Rework GitHub Release and Docker Actions

The universal goal is to make those actions available in forks,
remove some cumbersome scripts and unnecessary steps, enable
arm64 build and upload to ghcr.io as an alternative container
registry.

Signed-off-by: Jiaxun Yang <[email protected]>

Author: FlyGoat

.github/workflows/docker.yml

@@ -9,6 +9,11 @@ on:
 jobs:
   ubuntu:
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
     steps:
     - name: Print environment
       shell: bash
@@ -18,6 +23,8 @@ jobs:
     - uses: actions/setup-python@v5
       with:
         python-version: '3.10'
+        cache: 'pip'
+
     - name: Install dependencies
       run: python3 -m pip install -r docker/requirements.txt
     - name: Install opengrok-tools so that pylint can perform the checks
@@ -33,18 +40,46 @@ jobs:
       run: black --check docker/*.py
     - name: Run isort in check mode
       run: isort --settings-file docker/.isort.cfg docker/*.py  --check --diff
-    - name: Build and optionally push Docker image
-      env:
-        DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-        OPENGROK_REPO_SLUG: ${{ github.repository }}
-        OPENGROK_REF: ${{ github.ref }}
-      run: ./dev/docker.sh
-    - name: Install Python pre-requisites
-      run: python3 -m pip install requests
-    - name: Optionally update README on Docker hub
-      env:
-        OPENGROK_REPO_SLUG: ${{ github.repository }}
-        DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-      run: ./dev/dockerhub_readme.py
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.repository_owner }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v3
+      if: ${{ vars.DOCKER_SLUG != '' }} && ${{ github.event_name != 'pull_request' }}
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+    - name: Extract metadata (tags, labels) for Docker
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: |
+          ${{ vars.DOCKER_SLUG }}
+          ghcr.io/${{ github.repository }}
+        labels: |
+          maintainer="https://github.com/oracle/opengrok"
+          org.opencontainers.image.description="OpenGrok Code Search"
+        tags: |
+          type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+          type=raw,value=master,enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+          type=pep440,pattern={{version}},enable=${{ github.event_name == 'release' }}
+          type=pep440,pattern={{major}}.{{minor}},enable=${{ github.event_name == 'release' }}
+          type=ref,event=branch
+          type=ref,event=pr
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Build and push Docker image
+      id: push
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile
+        platforms: linux/amd64,linux/arm64
+        push: ${{ github.event_name == 'release' || (github.event_name == 'push' && github.ref == 'refs/heads/master') }}
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}

.github/workflows/dockerhub-description.yml

@@ -0,0 +1,22 @@
+name: Update Docker Hub Description
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - docker/README.md
+      - .github/workflows/dockerhub-description.yml
+jobs:
+  dockerHubDescription:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Docker Hub Description
+      if: ${{ vars.DOCKER_SLUG != '' }}
+      uses: peter-evans/dockerhub-description@v4
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+        repository: ${{ vars.DOCKER_SLUG }}
+        readme-filepath: ./docker/README.md

.github/workflows/release.yml

@@ -1,27 +1,12 @@
 name: Release
 
-# TODO: run this only for the oracle/opengrok repository
 on:
   release:
     types: [created]
 
 jobs:
-  get_tag:
-    name: Get tag name
-    outputs:
-      tag: ${{ steps.get_tag.outputs.tag }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout master branch
-        uses: actions/checkout@v4
-      - name: Get the tag name
-        id: get_tag
-        env:
-          OPENGROK_REF: ${{ github.ref }}
-        run: ./dev/ref2tag.sh
   build:
     runs-on: ubuntu-latest
-    needs: get_tag
     steps:
     - name: Checkout master branch
       uses: actions/checkout@v4
@@ -47,18 +32,13 @@ jobs:
       run: ./dev/before
     - name: Build
       run: ./mvnw -DskipTests=true -Dmaven.javadoc.skip=false -B -V package
-    - name: Get upload URL
-      id: get_upload_url
-      env:
-        OPENGROK_TAG: ${{ needs.get_tag.outputs.tag }}
-      run: dev/get_upload_url.sh
     - name: Upload release tarball
       id: upload-release-asset
       uses: actions/upload-release-asset@v1
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
-        upload_url: ${{ steps.get_upload_url.outputs.upload_url }}
-        asset_path: ./distribution/target/opengrok-${{ needs.get_tag.outputs.tag }}.tar.gz
-        asset_name: opengrok-${{ needs.get_tag.outputs.tag }}.tar.gz
-        asset_content_type: application/octet-stream
+        upload_url: ${{ github.event.release.upload_url }}
+        asset_path: ./distribution/target/opengrok-${{ github.event.release.tag_name }}.tar.gz
+        asset_name: opengrok-${{ github.event.release.tag_name }}.tar.gz
+        asset_content_type: application/gzip