.g. './Dockerfile', './docker/Dockerfile')" - default: "Dockerfile" - type: string - context: - description: "Path to Docker Build Context" - default: "." - type: string - build-args: - description: - "Docker build arguments (multiline format: KEY1=value1\nKEY2=value2)" - default: "" - type: string - attest: - description: "Generate & sign a keyless SLSA build provenance attestation for the pushed image (the CALLER must grant id-token: write and attestations: write)" - default: false - type: boolean - secrets: - dockerhub-username: - description: "Username for Docker Hub authentication" - required: true - dockerhub-password: - description: "DockerHub PAT with Build scope (required to authenticate to Docker Build Cloud endpoint)" - required: true - -jobs: - build: - runs-on: ubuntu-latest - - steps: - - name: Checkout Repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - # Login MUST run before Set up Docker Buildx so the cloud driver can - # authenticate to the Docker Build Cloud endpoint via ~/.docker/config.json. - - name: Login to Docker Hub - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 - with: - username: ${{ secrets.dockerhub-username }} - password: ${{ secrets.dockerhub-password }} - - - name: Set up Docker Buildx (Docker Build Cloud) - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - with: - driver: cloud - endpoint: ${{ inputs.cloud-builder-endpoint }} - - - name: Build and push multi-platform image - id: build - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 - with: - build-args: ${{ inputs.build-args }} - context: ${{ inputs.context }} - file: ${{ inputs.dockerfile }} - platforms: ${{ inputs.platforms }} - push: true - tags: ${{ inputs.image-name }}:${{ inputs.image-tag }} - - # --- SLSA provenance attestation ----- - # Requires the permissions id-token: write + attestations: write. - - name: Generate & sign SLSA provenance (keyless) - if: ${{ inputs.attest }} - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 - with: - subject-name: ${{ inputs.image-name }} - subject-digest: ${{ steps.build.outputs.digest }} - push-to-registry: true diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 834de9b..3dbd377 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,7 +1,6 @@ { "conventional-commits": "1.2.3", "docker-build": "3.8.0", - "docker-build-cloud": "1.1.2", "docker-promote": "1.0.0", "java-build": "1.0.0", "propose-safe-multisig-tx": "1.1.3", diff --git a/README.md b/README.md index 739d716..5068b7e 100644 --- a/README.md +++ b/README.md @@ -8,10 +8,6 @@ This repository contains a comprehensive collection of reusable GitHub Actions w Validates that pull request titles follow the [Conventional Commits](https://www.conventionalcommits.org/) specification for better repository management. Ensures your commit history remains clean and meaningful for improved collaboration. -### ☁️ [Build Docker Image via Docker Build Cloud](./docker-build-cloud) - -Builds and pushes a multi-platform Docker image (e.g. `linux/amd64` + `linux/arm64`) to Docker Hub in a single job using Docker Build Cloud's remote builders. No QEMU emulation, no native ARM runners. - ### 🐳 [Build Docker Image](./docker-build) Automates the process of building, tagging, and pushing Docker images to Docker Hub. Perfect for projects that require containerization with minimal configuration overhead. diff --git a/docker-build-cloud/CHANGELOG.md b/docker-build-cloud/CHANGELOG.md deleted file mode 100644 index 99862ce..0000000 --- a/docker-build-cloud/CHANGELOG.md +++ /dev/null @@ -1,32 +0,0 @@ -# Changelog - -## [1.1.2](https://github.com/iExecBlockchainComputing/github-actions-workflows/compare/docker-build-cloud-v1.1.1...docker-build-cloud-v1.1.2) (2026-10-13) - - -### Bug Fixes - -* checkout with persist-credentials: false ([#181](https://github.com/iExecBlockchainComputing/github-actions-workflows/issues/181)) ([738ae7b](https://github.com/iExecBlockchainComputing/github-actions-workflows/commit/738ae7b79b6375b421ac1f5571e625482e78e161)) -* update third-party GitHub Actions ([#167](https://github.com/iExecBlockchainComputing/github-actions-workflows/issues/167)) ([396fc60](https://github.com/iExecBlockchainComputing/github-actions-workflows/commit/396fc60de4f14227e21a68d470bab7dd4d9b14f4)) - -## [1.1.1](https://github.com/iExecBlockchainComputing/github-actions-workflows/compare/docker-build-cloud-v1.1.0...docker-build-cloud-v1.1.1) (2026-09-04) - - -### Bug Fixes - -* pin third-party GitHub Actions to commit SHA ([#136](https://github.com/iExecBlockchainComputing/github-actions-workflows/issues/136)) ([a69a256](https://github.com/iExecBlockchainComputing/github-actions-workflows/commit/a69a25679b7d47df1256596f1fc9df0fdc38a8a8)) - -## [1.1.0](https://github.com/iExecBlockchainComputing/github-actions-workflows/compare/docker-build-cloud-v1.0.0...docker-build-cloud-v1.1.0) (2026-06-30) - - -### Features - -* add slsa attest to docker builds ([#126](https://github.com/iExecBlockchainComputing/github-actions-workflows/issues/126)) ([2fd65e3](https://github.com/iExecBlockchainComputing/github-actions-workflows/commit/2fd65e36f7e8dc548f8619e1cc290a2171e32210)) - -## 1.0.0 (2026-05-06) - - -### Features - -* add docker-build-cloud reusable workflow for multi-arch DockerHub publish ([#115](https://github.com/iExecBlockchainComputing/github-actions-workflows/issues/115)) ([895df3f](https://github.com/iExecBlockchainComputing/github-actions-workflows/commit/895df3f5220dcec4fcda4ad690c96409ae14a28d)) - -## Changelog diff --git a/docker-build-cloud/README.md b/docker-build-cloud/README.md deleted file mode 100644 index 09a4f6e..0000000 --- a/docker-build-cloud/README.md +++ /dev/null @@ -1,75 +0,0 @@ -# 🐳 Docker Build Cloud — Multi-Platform Workflow - -## 🔍 Overview - -This reusable GitHub Actions workflow builds and pushes a multi-platform Docker image to Docker Hub using [Docker Build Cloud](https://docs.docker.com/build-cloud/) remote builders. It produces a single multi-arch manifest (e.g. `linux/amd64` + `linux/arm64`) in one job, with no QEMU emulation and no native ARM runners required. - -## ✨ Features - -- 🏗️ Multi-platform build in a single job via Docker Build Cloud's remote builders -- 🔐 Authenticates to DockerHub for both registry push and DBC endpoint access -- 🏷️ Tags the image with `:` -- 🚀 No QEMU emulation, no native ARM runners — DBC handles arch-specific builds -- 📜 Generates & signs a keyless SLSA build provenance attestation (optional) - -> [!IMPORTANT] Requires a Docker Build Cloud subscription and a builder configured in your DockerHub organization. The DockerHub PAT must have the **Build** scope to authenticate to the cloud endpoint. - -## ⚙️ Inputs - -| Name | Description | Required | Default | -| --- | --- | --- | --- | -| `attest` | Generate & sign a keyless SLSA build provenance attestation for the pushed image (requires caller permissions, see notes) | No | `false` | -| `build-args` | Docker build arguments (multiline format: `KEY1=value1\nKEY2=value2`) | No | `""` | -| `cloud-builder-endpoint` | Docker Build Cloud endpoint, format `/` | Yes | - | -| `context` | Path to Docker Build Context | No | `"."` | -| `dockerfile` | Path to the Dockerfile (e.g. `'./Dockerfile'`, `'./docker/Dockerfile'`) | No | `"Dockerfile"` | -| `image-name` | Name of Docker Image, fully qualified (e.g. `iexechub/my-image`) | Yes | - | -| `image-tag` | Tag to apply to the built image (e.g. `1.0.0`, no v prefix) | Yes | - | -| `platforms` | Comma-separated build platforms (e.g. `linux/amd64,linux/arm64`) | Yes | - | - -## 🔐 Secrets - -| Name | Description | Required | -| --- | --- | --- | -| `dockerhub-username` | Username for Docker Hub authentication | Yes | -| `dockerhub-password` | Personal Access Token for Docker Hub with the **Build** scope (needed for DBC endpoint) | Yes | - -## 💻 Example Usage - -```yaml -name: Build and Push Release Image - -on: - push: - tags: - - "v*.*.*" - -jobs: - build-multiplatform: - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build-cloud.yml@main # ⚠️ use tagged version here - with: - image-name: iexechub/my-image - image-tag: ${{ github.ref_name }} - platforms: linux/amd64,linux/arm64 - cloud-builder-endpoint: ${{ vars.DOCKER_CLOUD_BUILDER_LABEL }} - secrets: - dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }} - dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }} -``` - -## 📝 Notes - -- 🔒 The DockerHub PAT must have the **Build** scope, not just Read/Write — DBC endpoints will return `403 Forbidden` otherwise. -- 🪪 The user owning the PAT must be a member of the cloud builder (Docker Hub → org → Build Cloud → builder → Members). -- 🔁 Login to DockerHub MUST run before `setup-buildx-action` — the cloud driver reads `~/.docker/config.json` at bootstrap. -- 📜 When `attest: true`, the **caller** workflow must grant the following permissions: - ```yaml - permissions: - id-token: write - attestations: write - ``` - -## 🛠️ Troubleshooting - -- **`403 Forbidden` on Set up Docker Buildx**: PAT missing Build scope, user not a member of the cloud builder, token owner not in the builder org, malformed endpoint, or inactive DBC subscription. -- **Manifest only contains one platform**: confirm `platforms` input lists every arch with commas (no spaces). diff --git a/docker-build-cloud/version.txt b/docker-build-cloud/version.txt deleted file mode 100644 index 45a1b3f..0000000 --- a/docker-build-cloud/version.txt +++ /dev/null @@ -1 +0,0 @@ -1.1.2 diff --git a/docker-build-cloud/workflow-sha256 b/docker-build-cloud/workflow-sha256 deleted file mode 100644 index d94e4b6..0000000 --- a/docker-build-cloud/workflow-sha256 +++ /dev/null @@ -1 +0,0 @@ -988d890cdfffa6499cf4793ee140f9ff19467560c60acdf133b505122fc76bde diff --git a/release-please-config.json b/release-please-config.json index b64e349..ba36324 100644 --- a/release-please-config.json +++ b/release-please-config.json @@ -17,10 +17,6 @@ "component": "docker-build", "extra-label": "docker-build" }, - "docker-build-cloud": { - "component": "docker-build-cloud", - "extra-label": "docker-build-cloud" - }, "docker-promote": { "component": "docker-promote", "extra-label": "docker-promote" diff --git a/scripts/check-release-please-config.sh b/scripts/check-release-please-config.sh index e9aa872..e35e330 100755 --- a/scripts/check-release-please-config.sh +++ b/scripts/check-release-please-config.sh @@ -99,7 +99,7 @@ else fi # --- tag format: must resolve to -vX.Y.Z tags --- -# Existing releases use e.g. docker-build-v2.5.2 / docker-build-cloud-v1.1.1; any +# Existing releases use e.g. docker-build-v2.5.2 / docker-promote-v1.0.0; any # deviation silently orphans tag matching and walks all history in the next run. tag_include_component=$(jq -r 'if has("include-component-in-tag") then ."include-component-in-tag" else true end' "$CONFIG") tag_include_v=$(jq -r 'if has("include-v-in-tag") then ."include-v-in-tag" else true end' "$CONFIG")