|
| 1 | +name: Publish Via backend |
| 2 | + |
| 3 | +on: |
| 4 | + workflow_dispatch: |
| 5 | + inputs: |
| 6 | + source_sha: |
| 7 | + description: Full merged master commit to publish |
| 8 | + required: true |
| 9 | + type: string |
| 10 | + |
| 11 | +permissions: |
| 12 | + contents: read |
| 13 | + |
| 14 | +concurrency: |
| 15 | + group: publish-via-backend-${{ inputs.source_sha }} |
| 16 | + cancel-in-progress: false |
| 17 | + |
| 18 | +jobs: |
| 19 | + publish: |
| 20 | + name: Build and publish Via backend |
| 21 | + if: github.repository == 'vianetwork/blockscout' && github.ref == 'refs/heads/master' |
| 22 | + runs-on: ubuntu-24.04 |
| 23 | + timeout-minutes: 90 |
| 24 | + env: |
| 25 | + SOURCE_SHA: ${{ inputs.source_sha }} |
| 26 | + IMAGE_REPOSITORY: docker.io/vianetwork/blockscout-backend |
| 27 | + steps: |
| 28 | + - name: Check publication prerequisites |
| 29 | + env: |
| 30 | + DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }} |
| 31 | + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} |
| 32 | + run: | |
| 33 | + [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo 'A full lowercase commit SHA is required'; exit 1; } |
| 34 | + [[ -n "$DOCKERHUB_USER" && -n "$DOCKERHUB_TOKEN" ]] || { |
| 35 | + echo 'Provision DOCKERHUB_USER and DOCKERHUB_TOKEN in repository Actions secrets'; exit 1; |
| 36 | + } |
| 37 | +
|
| 38 | + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 |
| 39 | + with: |
| 40 | + ref: ${{ inputs.source_sha }} |
| 41 | + fetch-depth: 0 |
| 42 | + persist-credentials: false |
| 43 | + |
| 44 | + - name: Verify merged source and derive image identity |
| 45 | + id: source |
| 46 | + run: | |
| 47 | + test "$(git rev-parse HEAD)" = "$SOURCE_SHA" |
| 48 | + git merge-base --is-ancestor "$SOURCE_SHA" origin/master |
| 49 | + version=$(sed -n 's/^[[:space:]]*version: "\([0-9][0-9.]*\)",$/\1/p' mix.exs) |
| 50 | + [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] |
| 51 | + image="$IMAGE_REPOSITORY:$version-via-${SOURCE_SHA:0:12}-$GITHUB_RUN_ID.$GITHUB_RUN_ATTEMPT" |
| 52 | + printf 'version=%s\nimage=%s\n' "$version" "$image" >> "$GITHUB_OUTPUT" |
| 53 | +
|
| 54 | + - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 |
| 55 | + |
| 56 | + - name: Build combined zkSync API and indexer |
| 57 | + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 |
| 58 | + with: |
| 59 | + context: . |
| 60 | + file: ./docker/Dockerfile |
| 61 | + platforms: linux/amd64 |
| 62 | + load: true |
| 63 | + push: false |
| 64 | + tags: ${{ steps.source.outputs.image }} |
| 65 | + labels: | |
| 66 | + org.opencontainers.image.source=https://github.com/vianetwork/blockscout |
| 67 | + org.opencontainers.image.revision=${{ inputs.source_sha }} |
| 68 | + org.opencontainers.image.version=${{ steps.source.outputs.version }} |
| 69 | + build-args: | |
| 70 | + CHAIN_TYPE=zksync |
| 71 | + RELEASE_VERSION=${{ steps.source.outputs.version }} |
| 72 | + BLOCKSCOUT_VERSION=v${{ steps.source.outputs.version }}.+commit.${{ inputs.source_sha }} |
| 73 | + DISABLE_API=false |
| 74 | +
|
| 75 | + - name: Smoke check the packaged release |
| 76 | + env: |
| 77 | + IMAGE: ${{ steps.source.outputs.image }} |
| 78 | + RELEASE_VERSION: ${{ steps.source.outputs.version }} |
| 79 | + run: | |
| 80 | + test "$(docker image inspect --format '{{.Architecture}}' "$IMAGE")" = amd64 |
| 81 | + test "$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$IMAGE")" = "$SOURCE_SHA" |
| 82 | + docker run --rm --entrypoint sh "$IMAGE" -ec ' |
| 83 | + test "$CHAIN_TYPE" = zksync |
| 84 | + test "$DISABLE_API" = false |
| 85 | + test -r "/app/releases/$RELEASE_VERSION/config_helper.exs" |
| 86 | + test -r /app/config/config_helper.exs |
| 87 | + test -x /app/bin/blockscout |
| 88 | + bin/blockscout version |
| 89 | + ' |
| 90 | +
|
| 91 | + - name: Authenticate to Via Docker Hub |
| 92 | + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 |
| 93 | + with: |
| 94 | + registry: docker.io |
| 95 | + username: ${{ secrets.DOCKERHUB_USER }} |
| 96 | + password: ${{ secrets.DOCKERHUB_TOKEN }} |
| 97 | + |
| 98 | + - name: Publish and verify the registry digest |
| 99 | + env: |
| 100 | + IMAGE: ${{ steps.source.outputs.image }} |
| 101 | + run: | |
| 102 | + docker push "$IMAGE" |
| 103 | + reference=$(docker image inspect --format '{{index .RepoDigests 0}}' "$IMAGE") |
| 104 | + digest="${reference##*@}" |
| 105 | + [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]] |
| 106 | + pinned="$IMAGE_REPOSITORY@$digest" |
| 107 | + docker buildx imagetools inspect "$pinned" |
| 108 | + docker pull "$pinned" |
| 109 | + test "$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$pinned")" = "$SOURCE_SHA" |
| 110 | + test "$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.source"}}' "$pinned")" = https://github.com/vianetwork/blockscout |
| 111 | + { |
| 112 | + printf 'Source: %s\n\n' "$SOURCE_SHA" |
| 113 | + printf 'Workflow revision: %s\n\n' "$GITHUB_SHA" |
| 114 | + printf 'Image: %s\n\n' "$IMAGE" |
| 115 | + printf 'Digest pin: %s\n\n' "$pinned" |
| 116 | + printf 'Platform: linux/amd64; chain type: zksync; combined API/indexer.\n\n' |
| 117 | + printf 'Packaging smoke passed. Database migration, startup, and rollback rehearsal remain deployment gates.\n' |
| 118 | + } >> "$GITHUB_STEP_SUMMARY" |
0 commit comments