Add publishing docker image by gradle in release workflow #159

xfiderek · 2020-07-21T12:02:46Z

Summary

Refactored publishing docker image in release workflow
Previously images were being published by github action
Now they're published using gradle

Other Information
Workflow tested on mock repository in both possible cases (hotfix/non hotfix), but note that during tests different image (simple dockerfile) was being published on different repository (with different credentials).

TheMP · 2020-07-21T12:51:32Z

.github/workflows/release.yml

+          ./gradlew dockerTagsPush -P version=${{ steps.bump_dry.outputs.tag }}
+
+      - name: "4-2. Publish non-hotfix docker image"
+        if: ${{ !contains(github.event.head_commit.message, '#hotfix') }}


what happens in case of #patch in commit message?

actually also - what happens in case of hotfix itself?

Maybe versioning logic should be documented somewhere (not for this pr) as it looks like it is not easy to deduce, at least for me.

what happens in case of #patch in commit message?

There was not any specific behaviour for #patch commit before my changes as far as I can see

actually also - what happens in case of hotfix itself?

In hotfix we skip publishing docker image with tag 'latest', since hotfix (according to my conversation with @endrjuskr ) refers to changes in one of previous versions

This is definitely something we have to concretely specify somewhere. Because the two latest hotfixes changed the latest release..

Hotfixe is something that applies to older version that we still support. For instance v1 and v2. In our cases it was more like patch or minor, so that is why we released latest.

TheMP · 2020-07-21T12:57:20Z

.github/workflows/release.yml

-      - name: "3. Determine docker tags"
-        run: echo ::set-env name=DOCKER_TAGS::$(echo latest, ${{ steps.bump_dry.outputs.tag }})
+      - name: "3. Login to docker hub"
+        run: "echo '${{ secrets.DOCKER_HUB_TOKEN }}' | docker login --username ${{ secrets.DOCKER_HUB_USER }} --password-stdin"


don't we have to pass the secret with env like here? https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#example-using-bash

Can you do docker login --username ${{ secrets.DOCKER_HUB_USER }} --password ${{ secrets.DOCKER_HUB_TOKEN }}" ? In such case you will leave pasword in logs

don't we have to pass the secret with env like here? https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#example-using-bash

yes, probably you are right. I will change it soon

Can you do docker login --username ${{ secrets.DOCKER_HUB_USER }} --password ${{ secrets.DOCKER_HUB_TOKEN }}" ? In such case you will leave pasword in logs

According to docker login documentation using --password-stdin avoids logging credentials, but correct me if I misunderstood it.

It is when you cat a file and then pipe it. In our case we echo it, so it will be visible. In a solution that I proposed it will as well because it inject it to command

You need to use env - https://github.community/t/github-actions-docker-login/16053/2

endrjuskr · 2020-07-21T13:03:21Z

.github/workflows/release.yml

-      - name: "3. Determine docker tags"
-        run: echo ::set-env name=DOCKER_TAGS::$(echo latest, ${{ steps.bump_dry.outputs.tag }})
+      - name: "3. Login to docker hub"
+        run: "echo '${{ secrets.DOCKER_HUB_TOKEN }}' | docker login --username ${{ secrets.DOCKER_HUB_USER }} --password-stdin"


Can you do docker login --username ${{ secrets.DOCKER_HUB_USER }} --password ${{ secrets.DOCKER_HUB_TOKEN }}" ? In such case you will leave pasword in logs

endrjuskr · 2020-07-21T13:04:49Z

build.gradle

@@ -16,7 +16,8 @@ task build {
 // docker & docker run
 docker {
    name "unit8/darts"
-    tags version, "latest"
+    //it will also automatically create image with tag 'latest'
+    tag version, "unit8/darts:${version}"


will it create three tags? why we need tag version ?

Let's explicit say latest, rather than assume it is automatic

will it create three tags? why we need tag version ?

It will create two tags - 'latest' and 'x.y.z' (where 'x.y.z' is release version)

version is variable that is passed to gradle after resolving current release tag by github action. So if release tag is 0.3.0 version will be replaced by 0.3.0, and gradle will build docker image with two tags, 'latest' and '0.3.0' ('latest' tag is always attached automatically). Maybe there is better way to parse current version to gradle. If so, I am open to any further suggestions.

so why we need this - "unit8/darts:${version}" ? Is it a formatter?

I also think that it is a bit unclear, but I will do my best to explain it. Basically "tags" is deprecated and now it is replaced by "tag". So, we can add any number of following lines:
tag x, y
Now, x is internal name, some sort of alias, whereas y is image:tag that corresponds to image name and demanded tag, so for example we can specify following line:
tag unicorn, unit8/darts:0.3.0
Purpose of this key, value correspondence is to refer to created tags by keys. For example, we can then call:
./gradlew dockerPushUnicorn
And image with tag 0.3.0 (unit8/darts:0.3.0) will be pushed. It can be useful if we have multiple tags and want to push only subset of them. I really recommend reading Task section in plugin's README.

endrjuskr · 2020-07-21T13:09:34Z

.github/workflows/release.yml

+      - name: "4-2. Publish non-hotfix docker image"
+        if: ${{ !contains(github.event.head_commit.message, '#hotfix') }}
+        run: |
+          ./gradlew dockerPush -P version=${{ steps.bump_dry.outputs.tag }}


What's the difference between dockerPush and dockerTagsPush? It is not intuitive what each method does

What's the difference between dockerPush and dockerTagsPush? It is not intuitive what each method does

As you can see above in gradle.build file in docker plugin we specify only tag version, but I've mentioned before that gradle automatically creates also tag 'latest'. dockerPush pushes image with all created tags, wheareas dockerTagsPush publish image only with specified tags, so dockerTagsPush will push image only with one tag - version, while dockerPush will push image with both version and 'latest' tags. I've disscussed value of version variable in previous comments.

can we use always dockerTagsPush? to make it more explicit?

can we use always dockerTagsPush? to make it more explicit?

We can create two tags, one for latest and one for current version and use a dockerPush${version} and optionally dockerPushLatest (See here). In such case only thing that we should agree on is how to pass version variable to gradle. I see two possibilities:

Pass version to gradle as property from CLI in workflow (current implementation)

Set version as enviromental variable in workflow and use System.env.version in gradle to retrieve it.

What do you think?

I would recommend passing it as property. Reading something from env in gradle is not visible at first and might confuse people

Add publishing docker image by gradle

cac8f2b

xfiderek requested review from endrjuskr, hrzn and Kostiiii July 21, 2020 12:02

xfiderek requested a review from TheMP as a code owner July 21, 2020 12:02

TheMP reviewed Jul 21, 2020

View reviewed changes

endrjuskr suggested changes Jul 21, 2020

View reviewed changes

xfiderek added 2 commits July 28, 2020 09:33

pass docker credentials as env variables

d6babe0

Clean and improve image publishing steps

0165b6a

xfiderek requested review from endrjuskr, TheMP and pennfranc July 28, 2020 07:41

endrjuskr approved these changes Jul 28, 2020

View reviewed changes

Merge branch 'develop' into feature/gradle_docker_pub

639267c

xfiderek merged commit 217e595 into develop Jul 28, 2020

xfiderek deleted the feature/gradle_docker_pub branch July 28, 2020 11:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add publishing docker image by gradle in release workflow #159

Add publishing docker image by gradle in release workflow #159

xfiderek commented Jul 21, 2020

TheMP Jul 21, 2020

TheMP Jul 21, 2020

Kostiiii Jul 21, 2020

xfiderek Jul 21, 2020

xfiderek Jul 21, 2020 •

edited

Loading

pennfranc Jul 22, 2020

endrjuskr Jul 27, 2020

TheMP Jul 21, 2020

endrjuskr Jul 21, 2020

xfiderek Jul 21, 2020

xfiderek Jul 21, 2020

endrjuskr Jul 22, 2020

endrjuskr Jul 22, 2020

endrjuskr Jul 21, 2020

endrjuskr Jul 21, 2020

endrjuskr Jul 21, 2020

xfiderek Jul 21, 2020 •

edited

Loading

endrjuskr Jul 22, 2020

xfiderek Jul 23, 2020

endrjuskr Jul 21, 2020

xfiderek Jul 21, 2020

endrjuskr Jul 22, 2020

xfiderek Jul 23, 2020

endrjuskr Jul 27, 2020

Add publishing docker image by gradle in release workflow #159

Add publishing docker image by gradle in release workflow #159

Conversation

xfiderek commented Jul 21, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xfiderek Jul 21, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xfiderek Jul 21, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xfiderek Jul 21, 2020 •

edited

Loading

xfiderek Jul 21, 2020 •

edited

Loading