ci: build multiarched docker images

Signed-off-by: You-Sheng Yang <[email protected]>

.github/workflows/ci.yml

@@ -0,0 +1,69 @@
+name: Container Images
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  matrix:
+    name: Build Matrix
+    runs-on: ubuntu-latest
+    outputs:
+      full_json: ${{ steps.releases.outputs.json }}
+      codenames: ${{ steps.pp.outputs.codenames }}
+      codename_arch: ${{ steps.pp.outputs.codename_arch }}
+    steps:
+      - name: Releases Info
+        id: releases
+        uses: vicamo/actions-library/debian-releases@v1
+
+      - name: Post Processing
+        id: pp
+        env:
+          FULL_JSON: ${{ steps.releases.outputs.json }}
+        run: |
+          disabled='["hurd-amd64", "hurd-i386", "ia64", "kfreebsd-amd64", "kfreebsd-i386"]'
+
+          codenames="$(echo "${FULL_JSON}" | \
+              jq -c -M '[ .[] as $s | $s.mirrors[0].pockets[$s.codename].architectures as $da | $s | {"distribution":.distribution,"codename":.codename,"suite":.suite,"active":.active,"architectures":(.architectures - '"${disabled}"' | map({"arch":.,"ports":(. as $arch | $da | index($arch) == null)}) | tostring)} ]')"
+          echo "::group::Built JSON(codenames)"
+          echo "${codenames}" | jq
+          echo "::endgroup::"
+
+          codename_arch="$(echo "${FULL_JSON}" | \
+              jq -c -M '[ .[] as $s | ($s.architectures - '"${disabled}"') | {"distribution":$s.distribution,"codename":$s.codename,"suite":$s.suite,"active":$s.active,"architectures":.} ]')"
+          echo "::group::Built JSON(codename and architectures)"
+          echo "${codename_arch}" | jq
+          echo "::endgroup::"
+
+          { \
+            echo "codenames=${codenames}"; \
+            echo "codename_arch=${codename_arch}"; \
+          } | tee -a "${GITHUB_OUTPUT}"
+
+  per-suite:
+    name: Per Suite
+    needs:
+      - matrix
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.matrix.outputs.codenames) }}
+    uses: ./.github/workflows/per-suite.yml
+    with:
+      distribution: ${{ matrix.distribution }}
+      codename: ${{ matrix.codename }}
+      suite: ${{ matrix.suite }}
+      active: ${{ matrix.active }}
+      architectures: ${{ matrix.architectures }}

.github/workflows/per-suite.yml

@@ -0,0 +1,150 @@
+---
+name: Build Suite
+on:
+  workflow_call:
+    inputs:
+      distribution:
+        description: 'Distribution name, e.g. debian.'
+        type: string
+        required: true
+      codename:
+        description: 'Debian codename.'
+        type: string
+        required: true
+      suite:
+        description: 'Debian suite.'
+        type: string
+        required: true
+      active:
+        description: 'Use default/archive apt mirror.'
+        type: boolean
+        required: true
+      architectures:
+        description: 'Architectures in JSON array'
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  per-arch:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(inputs.architectures) }}
+    env:
+      DISTRO: ${{ inputs.distribution }}
+      CODENAME: ${{ inputs.codename }}
+      ARCH: ${{ matrix.arch }}
+    steps:
+      - name: Translate docker platform
+        id: translate
+        run: |
+          platform=
+          case "${ARCH}" in
+            amd64)    platform=linux/amd64;;
+            arm)      platform=linux/arm;;
+            arm64)    platform=linux/arm64/v8;;
+            armel)    platform=linux/arm/v5;;
+            armhf)    platform=linux/arm/v7;;
+            i386)     platform=linux/386;;
+            loong64)  platform=linux/loong64;;
+            mips64el) platform=linux/mips64le;;
+            ppc64el)  platform=linux/ppc64le;;
+            riscv64)  platform=linux/riscv64;;
+            s390x)    platform=linux/s390x;;
+
+            # Also in github.com/containerd/containerd/platforms/database
+            mips)     platform=linux/mips;;
+            mipsel)   platform=linux/mipsle;;
+            powerpc)  platform=linux/ppc;;
+            ppc64)    platform=linux/ppc64;;
+            s390)     platform=linux/s390;;
+            sparc)    platform=linux/sparc;;
+            sparc64)  platform=linux/sparc64;;
+            x32)      platform=linux/amd64p32;;
+
+            # Other architectures supported by QEMU
+            alpha)    platform=linux/alpha;;
+            hppa)     platform=linux/hppa;;
+            m68k)     platform=linux/m68k;;
+            sh4)      platform=linux/sh4;;
+
+            *)
+              echo "Unsupported arch '${ARCH}'" >&2
+              exit 1
+              ;;
+          esac
+
+          echo "platform=${platform}" | tee -a "${GITHUB_OUTPUT}"
+
+      - # Add support for more platforms with QEMU (optional)
+        name: Set up QEMU
+        if: matrix.arch != 'amd64' && matrix.arch != 'i386'
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -yq binfmt-support qemu-user-static
+          ls -al /proc/sys/fs/binfmt_misc
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: v0.12.0
+
+      - name: Check fallback availability
+        id: fallback
+        env:
+          PLATFORM: ${{ steps.translate.outputs.platform }}
+        run: |
+          image="${DISTRO}:${CODENAME}"
+
+          # generate: linux/amd64:docker.io/library/ubuntu:noble@sha256:69ce9399...
+          manifest="$(docker buildx imagetools inspect "${image}" | \
+              awk '/Name: +\S+@sha256:/ { digest=$2; getline; getline; platform=$2; print platform ":" digest}' | \
+              grep "^${PLATFORM}:" || true)"
+          if [ -z "${manifest}" ]; then
+            manifest="$(docker buildx imagetools inspect "vicamo/${image}" | \
+                awk '/Name: +\S+@sha256:/ { digest=$2; getline; getline; platform=$2; print platform ":" digest}' | \
+                grep "^${PLATFORM}:" || true)"
+            if [ -z "${manifest}" ]; then
+              digest="$(docker buildx imagetools inspect "vicamo/${image}-${ARCH}" | \
+                  awk '/Name: +\S+/ { image=$2; getline; getline; digest=$2; print image "@" digest}' \
+                  || true)"
+              manifest="${PLATFORM}:${digest}"
+            fi
+          fi
+
+          echo "digest=${manifest#*:}" | tee -a "${GITHUB_OUTPUT}"
+
+      - name: Checkout Debuerreotype
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          repository: debuerreotype/debuerreotype
+          ref: master
+          path: debuerreotype
+
+      - name: Debuerreotype
+        id: debuerreotype
+        env:
+          PLATFORM: ${{ steps.translate.outputs.platform }}
+          FALLBACK_DIGEST: ${{ steps.fallback.outputs.digest }}
+          ARG_EOL: ${{ inputs.active && '' || '--eol' }}
+          ARG_PORTS: ${{ matrix.ports && '--ports' || '' }}
+        working-directory: debuerreotype
+        run: |
+          epoch="$(TZ=UTC date +%s)"
+          serial="$(TZ=UTC date --date "@$epoch" +%Y%m%d)"
+
+          mkdir output
+          roottar="output/${serial}/${ARCH}/${CODENAME}/rootfs.tar.xz"
+
+          ./docker-run.sh --no-build --pull \
+              --image=debuerreotype/debuerreotype:master \
+              ./examples/debian.sh \
+              ${ARG_EOL} ${ARG_PORTS} --arch="${ARCH}" \
+              output "${CODENAME}" "@${epoch}"
+
+          sha256sum "${roottar}" | cut -d' ' -f1