Merge pull request #1161 from bahe-msft/copilot/1160-issue-fix

Pangjiping · web-flow · commit 753ee45fe3c1 · 2026-07-02T09:13:07.000+08:00
feat: adding ghcr image publish support
diff --git a/.github/workflows/kubernetes-nightly-build.yml b/.github/workflows/kubernetes-nightly-build.yml
@@ -2,6 +2,7 @@ name: Kubernetes nightly build (Monorepo)
 
 permissions:
   contents: read
+  packages: write
 
 on:
   workflow_dispatch:
@@ -155,10 +156,18 @@ jobs:
           username: ${{ secrets.ACR_USERNAME }}
           password: ${{ secrets.ACR_PASSWORD }}
 
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Build and push (TAG=latest)
         working-directory: ${{ matrix.workdir }}
         run: |
           export TAG=latest
+          export GHCR_REPO="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/opensandbox"
           if [ -n "${{ matrix.k8s_component }}" ]; then
             export COMPONENT="${{ matrix.k8s_component }}"
           fi
diff --git a/.github/workflows/publish-components.yml b/.github/workflows/publish-components.yml
@@ -7,6 +7,7 @@ permissions:
   id-token: write
   attestations: write
   artifact-metadata: write
+  packages: write
 
 on:
   workflow_dispatch:
@@ -68,6 +69,13 @@ jobs:
           username: ${{ secrets.ACR_USERNAME }}
           password: ${{ secrets.ACR_PASSWORD }}
 
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Parse tag and set variables
         id: parse_tag
         run: |
@@ -127,6 +135,7 @@ jobs:
 
           export TAG=$IMAGE_TAG
           export COMPONENT=$COMPONENT
+          export GHCR_REPO="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/opensandbox"
           chmod +x build.sh
           ./build.sh
 
@@ -140,16 +149,18 @@ jobs:
           echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
           echo "dockerhub_image=docker.io/opensandbox/$COMPONENT" >> "$GITHUB_OUTPUT"
           echo "acr_image=sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/$COMPONENT" >> "$GITHUB_OUTPUT"
+          echo "ghcr_image=$GHCR_REPO/$COMPONENT" >> "$GITHUB_OUTPUT"
 
       - name: Sign release images
         if: github.ref_type == 'tag' && steps.parse_tag.outputs.image_tag != 'latest' && steps.parse_tag.outputs.image_tag != ''
         env:
           DIGEST: ${{ steps.build.outputs.digest }}
           DOCKERHUB_IMAGE: ${{ steps.build.outputs.dockerhub_image }}
           ACR_IMAGE: ${{ steps.build.outputs.acr_image }}
+          GHCR_IMAGE: ${{ steps.build.outputs.ghcr_image }}
         run: |
           set -euo pipefail
-          cosign sign --yes "${DOCKERHUB_IMAGE}@${DIGEST}" "${ACR_IMAGE}@${DIGEST}"
+          cosign sign --yes "${DOCKERHUB_IMAGE}@${DIGEST}" "${ACR_IMAGE}@${DIGEST}" "${GHCR_IMAGE}@${DIGEST}"
 
       - name: Attest Docker Hub image
         if: github.ref_type == 'tag' && steps.parse_tag.outputs.image_tag != 'latest' && steps.parse_tag.outputs.image_tag != ''
@@ -169,6 +180,15 @@ jobs:
           push-to-registry: true
           create-storage-record: false
 
+      - name: Attest GHCR image
+        if: github.ref_type == 'tag' && steps.parse_tag.outputs.image_tag != 'latest' && steps.parse_tag.outputs.image_tag != ''
+        uses: actions/attest@v4
+        with:
+          subject-name: ${{ steps.build.outputs.ghcr_image }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
+          create-storage-record: false
+
       - name: Bump component version in repo
         if: steps.parse_tag.outputs.image_tag != 'latest' && steps.parse_tag.outputs.image_tag != ''
         env:
diff --git a/.github/workflows/publish-server.yml b/.github/workflows/publish-server.yml
@@ -10,6 +10,7 @@ permissions:
   id-token: write
   attestations: write
   artifact-metadata: write
+  packages: write
 
 jobs:
   publish-pypi:
@@ -76,6 +77,13 @@ jobs:
           username: ${{ secrets.ACR_USERNAME }}
           password: ${{ secrets.ACR_PASSWORD }}
 
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Parse tag and set variables
         id: parse_tag
         run: |
@@ -103,6 +111,7 @@ jobs:
           TAG: ${{ steps.parse_tag.outputs.image_tag }}
           BUILD_METADATA_FILE: ${{ runner.temp }}/opensandbox-server-image-metadata.json
         run: |
+          export GHCR_REPO="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/opensandbox"
           chmod +x build.sh
           ./build.sh
 
@@ -116,16 +125,18 @@ jobs:
           echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
           echo "dockerhub_image=docker.io/opensandbox/server" >> "$GITHUB_OUTPUT"
           echo "acr_image=sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/server" >> "$GITHUB_OUTPUT"
+          echo "ghcr_image=$GHCR_REPO/server" >> "$GITHUB_OUTPUT"
 
       - name: Sign release images
         if: github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/server/v') && steps.parse_tag.outputs.image_tag != 'latest' && steps.parse_tag.outputs.image_tag != ''
         env:
           DIGEST: ${{ steps.build.outputs.digest }}
           DOCKERHUB_IMAGE: ${{ steps.build.outputs.dockerhub_image }}
           ACR_IMAGE: ${{ steps.build.outputs.acr_image }}
+          GHCR_IMAGE: ${{ steps.build.outputs.ghcr_image }}
         run: |
           set -euo pipefail
-          cosign sign --yes "${DOCKERHUB_IMAGE}@${DIGEST}" "${ACR_IMAGE}@${DIGEST}"
+          cosign sign --yes "${DOCKERHUB_IMAGE}@${DIGEST}" "${ACR_IMAGE}@${DIGEST}" "${GHCR_IMAGE}@${DIGEST}"
 
       - name: Attest Docker Hub image
         if: github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/server/v') && steps.parse_tag.outputs.image_tag != 'latest' && steps.parse_tag.outputs.image_tag != ''
@@ -145,6 +156,15 @@ jobs:
           push-to-registry: true
           create-storage-record: false
 
+      - name: Attest GHCR image
+        if: github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/server/v') && steps.parse_tag.outputs.image_tag != 'latest' && steps.parse_tag.outputs.image_tag != ''
+        uses: actions/attest@v4
+        with:
+          subject-name: ${{ steps.build.outputs.ghcr_image }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
+          create-storage-record: false
+
   bump-server-chart:
     if: startsWith(github.ref, 'refs/tags/server/v')
     needs: publish-image
diff --git a/components/egress/build.sh b/components/egress/build.sh
@@ -32,6 +32,7 @@ build_arg_if_set() {
 }
 
 TAG=${TAG:-latest}
+GHCR_REPO=${GHCR_REPO:-}
 VERSION=${VERSION:-$(git describe --tags --always --dirty 2>/dev/null || echo "dev")}
 GIT_COMMIT=${GIT_COMMIT:-$(git rev-parse HEAD 2>/dev/null || echo "unknown")}
 BUILD_TIME=${BUILD_TIME:-$(default_build_time)}
@@ -49,14 +50,20 @@ docker buildx create --use --name egress-builder
 docker buildx inspect --bootstrap
 docker buildx ls
 
+IMAGE_TAGS=(-t opensandbox/egress:${TAG} -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:${TAG})
 LATEST_TAGS=()
+if [[ -n "${GHCR_REPO}" ]]; then
+  IMAGE_TAGS+=(-t "${GHCR_REPO}/egress:${TAG}")
+fi
 if [[ "${TAG}" == v* ]]; then
   LATEST_TAGS+=(-t opensandbox/egress:latest -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:latest)
+  if [[ -n "${GHCR_REPO}" ]]; then
+    LATEST_TAGS+=(-t "${GHCR_REPO}/egress:latest")
+  fi
 fi
 
 docker buildx build \
-  -t opensandbox/egress:${TAG} \
-  -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:${TAG} \
+  "${IMAGE_TAGS[@]}" \
   "${LATEST_TAGS[@]}" \
   -f components/egress/Dockerfile \
   "${BUILD_ARGS[@]}" \
diff --git a/components/execd/build.sh b/components/execd/build.sh
@@ -32,6 +32,7 @@ build_arg_if_set() {
 }
 
 TAG=${TAG:-latest}
+GHCR_REPO=${GHCR_REPO:-}
 VERSION=${VERSION:-$(git describe --tags --always --dirty 2>/dev/null || echo "dev")}
 GIT_COMMIT=${GIT_COMMIT:-$(git rev-parse HEAD 2>/dev/null || echo "unknown")}
 BUILD_TIME=${BUILD_TIME:-$(default_build_time)}
@@ -53,14 +54,20 @@ docker buildx inspect --bootstrap
 
 docker buildx ls
 
+IMAGE_TAGS=(-t opensandbox/execd:${TAG} -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:${TAG})
 LATEST_TAGS=()
+if [[ -n "${GHCR_REPO}" ]]; then
+  IMAGE_TAGS+=(-t "${GHCR_REPO}/execd:${TAG}")
+fi
 if [[ "${TAG}" == v* ]]; then
   LATEST_TAGS+=(-t opensandbox/execd:latest -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:latest)
+  if [[ -n "${GHCR_REPO}" ]]; then
+    LATEST_TAGS+=(-t "${GHCR_REPO}/execd:latest")
+  fi
 fi
 
 docker buildx build \
-  -t opensandbox/execd:${TAG} \
-  -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:${TAG} \
+  "${IMAGE_TAGS[@]}" \
   "${LATEST_TAGS[@]}" \
   -f components/execd/Dockerfile \
   "${BUILD_ARGS[@]}" \
diff --git a/components/ingress/build.sh b/components/ingress/build.sh
@@ -32,6 +32,7 @@ build_arg_if_set() {
 }
 
 TAG=${TAG:-latest}
+GHCR_REPO=${GHCR_REPO:-}
 VERSION=${VERSION:-$(git describe --tags --always --dirty 2>/dev/null || echo "dev")}
 GIT_COMMIT=${GIT_COMMIT:-$(git rev-parse HEAD 2>/dev/null || echo "unknown")}
 BUILD_TIME=${BUILD_TIME:-$(default_build_time)}
@@ -53,14 +54,20 @@ docker buildx inspect --bootstrap
 
 docker buildx ls
 
+IMAGE_TAGS=(-t opensandbox/ingress:${TAG} -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/ingress:${TAG})
 LATEST_TAGS=()
+if [[ -n "${GHCR_REPO}" ]]; then
+  IMAGE_TAGS+=(-t "${GHCR_REPO}/ingress:${TAG}")
+fi
 if [[ "${TAG}" == v* ]]; then
   LATEST_TAGS+=(-t opensandbox/ingress:latest -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/ingress:latest)
+  if [[ -n "${GHCR_REPO}" ]]; then
+    LATEST_TAGS+=(-t "${GHCR_REPO}/ingress:latest")
+  fi
 fi
 
 docker buildx build \
-  -t opensandbox/ingress:${TAG} \
-  -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/ingress:${TAG} \
+  "${IMAGE_TAGS[@]}" \
   "${LATEST_TAGS[@]}" \
   -f components/ingress/Dockerfile \
   "${BUILD_ARGS[@]}" \
diff --git a/kubernetes/build.sh b/kubernetes/build.sh
@@ -26,6 +26,7 @@ build_arg_if_set() {
 TAG=${TAG:-latest}
 COMPONENT=${COMPONENT:-controller}
 PUSH=${PUSH:-true}
+GHCR_REPO=${GHCR_REPO:-}
 BUILD_METADATA_FILE=${BUILD_METADATA_FILE:-build/${COMPONENT}-image-metadata.json}
 BUILD_ARGS=()
 for name in GOFLAGS LDFLAGS CGO_ENABLED CC CXX CFLAGS CXXFLAGS CGO_CFLAGS CGO_CXXFLAGS CGO_LDFLAGS; do
@@ -67,13 +68,17 @@ echo "========================================="
 PLATFORMS="linux/amd64,linux/arm64"
 
 if [ "$PUSH" == "true" ]; then
+    IMAGE_TAGS=(-t "${DOCKERHUB_REPO}/${IMAGE_NAME}:${TAG}" -t "${ACR_REPO}/${IMAGE_NAME}:${TAG}")
+    if [[ -n "${GHCR_REPO}" ]]; then
+        IMAGE_TAGS+=(-t "${GHCR_REPO}/${IMAGE_NAME}:${TAG}")
+    fi
+
     # Build and push to registry
     docker buildx build \
         --platform $PLATFORMS \
         $BUILD_ARG \
         "${BUILD_ARGS[@]}" \
-        -t "${DOCKERHUB_REPO}/${IMAGE_NAME}:${TAG}" \
-        -t "${ACR_REPO}/${IMAGE_NAME}:${TAG}" \
+        "${IMAGE_TAGS[@]}" \
         --metadata-file "${BUILD_METADATA_FILE}" \
         --push \
         -f "$DOCKERFILE" \
@@ -83,6 +88,9 @@ if [ "$PUSH" == "true" ]; then
     echo "Successfully built and pushed:"
     echo "  ${DOCKERHUB_REPO}/${IMAGE_NAME}:${TAG}"
     echo "  ${ACR_REPO}/${IMAGE_NAME}:${TAG}"
+    if [[ -n "${GHCR_REPO}" ]]; then
+        echo "  ${GHCR_REPO}/${IMAGE_NAME}:${TAG}"
+    fi
     echo "========================================="
 else
     # Build only (for local testing)
diff --git a/kubernetes/docs/BUILD-IMAGES.md b/kubernetes/docs/BUILD-IMAGES.md
@@ -22,6 +22,9 @@ COMPONENT=task-executor TAG=v0.1.0 PUSH=false ./build.sh
 # Ensure you are logged in to Alibaba Cloud ACR
 docker login sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com
 
+# Optional: also push to GitHub Container Registry
+docker login ghcr.io
+
 # Build and push controller image
 COMPONENT=controller TAG=v0.1.0 ./build.sh
 
@@ -34,6 +37,7 @@ COMPONENT=task-executor TAG=v0.1.0 ./build.sh
 - `COMPONENT`: The component to build. Options: `controller`, `task-executor`
 - `TAG`: Image tag, defaults to `latest`
 - `PUSH`: Whether to push to remote registry, defaults to `true`
+- `GHCR_REPO`: Optional GHCR repository prefix, for example `ghcr.io/opensandbox-group/opensandbox`
 
 ## Option 2: Using GitHub Actions
 
@@ -85,11 +89,22 @@ make docker-push-task-executor TASK_EXECUTOR_IMG=myregistry/opensandbox-task-exe
 
 ## Image Registry
 
-Built images are pushed to the following registry:
+Built images are pushed to Docker Hub and Alibaba Cloud Container Registry (ACR). When `GHCR_REPO` is set, the same images are also pushed to GitHub Container Registry (GHCR).
+
+### Docker Hub
+- Controller: `opensandbox/controller:<tag>`
+- Task Executor: `opensandbox/task-executor:<tag>`
+- Image Committer: `opensandbox/image-committer:<tag>`
 
 ### Alibaba Cloud Container Registry (ACR)
 - Controller: `sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/controller:<tag>`
 - Task Executor: `sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/task-executor:<tag>`
+- Image Committer: `sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/image-committer:<tag>`
+
+### GitHub Container Registry (GHCR)
+- Controller: `ghcr.io/<owner>/opensandbox/controller:<tag>`
+- Task Executor: `ghcr.io/<owner>/opensandbox/task-executor:<tag>`
+- Image Committer: `ghcr.io/<owner>/opensandbox/image-committer:<tag>`
 
 ## Multi-Architecture Support
 
diff --git a/sandboxes/code-interpreter/build.sh b/sandboxes/code-interpreter/build.sh
@@ -16,6 +16,7 @@
 set -ex
 
 TAG=${TAG:-latest}
+GHCR_REPO=${GHCR_REPO:-}
 BUILD_METADATA_FILE=${BUILD_METADATA_FILE:-build/code-interpreter-image-metadata.json}
 mkdir -p "$(dirname "${BUILD_METADATA_FILE}")"
 
@@ -33,9 +34,13 @@ docker buildx ls
 #  --push \
 #  .
 
+IMAGE_TAGS=(-t opensandbox/code-interpreter:${TAG} -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/code-interpreter:${TAG})
+if [[ -n "${GHCR_REPO}" ]]; then
+  IMAGE_TAGS+=(-t "${GHCR_REPO}/code-interpreter:${TAG}")
+fi
+
 docker buildx build \
-  -t opensandbox/code-interpreter:${TAG} \
-  -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/code-interpreter:${TAG} \
+  "${IMAGE_TAGS[@]}" \
   --platform linux/amd64,linux/arm64 \
   --metadata-file "${BUILD_METADATA_FILE}" \
   --push \
diff --git a/server/build.sh b/server/build.sh
@@ -16,6 +16,7 @@
 set -ex
 
 TAG=${TAG:-latest}
+GHCR_REPO=${GHCR_REPO:-}
 BUILD_METADATA_FILE=${BUILD_METADATA_FILE:-build/server-image-metadata.json}
 mkdir -p "$(dirname "${BUILD_METADATA_FILE}")"
 
@@ -27,14 +28,20 @@ docker buildx inspect --bootstrap
 
 docker buildx ls
 
+IMAGE_TAGS=(-t opensandbox/server:${TAG} -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/server:${TAG})
 LATEST_TAGS=()
+if [[ -n "${GHCR_REPO}" ]]; then
+  IMAGE_TAGS+=(-t "${GHCR_REPO}/server:${TAG}")
+fi
 if [[ "${TAG}" == v* ]]; then
   LATEST_TAGS+=(-t opensandbox/server:latest -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/server:latest)
+  if [[ -n "${GHCR_REPO}" ]]; then
+    LATEST_TAGS+=(-t "${GHCR_REPO}/server:latest")
+  fi
 fi
 
 docker buildx build \
-  -t opensandbox/server:${TAG} \
-  -t sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/server:${TAG} \
+  "${IMAGE_TAGS[@]}" \
   "${LATEST_TAGS[@]}" \
   --platform linux/amd64,linux/arm64 \
   --metadata-file "${BUILD_METADATA_FILE}" \
