Skip to content
Bleeding Docker Image CI

Bleeding Docker Image CI #1266

Sign in to view logs

Bleeding Docker Image CI

Bleeding Docker Image CI #1266

Workflow file for this run

.github/workflows/bleeding.yml at a58a33f
name: Bleeding Docker Image CI
on:
push:
branches:
- main
pull_request:
schedule:
- cron: 0 4 * * *
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true
permissions:
contents: read
jobs:
bleeding:
runs-on: ubuntu-24.04
outputs:
weblate_sha: ${{ steps.get_sha.outputs.sha }}
weblate_date: ${{ steps.get_date.outputs.date }}
steps:
- id: get_sha
run: echo "sha=$(git ls-remote --quiet https://github.com/WeblateOrg/weblate.git HEAD | awk '{print $1}')" >> $GITHUB_OUTPUT
- id: get_date
run: echo "date=$(date --iso-8601=ns)" >> $GITHUB_OUTPUT
build:
runs-on: ubuntu-24.04
name: Build, bleeding, ${{ matrix.architecture }}
needs:
- bleeding
strategy:
matrix:
architecture: [linux/amd64]
env:
MATRIX_ARCHITECTURE: ${{ matrix.architecture }}
steps:
- uses: actions/checkout@v4
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Configure Docker build
run: .github/bin/get-buildx-args
- name: Build the Docker image
run: .github/bin/docker-build
buildx:
runs-on: ubuntu-24.04
name: Build, bleeding, ${{ matrix.architecture }}
needs:
- bleeding
strategy:
matrix:
architecture:
- linux/arm64
env:
MATRIX_ARCHITECTURE: ${{ matrix.architecture }}
steps:
- uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/[email protected]
with:
platforms: ${{ matrix.architecture }}
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Configure Docker build
run: .github/bin/get-buildx-args
- name: Build the Docker image
run: .github/bin/docker-build
test-basic:
runs-on: ubuntu-24.04
name: Test basic, bleeding
needs:
- bleeding
- build
env:
MATRIX_ARCHITECTURE: linux/amd64
COMPOSE_PROJECT_NAME: wl
PYTHONUNBUFFERED: 1
TEST_CONTAINER: weblate/weblate:test
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Build the Docker image
run: .github/bin/docker-build load
- name: List Docker images
run: docker image ls --all
- name: Generate configuration
run: |
cd docker-compose
./test-generate
- name: Startup container
run: |
cd docker-compose
./test-boot
- name: List Python packages
run: |
cd docker-compose
./test-pip
- name: Inspect container
run: |
cd docker-compose
./test-inspect
- name: Check service is running
run: |
cd docker-compose
./test-online
- name: Check service health status
run: |
cd docker-compose
./test-health
- name: Run Django Checks
run: |
cd docker-compose
./test-checks
- name: Verify supervisor
run: |
cd docker-compose
./test-supervisor
- name: Test admin creation
run: |
cd docker-compose
./test-admin
- name: Test commands
run: |
cd docker-compose
./test-commands
- name: Display logs
if: always()
run: |
cd docker-compose
./test-logs
- name: Stop Weblate service
run: |
cd docker-compose
docker compose stop weblate
- name: Start Weblate service
run: |
cd docker-compose
docker compose start weblate
- name: Check service is running
run: |
cd docker-compose
./test-online
- name: Shutdown service
run: |
cd docker-compose
./test-stop
test-novolume:
runs-on: ubuntu-24.04
name: Test novolume, bleeding
needs:
- bleeding
- build
- test-basic
env:
MATRIX_ARCHITECTURE: linux/amd64
COMPOSE_PROJECT_NAME: wl
PYTHONUNBUFFERED: 1
TEST_CONTAINER: weblate/weblate:test
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Build the Docker image
run: .github/bin/docker-build load
- name: List Docker images
run: docker image ls --all
- name: Generate configuration
run: |
cd docker-compose
./test-generate 8080 http read-write
- name: Startup container
run: |
cd docker-compose
./test-boot
- name: List Python packages
run: |
cd docker-compose
./test-pip
- name: Inspect container
run: |
cd docker-compose
./test-inspect
- name: Check service is running
run: |
cd docker-compose
./test-online
- name: Check service health status
run: |
cd docker-compose
./test-health
- name: Run Django Checks
run: |
cd docker-compose
./test-checks
- name: Verify supervisor
run: |
cd docker-compose
./test-supervisor
- name: Test admin creation
run: |
cd docker-compose
./test-admin
- name: Test commands
run: |
cd docker-compose
./test-commands
- name: Display logs
if: always()
run: |
cd docker-compose
./test-logs
- name: Stop Weblate service
run: |
cd docker-compose
docker compose stop weblate
- name: Start Weblate service
run: |
cd docker-compose
docker compose start weblate
- name: Check service is running
run: |
cd docker-compose
./test-online
- name: Shutdown service
run: |
cd docker-compose
./test-stop
test-saml:
runs-on: ubuntu-24.04
name: Test SAML, bleeding
needs:
- bleeding
- build
- test-basic
env:
MATRIX_ARCHITECTURE: linux/amd64
COMPOSE_PROJECT_NAME: wl
PYTHONUNBUFFERED: 1
TEST_CONTAINER: weblate/weblate:test
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Build the Docker image
run: .github/bin/docker-build load
- name: List Docker images
run: docker image ls --all
- name: Generate configuration
env:
TEST_EXTRA_ENV: 'WEBLATE_SAML_IDP_URL: https://example.com/idp'
run: |
cd docker-compose
./test-generate
- name: Startup container
run: |
cd docker-compose
./test-boot
- name: List Python packages
run: |
cd docker-compose
./test-pip
- name: Inspect container
run: |
cd docker-compose
./test-inspect
- name: Check service is running
run: |
cd docker-compose
./test-online
- name: Check service health status
run: |
cd docker-compose
./test-health
- name: Run Django Checks
run: |
cd docker-compose
./test-checks
- name: Verify supervisor
run: |
cd docker-compose
./test-supervisor
- name: Test admin creation
run: |
cd docker-compose
./test-admin
- name: Verify SAML certificate
run: |
cd docker-compose
./test-saml
- name: Display logs
if: always()
run: |
cd docker-compose
./test-logs
- name: Shutdown service
run: |
cd docker-compose
./test-stop
test-split:
runs-on: ubuntu-24.04
name: Test split, bleeding
needs:
- bleeding
- build
- test-basic
env:
MATRIX_ARCHITECTURE: linux/amd64
COMPOSE_PROJECT_NAME: wl
PYTHONUNBUFFERED: 1
TEST_CONTAINER: weblate/weblate:test
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Build the Docker image
run: .github/bin/docker-build load
- name: List Docker images
run: docker image ls --all
- name: Generate configuration
run: |
cd docker-compose
./test-generate 8080 http split
- name: Startup container
run: |
cd docker-compose
./test-boot
- name: List Python packages
run: |
cd docker-compose
./test-pip
- name: Inspect container
run: |
cd docker-compose
./test-inspect
- name: Check service is running
run: |
cd docker-compose
./test-online
- name: Check service health status
run: |
cd docker-compose
./test-health
- name: Run Django Checks
run: |
cd docker-compose
./test-checks
- name: Verify supervisor
run: |
cd docker-compose
./test-supervisor
- name: Test admin creation
run: |
cd docker-compose
./test-admin
- name: Display logs
if: always()
run: |
cd docker-compose
./test-logs
- name: Shutdown service
run: |
cd docker-compose
./test-stop
test-single-celery:
runs-on: ubuntu-24.04
name: Test single celery process, bleeding
needs:
- bleeding
- build
- test-basic
env:
MATRIX_ARCHITECTURE: linux/amd64
COMPOSE_PROJECT_NAME: wl
PYTHONUNBUFFERED: 1
TEST_CONTAINER: weblate/weblate:test
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Build the Docker image
run: .github/bin/docker-build load
- name: List Docker images
run: docker image ls --all
- name: Generate configuration
run: |
cd docker-compose
./test-generate 8080 http split
- name: Startup container
run: |
cd docker-compose
./test-boot
- name: List Python packages
run: |
cd docker-compose
./test-pip
- name: Inspect container
run: |
cd docker-compose
./test-inspect
- name: Check service is running
run: |
cd docker-compose
./test-online
- name: Check service health status
run: |
cd docker-compose
./test-health
- name: Run Django Checks
run: |
cd docker-compose
./test-checks
- name: Verify supervisor
run: |
cd docker-compose
./test-supervisor
- name: Test admin creation
run: |
cd docker-compose
./test-admin
- name: Display logs
if: always()
run: |
cd docker-compose
./test-logs
- name: Shutdown service
run: |
cd docker-compose
./test-stop
test-ssl:
runs-on: ubuntu-24.04
name: Test SSL, bleeding
needs:
- bleeding
- build
- test-basic
env:
MATRIX_ARCHITECTURE: linux/amd64
COMPOSE_PROJECT_NAME: wl
PYTHONUNBUFFERED: 1
TEST_CONTAINER: weblate/weblate:test
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Build the Docker image
run: .github/bin/docker-build load
- name: List Docker images
run: docker image ls --all
- name: Generate configuration
run: |
cd docker-compose
./test-generate 4443 https
- name: Generate SSL certificate
run: |
cd docker-compose
docker compose up --no-start
VOLUMEPATH=$(docker volume inspect -f '{{.Mountpoint}}' wl_weblate-data)
sudo mkdir -p $VOLUMEPATH/ssl
sudo openssl req -x509 -nodes -days 365 -subj "/CN=localhost" -newkey rsa:2048 -keyout $VOLUMEPATH/ssl/privkey.pem -out $VOLUMEPATH/ssl/fullchain.pem
sudo chown -R 1000:1000 $VOLUMEPATH/ssl
- name: Startup container
run: |
cd docker-compose
./test-boot
- name: List Python packages
run: |
cd docker-compose
./test-pip
- name: Inspect container
run: |
cd docker-compose
./test-inspect
- name: Check service is running
run: |
cd docker-compose
./test-online
- name: Check service health status
run: |
cd docker-compose
./test-health
- name: Run Django Checks
run: |
cd docker-compose
./test-checks
- name: Verify supervisor
run: |
cd docker-compose
./test-supervisor
- name: Test admin creation
run: |
cd docker-compose
./test-admin
- name: Display logs
if: always()
run: |
cd docker-compose
./test-logs
- name: Shutdown service
run: |
cd docker-compose
./test-stop
anchore:
runs-on: ubuntu-24.04
name: Anchore Container Scan
needs:
- bleeding
- build
permissions:
security-events: write
env:
MATRIX_ARCHITECTURE: linux/amd64
steps:
- uses: actions/checkout@v4
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Build the Docker image
run: .github/bin/docker-build load
- name: List Docker images
run: docker image ls --all
- name: Checkout the code
uses: actions/checkout@v4
- name: Anchore scan action
uses: anchore/scan-action@v5
id: scan
with:
image: weblate/weblate:test
fail-build: false
- name: Upload Anchore Scan Report
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ steps.scan.outputs.sarif }}
trivy:
runs-on: ubuntu-24.04
name: Trivy Container Scan
needs:
- bleeding
- build
permissions:
security-events: write
env:
MATRIX_ARCHITECTURE: linux/amd64
steps:
- uses: actions/checkout@v4
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Build the Docker image
run: .github/bin/docker-build load
- name: List Docker images
run: docker image ls --all
- name: Checkout the code
uses: actions/checkout@v4
- name: Run Trivy vulnerability scanner
uses: aquasecurity/[email protected]
env:
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
with:
image-ref: weblate/weblate:test
format: template
template: '@/contrib/sarif.tpl'
output: trivy-results.sarif
severity: CRITICAL,HIGH
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: trivy-results.sarif
- uses: actions/upload-artifact@v4
with:
name: Trivy scan SARIF
path: trivy-results.sarif
merge:
runs-on: ubuntu-24.04
name: Merge images
needs:
- build
- buildx
- bleeding
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/[email protected]
with:
platforms: all
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Configure Docker build
run: .github/bin/get-buildx-args
- name: Merge the Docker images
run: .github/bin/docker-build
push_dockerhub:
runs-on: ubuntu-24.04
name: Publish to Docker Hub, stable
needs:
- test-basic
- test-saml
- test-split
- test-single-celery
- test-novolume
- test-ssl
- buildx
- anchore
- trivy
- merge
- bleeding
if: ${{ (startsWith(github.ref, 'refs/tags/') || (github.ref == 'refs/heads/main')) && github.repository == 'WeblateOrg/docker' }}
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/[email protected]
with:
platforms: all
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: DockerHub login
run: echo "${{ secrets.DOCKERHUB_ACCESS_TOKEN }}" | docker login --username "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Configure Docker build
run: .github/bin/get-buildx-args publish-bleeding
- name: Publish the Docker images
run: .github/bin/docker-build publish-bleeding
push_github:
runs-on: ubuntu-24.04
name: Publish to GitHub, stable
permissions:
packages: write
needs:
- test-basic
- test-saml
- test-split
- test-single-celery
- test-novolume
- test-ssl
- buildx
- anchore
- trivy
- merge
- bleeding
if: ${{ (startsWith(github.ref, 'refs/tags/') || (github.ref == 'refs/heads/main')) && github.repository == 'WeblateOrg/docker' }}
env:
DOCKER_IMAGE: ghcr.io/weblateorg/weblate
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/[email protected]
with:
platforms: all
- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
# renovate: datasource=github-releases depName=docker/buildx
version: v0.18.0
- name: Login to GitHub Container Registry
if: ${{ github.event_name != 'pull_request'}}
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Adjust bleeding edge image
run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}} ${{needs.bleeding.outputs.weblate_date}}
- name: Configure Docker build
run: .github/bin/get-buildx-args publish-bleeding
- name: Publish the Docker images
run: .github/bin/docker-build publish-bleeding