sealos/.github/workflows/services.yml

name: Build Services image

on:
  workflow_dispatch:
    inputs:
      push_image:
        description: "Push image"
        required: false
        type: boolean
        default: false
      push_image_tag:
        description: "Push image tag"
        default: "latest"
        required: false
        type: string
  push:
    branches: ["main"]
    paths:
      - "service/**"
      - ".github/workflows/services.yml"
      - "!**/*.md"
      - "!**/*.yaml"
  pull_request:
    branches: ["*"]
    paths:
      - "service/**"
      - ".github/workflows/services.yml"
      - "!**/*.md"
      - "!**/*.yaml"
env:
  # Common versions
  GO_VERSION: "1.22"
  DEFAULT_OWNER: "labring"
  CRYPTOKEY: ${{ secrets.CONTROLLER_BUILD_CRYPTOKEY }}
  ALIYUN_REGISTRY: ${{ secrets.ALIYUN_REGISTRY }}
  ALIYUN_REPO_PREFIX: ${{ secrets.ALIYUN_REPO_PREFIX && secrets.ALIYUN_REPO_PREFIX || secrets.ALIYUN_USERNAME && format('{0}/{1}', secrets.ALIYUN_REGISTRY, secrets.ALIYUN_USERNAME) || '' }}

jobs:
  resolve-modules:
    runs-on: ubuntu-24.04
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve Modules
        id: set-matrix
        run: bash scripts/resolve-modules.sh ./service

  golangci-lint:
    needs: [resolve-modules]
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.resolve-modules.outputs.matrix) }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Golang with cache
        uses: magnetikonline/action-golang-cache@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Run Linter
        uses: golangci/golangci-lint-action@v6
        with:
          version: v1.64.5
          working-directory: ${{ matrix.workdir }}
          args: "--out-${NO_FUTURE}format colored-line-number"

  image-build:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        ## TODO: add more modules
        module:
          [
            database,
            pay,
            account,
            minio,
            launchpad,
            exceptionmonitor,
            devbox,
            vlogs,
            hubble,
          ]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Golang with cache
        uses: magnetikonline/action-golang-cache@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Install Dependencies
        run: sudo apt update && sudo apt install -y libgpgme-dev libbtrfs-dev libdevmapper-dev

      - name: Build ${{ matrix.module }} amd64
        working-directory: service/${{ matrix.module }}
        env:
          MODULE: ${{ matrix.module }}
        run: |
          GOARCH=amd64 make build
          mv bin/manager bin/service-${MODULE}-amd64
          chmod +x bin/service-${MODULE}-amd64
          file bin/service-${MODULE}-amd64
          file bin/service-${MODULE}-amd64 | grep -q 'x86-64'
          if [ $? -ne 0 ]; then
              echo "amd64 platform build failed"
              exit 1
          fi

      - name: Build ${{ matrix.module }} arm64
        working-directory: service/${{ matrix.module }}
        env:
          MODULE: ${{ matrix.module }}
        run: |
          GOARCH=arm64 make build
          mv bin/manager bin/service-${MODULE}-arm64
          chmod +x bin/service-${MODULE}-arm64
          file bin/service-${MODULE}-arm64
          file bin/service-${MODULE}-arm64 | grep -q 'aarch64'
          if [ $? -ne 0 ]; then
              echo "arm64 platform build failed"
              exit 1
          fi

      - name: Expose git commit data
        uses: rlespinasse/git-commit-data-action@v1
      - name: Check if tag
        id: check_tag
        env:
          REF: ${{ github.ref }}
        run: |
          if [[ "$REF" == refs/tags/* ]]; then
            echo "isTag=true" >> "$GITHUB_OUTPUT"
          else
            echo "isTag=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Prepare
        id: prepare
        env:
          PUSH_IMAGE: ${{ inputs.push_image }}
          IS_TAG: ${{ steps.check_tag.outputs.isTag }}
          PUSH_IMAGE_TAG: ${{ inputs.push_image_tag }}
          REPO_OWNER: ${{ github.repository_owner }}
          MODULE: ${{ matrix.module }}
        run: |
          bash scripts/resolve-tag-image.sh "$PUSH_IMAGE" "$IS_TAG" "$PUSH_IMAGE_TAG"
          echo "docker_repo=ghcr.io/$REPO_OWNER/sealos-$MODULE-service" >> $GITHUB_OUTPUT
          if [[ -n "${{ env.ALIYUN_REPO_PREFIX }}" ]]; then
            echo "aliyun_docker_repo=${{ env.ALIYUN_REPO_PREFIX }}/sealos-$MODULE-service" >> $GITHUB_OUTPUT
          fi

      - # Add support for more platforms with QEMU (optional)
        # https://github.com/docker/setup-qemu-action
        name: Set up QEMU
        uses: docker/setup-qemu-action@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        if: ${{ (github.event_name == 'push') ||(github.event_name == 'create') || (inputs.push_image == true)  }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GHCR_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Login to Aliyun Registry
        uses: docker/login-action@v3
        if: ${{ ((github.event_name == 'push') ||(github.event_name == 'create') || (inputs.push_image == true)) && env.ALIYUN_REGISTRY }}
        with:
          registry: ${{ env.ALIYUN_REGISTRY }}
          username: ${{ secrets.ALIYUN_USERNAME }}
          password: ${{ secrets.ALIYUN_PASSWORD }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ steps.prepare.outputs.docker_repo }}
            ${{ steps.prepare.outputs.aliyun_docker_repo }}
          tags: |
            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
            type=raw,value=${{ steps.prepare.outputs.tag_name }},enable=true
            type=ref,event=tag
            type=sha
        env:
          DOCKER_METADATA_SHORT_SHA_LENGTH: 9

      - name: build (and publish) ${{ matrix.module }} main image
        uses: docker/build-push-action@v6
        with:
          context: ./service/${{ matrix.module }}
          file: ./service/${{ matrix.module }}/Dockerfile
          # Push if it's a push event or if push_image is true
          push: ${{ (github.event_name == 'push') ||(github.event_name == 'create') || (inputs.push_image == true)  }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64

  save-sealos:
    uses: ./.github/workflows/import-save-sealos.yml
    with:
      artifact_name: sealos-services
  build-cluster-image:
    if: ${{ (github.event_name == 'push') ||(github.event_name == 'create') || (inputs.push_image == true) }}
    needs:
      - image-build
      - save-sealos
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        ## TODO: add more modules
        module:
          [
            database,
            pay,
            account,
            minio,
            launchpad,
            exceptionmonitor,
            devbox,
            vlogs,
            hubble,
          ]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Expose git commit data
        uses: rlespinasse/git-commit-data-action@v1
      - name: Check if tag
        id: check_tag
        env:
          REF: ${{ github.ref }}
        run: |
          if [[ "$REF" == refs/tags/* ]]; then
            echo "isTag=true" >> "$GITHUB_OUTPUT"
          else
            echo "isTag=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Prepare
        id: prepare
        env:
          PUSH_IMAGE: ${{ inputs.push_image }}
          IS_TAG: ${{ steps.check_tag.outputs.isTag }}
          PUSH_IMAGE_TAG: ${{ inputs.push_image_tag }}
          REPO_OWNER: ${{ github.repository_owner }}
          MODULE: ${{ matrix.module }}
        run: |
          bash scripts/resolve-tag-image.sh "$PUSH_IMAGE" "$IS_TAG" "$PUSH_IMAGE_TAG"
          echo "old_docker_repo=ghcr.io/labring/sealos-$MODULE-service" >> $GITHUB_OUTPUT
          echo "new_docker_repo=ghcr.io/$REPO_OWNER/sealos-$MODULE-service" >> $GITHUB_OUTPUT
          echo "cluster_repo=ghcr.io/$REPO_OWNER/sealos-cloud-$MODULE-service" >> $GITHUB_OUTPUT

          if [[ -n "${{ env.ALIYUN_REPO_PREFIX }}" ]]; then
            echo "aliyun_cluster_repo=${{ env.ALIYUN_REPO_PREFIX }}/sealos-cloud-$MODULE-service" >> $GITHUB_OUTPUT
          fi

      - name: Download sealos
        uses: actions/download-artifact@v4
        with:
          name: sealos-services
          path: /tmp/
      - name: Verify sealos
        run: |
          sudo chmod a+x /tmp/sealos
          sudo mv /tmp/sealos /usr/bin/sealos
          sudo sealos version

      - name: Sealos login to ghcr.io
        # if push to master, then login to ghcr.io
        env:
          REPOSITORY_OWNER: ${{ github.repository_owner }}
          GH_PAT: ${{ secrets.GHCR_TOKEN || secrets.GITHUB_TOKEN }}
        run: |
          sudo sealos login -u "$REPOSITORY_OWNER" -p "$GH_PAT" --debug ghcr.io

      - name: Sealos login to Aliyun Registry
        if: ${{ env.ALIYUN_REGISTRY }}
        env:
          ALIYUN_USERNAME: ${{ secrets.ALIYUN_USERNAME }}
          ALIYUN_PASSWORD: ${{ secrets.ALIYUN_PASSWORD }}
        run: |
          sudo sealos login -u "$ALIYUN_USERNAME" -p "$ALIYUN_PASSWORD" --debug ${{ env.ALIYUN_REGISTRY }}

      - name: Mutate image tag in deploy files
        working-directory: service/${{ matrix.module }}/deploy
        env:
          OLD_DOCKER_REPO: ${{ steps.prepare.outputs.old_docker_repo }}
          NEW_DOCKER_REPO: ${{ steps.prepare.outputs.new_docker_repo }}
          TAG_NAME: ${{ steps.prepare.outputs.tag_name }}
        run: |
          OLD_DOCKER_IMAGE_NAME="${OLD_DOCKER_REPO}:latest"
          NEW_DOCKER_IMAGE_NAME="${NEW_DOCKER_REPO}:${TAG_NAME}"
          sed -i "s;${OLD_DOCKER_IMAGE_NAME};${NEW_DOCKER_IMAGE_NAME};" manifests/*

      - name: Build ${{ matrix.module }}-service cluster image
        working-directory: service/${{ matrix.module }}/deploy
        env:
          MODULE: ${{ matrix.module }}
          CLUSTER_REPO: ${{ steps.prepare.outputs.cluster_repo }}
          ALIYUN_CLUSTER_REPO: ${{ steps.prepare.outputs.aliyun_cluster_repo }}
          TAG_NAME: ${{ steps.prepare.outputs.tag_name }}
        run: |
          # Build for GHCR
          CLUSTER_IMAGE_NAME="${CLUSTER_REPO}:${TAG_NAME}"
          sudo sealos build -t "${CLUSTER_IMAGE_NAME}-amd64" --platform linux/amd64 -f Kubefile
          sudo rm -rf registry
          sudo sealos build -t "${CLUSTER_IMAGE_NAME}-arm64" --platform linux/arm64 -f Kubefile

          # Build for Aliyun if enabled
          if [[ -n "${ALIYUN_CLUSTER_REPO}" ]]; then
            ALIYUN_CLUSTER_IMAGE_NAME="${ALIYUN_CLUSTER_REPO}:${TAG_NAME}"
            sudo rm -rf registry
            sudo sealos build -t "${ALIYUN_CLUSTER_IMAGE_NAME}-amd64" --platform linux/amd64 -f Kubefile
            sudo rm -rf registry
            sudo sealos build -t "${ALIYUN_CLUSTER_IMAGE_NAME}-arm64" --platform linux/arm64 -f Kubefile
          fi

          sudo sealos images

      - name: Build ${{ matrix.module }}-service cluster image for latest
        env:
          CLUSTER_REPO: ${{ steps.prepare.outputs.cluster_repo }}
          ALIYUN_CLUSTER_REPO: ${{ steps.prepare.outputs.aliyun_cluster_repo }}
          TAG_NAME: ${{ steps.prepare.outputs.tag_name }}
        run: |
          # Handle GHCR images
          CLUSTER_IMAGE_NAME="$CLUSTER_REPO:$TAG_NAME"
          CLUSTER_IMAGE_NAME_LATEST="$CLUSTER_REPO:latest"
          sudo sealos tag "$CLUSTER_IMAGE_NAME-amd64"  "$CLUSTER_IMAGE_NAME_LATEST-amd64"
          sudo sealos tag "$CLUSTER_IMAGE_NAME-arm64"  "$CLUSTER_IMAGE_NAME_LATEST-arm64"

          # Handle Aliyun images if enabled
          if [[ -n "${ALIYUN_CLUSTER_REPO}" ]]; then
            ALIYUN_CLUSTER_IMAGE_NAME="$ALIYUN_CLUSTER_REPO:$TAG_NAME"
            ALIYUN_CLUSTER_IMAGE_NAME_LATEST="$ALIYUN_CLUSTER_REPO:latest"
            sudo sealos tag "$ALIYUN_CLUSTER_IMAGE_NAME-amd64"  "$ALIYUN_CLUSTER_IMAGE_NAME_LATEST-amd64"
            sudo sealos tag "$ALIYUN_CLUSTER_IMAGE_NAME-arm64"  "$ALIYUN_CLUSTER_IMAGE_NAME_LATEST-arm64"
          fi

          sudo sealos images

          # Create manifests for GHCR
          bash scripts/manifest-cluster-images.sh "$CLUSTER_IMAGE_NAME"
          bash scripts/manifest-cluster-images.sh "$CLUSTER_IMAGE_NAME_LATEST"

          # Create manifests for Aliyun if enabled
          if [[ -n "${ALIYUN_CLUSTER_REPO}" ]]; then
            bash scripts/manifest-cluster-images.sh "$ALIYUN_CLUSTER_IMAGE_NAME"
            bash scripts/manifest-cluster-images.sh "$ALIYUN_CLUSTER_IMAGE_NAME_LATEST"
          fi