Use pre-built images for nginx & service containers

.github/workflows/test.yml

@@ -4,6 +4,9 @@ on:
   push:
   pull_request:
 
+env:
+  REGISTRY: ghcr.io
+
 jobs:
   test-misc: # quick, simple checks
     timeout-minutes: 2
@@ -48,3 +51,64 @@ jobs:
     - run: ./test/test-images.sh
     - if: always()
       run: docker compose logs
+  check-image-references:
+    if: ${{ github.ref_type == 'tag' }}
+    needs:
+    - test-images
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        image: [nginx, service]
+    steps:
+    - name: Check tag format
+      run: '[[ "${{ github.ref_name }}" = v*.*.* ]]'
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Extract Docker metadata
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/central-${{ matrix.image }}
+    - name: Check release image is referenced in docker-compose.yml
+      run: 'grep "${{ steps.meta.outputs.tags }}" docker-compose.yml'
+  build-push-image:
+    needs:
+    - check-image-references
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        image: [nginx, service]
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+        fetch-tags: true
+        submodules: recursive
+    - name: Log into registry ${{ env.REGISTRY }}
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Extract Docker metadata
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/central-${{ matrix.image }}
+    - name: Set up QEMU emulator for multi-arch images
+      uses: docker/setup-qemu-action@v3
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Build and push ${{ matrix.image }} Docker image
+      uses: docker/build-push-action@v5
+      with:
+        file: ${{ matrix.image }}.dockerfile
+        context: .
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        platforms: 'linux/amd64,linux/arm64'

docker-compose.yml

@@ -34,9 +34,7 @@ services:
       - DKIM_KEY_PATH=/etc/exim4/dkim.key.temp
     restart: always
   service:
-    build:
-      context: .
-      dockerfile: service.dockerfile
+    image: 'ghcr.io/getodk/central-service:2025.1'
     depends_on:
       - secrets
       - postgres14
@@ -79,9 +77,7 @@ services:
     logging:
       driver: local
   nginx:
-    build:
-      context: .
-      dockerfile: nginx.dockerfile
+    image: 'ghcr.io/getodk/central-nginx:2025.1'
     depends_on:
       - service
       - enketo

release.sh

@@ -0,0 +1,81 @@
+#!/bin/bash -eu
+set -o pipefail
+
+log() { echo "[release] $*"; }
+
+log "Checking git branch..."
+currentBranch="$(git rev-parse --abbrev-ref HEAD)"
+if [[ "$currentBranch" != master ]]; then
+  log "!!!"
+  log "!!! Unexpected branch:"
+  log "!!!   Expected: master"
+  log "!!!     Actual: $currentBranch"
+  log "!!!"
+  exit 1
+fi
+log "  Git branch OK."
+
+log "Checking for uncommitted changes..."
+gitStatus="$(git status --porcelain)"
+if [[ "$gitStatus" != "" ]]; then
+  log "!!!"
+  log "!!! Your working directory is dirty.  Make sure you have committed all changes."
+  log "!!!"
+  exit 1
+fi
+log "  No uncommitted changes found."
+
+log "Checking for divergence from upstream..."
+upstream="$(git rev-parse --abbrev-ref '@{upstream}')"
+remote="${upstream%%/*}"
+log "  Fetching from remote '$remote'..."
+git fetch "$remote"
+log "  Comparing to $upstream..."
+if ! git diff --exit-code "$upstream"..HEAD; then
+  log "!!!"
+  log "!!! Differences found between HEAD and tracking branch $upstream !!!"
+  log "!!!"
+  log "!!! Do you need to git push?"
+  log "!!!"
+  exit 1
+fi
+log "  HEAD seems to be in-line with upstream."
+
+year="$(date +%Y)"
+if git tag | grep "^v$year\."; then
+  lastMinor="$(git tag | grep "^v$year" | tail -n1 | cut -d'.' -f2)"
+  suggestedVersion="v$year.$((lastMinor+1)).0"
+else
+  suggestedVersion="v$year.1.0"
+fi
+read -r -e \
+    -p "[release] Version to release: " \
+    -i "$suggestedVersion" newVersion
+if ! [[ "$newVersion" = v*.*.* ]]; then
+  log "!!!"
+  log "!!! Version '$newVersion' does not match expected format."
+  log "!!!"
+  exit 1
+fi
+
+log "Updating version numbers in docker-compose.yml ..."
+tmpfile="$(mktemp)"
+sed -E \
+    -e "s_(image:\s+'.*/.*/central-nginx):.*'_\1:$newVersion'_" \
+    -e "s_(image:\s+'.*/.*/central-service):.*'_\1:$newVersion'_" \
+    docker-compose.yml > "$tmpfile"
+mv "$tmpfile" docker-compose.yml
+
+log "Committing changes to git..."
+git add docker-compose.yml
+git commit -m"Release version: $newVersion"
+git tag "$newVersion"
+
+log "Pushing release to git..."
+git push && git push --tags
+
+echo
+log "Release complete.  Check build progress at:"
+log ""
+log "  https://github.com/getodk/central/actions"
+echo

test/snapshots.docker-compose.yml

@@ -0,0 +1,7 @@
+services:
+  service:
+    build:
+      dockerfile: service.dockerfile
+  nginx:
+    build:
+      dockerfile: nginx.dockerfile

test/test-images.sh

@@ -3,6 +3,13 @@ set -o pipefail
 
 log() { echo >&2 "[$(basename "$0")] $*"; }
 
+docker_compose() {
+  docker compose \
+      --file docker-compose.yml \
+      --file test/snapshots.docker-compose.yml \
+      "$@"
+}
+
 tmp="$(mktemp)"
 
 check_path() {
@@ -13,7 +20,7 @@ check_path() {
   for (( i=0; ; ++i )); do
     log "Checking response from $requestPath ..."
     echo -e "GET $requestPath HTTP/1.0\r\nHost: local\r\n\r\n" |
-        docker compose exec --no-TTY nginx \
+        docker_compose exec --no-TTY nginx \
             openssl s_client -quiet -connect 127.0.0.1:443 \
             >"$tmp" 2>&1 || true
     if grep --silent --fixed-strings "$expected" "$tmp"; then
@@ -43,10 +50,10 @@ [email protected]' > .env
 touch ./files/allow-postgres14-upgrade
 
 log "Building docker containers..."
-docker compose build
+docker_compose build
 
 log "Starting containers..."
-docker compose up --detach
+docker_compose up --detach
 
 log "Verifying frontend..."
 check_path 30 / 'ODK Central'
@@ -57,7 +64,7 @@ check_path 2 /v1/projects '[]'
 log "  Backend started OK."
 
 log "Verifying pm2..."
-docker compose exec service npx pm2 list | tee "$tmp"
+docker_compose exec service npx pm2 list | tee "$tmp"
 processCount="$(grep --count online "$tmp")"
 if [[ "$processCount" != 4 ]]; then
   log "!!! PM2 returned an unexpected count for online processes."