Skip to content

ci(docker): also publish -shadow image variants #508

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MegaRedHand merged 3 commits into from
Jul 8, 2026
Merged

ci(docker): also publish -shadow image variants #508

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
20399f5
ci(docker): also publish -shadow image variants
MegaRedHand Jul 8, 2026
4b28f1f
ci(docker): document shadow build non-reproducibility and manifest sync
MegaRedHand Jul 8, 2026
658cc95
Merge branch 'main' into worktree-stateless-chasing-papert
pablodeymo Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 49 additions & 21 deletions .github/workflows/docker_publish.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,15 +27,33 @@ env:

jobs:
build-image:
name: Build Docker image (${{ matrix.arch }})
name: Build Docker image (${{ matrix.arch.name }}, ${{ matrix.variant.name }})
strategy:
matrix:
include:
arch:
- runner: ubuntu-latest
arch: amd64
name: amd64
- runner: ubuntu-22.04-arm
arch: arm64
runs-on: ${{ matrix.runner }}
name: arm64
# Each tag is published twice: once as the regular image and once as a
# Shadow-simulator-compatible image (tag suffixed "-shadow"). The shadow
# build args mirror the `shadow-docker-build` Makefile target. LOCKED=
# builds the shadow variant unlocked (the quinn-udp [patch] is absent
# from Cargo.lock; see Dockerfile), so -shadow images are not
# reproducible and should not be treated as equivalent-security
# artifacts to the regular tags.
variant:
- name: default
suffix: ""
build_args: ""
- name: shadow
suffix: "-shadow"
build_args: |
SHADOW=1
FEATURES=shadow-integration
NO_DEFAULT_FEATURES=--no-default-features
LOCKED=
runs-on: ${{ matrix.arch.runner }}

steps:
- name: Checkout repository
Expand All @@ -53,11 +71,14 @@ jobs:

- name: Prepare tags
id: prep
env:
SUFFIX: ${{ matrix.variant.suffix }}
ARCH: ${{ matrix.arch.name }}
run: |
TAGS=""
IFS=',' read -ra TAG_ARRAY <<< "${TAGS_INPUT}"
for t in "${TAG_ARRAY[@]}"; do
TAGS="${TAGS}${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}-${{ matrix.arch }},"
TAGS="${TAGS}${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${SUFFIX}-${ARCH},"
done
TAGS="${TAGS%,}" # Remove trailing comma
echo "tags=${TAGS}" >> $GITHUB_OUTPUT
Expand All @@ -70,11 +91,12 @@ jobs:
build-args: |
GIT_COMMIT=${{ github.sha }}
GIT_BRANCH=${{ github.ref_name }}
${{ matrix.variant.build_args }}
push: true
tags: ${{ steps.prep.outputs.tags }}
platforms: linux/${{ matrix.arch }}
cache-from: type=gha,scope=${{ matrix.arch }}
cache-to: type=gha,scope=${{ matrix.arch }},mode=max
platforms: linux/${{ matrix.arch.name }}
cache-from: type=gha,scope=${{ matrix.arch.name }}-${{ matrix.variant.name }}
cache-to: type=gha,scope=${{ matrix.arch.name }}-${{ matrix.variant.name }},mode=max

publish-manifest:
name: Create and push multi-arch manifest
Expand All @@ -95,18 +117,24 @@ jobs:
run: |
IFS=',' read -ra TAG_ARRAY <<< "${TAGS_INPUT}"
FIRST_TAG="${TAG_ARRAY[0]}"
SHORT="${SHORT_SHA::7}"

# Create manifest for first tag with SHA tag
docker buildx imagetools create \
-t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG} \
-t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${SHORT_SHA::7} \
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG}-amd64 \
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG}-arm64

# Create manifests for remaining tags
for t in "${TAG_ARRAY[@]:1}"; do
# Publish each tag twice: the regular image and its "-shadow" twin.
# These suffixes must stay in sync with the `variant` matrix suffixes
# in the build-image job above: a new variant must be added in both.
for suffix in "" "-shadow"; do
# First tag also gets an immutable sha-<sha> tag.
docker buildx imagetools create \
-t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t} \
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}-amd64 \
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}-arm64
-t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG}${suffix} \
-t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${SHORT}${suffix} \
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG}${suffix}-amd64 \
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG}${suffix}-arm64

# Remaining tags.
for t in "${TAG_ARRAY[@]:1}"; do
docker buildx imagetools create \
-t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${suffix} \
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${suffix}-amd64 \
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${suffix}-arm64
done
Comment on lines +125 to +139

@greptile-apps greptile-apps Bot Jul 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Hardcoded suffix loop decoupled from build matrix

The manifest job iterates for suffix in "" "-shadow" rather than deriving suffixes from the build matrix. If a third variant is added to the variant: list in build-image, the build will push per-arch images for it but the manifest step will silently skip creating the multi-arch manifest for that variant. The two lists need to be kept in sync manually.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/docker_publish.yaml
Line: 119-133

Comment:
**Hardcoded suffix loop decoupled from build matrix**

The manifest job iterates `for suffix in "" "-shadow"` rather than deriving suffixes from the build matrix. If a third variant is added to the `variant:` list in `build-image`, the build will push per-arch images for it but the manifest step will silently skip creating the multi-arch manifest for that variant. The two lists need to be kept in sync manually.

How can I resolve this? If you propose a fix, please make it concise.

done