Skip to content

Commit d8cf875

Browse files
maldwgmaldwg
authored
Merge pull request #38 from Hamstring-NDR/feature/docker-cleanup
Feature/docker cleanup
2 parents dd671d4 + 5541c30 commit d8cf875

10 files changed

Lines changed: 321 additions & 198 deletions

File tree

‎.github/workflows/build_publish_docker.yml‎

Lines changed: 0 additions & 76 deletions
This file was deleted.

‎.github/workflows/publish_dev.yml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
name: Publish Docker Images (dev)
2+
3+
# Triggers on direct pushes to the 'dev' branch, which includes PR merges.
4+
on:
5+
push:
6+
branches: [ "dev" ]
7+
8+
env:
9+
REGISTRY: ghcr.io
10+
11+
jobs:
12+
bump-version:
13+
name: Bump VERSION file
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: write # needed to push the updated VERSION file back
17+
outputs:
18+
new_version: ${{ steps.bump.outputs.version }}
19+
20+
steps:
21+
- name: Checkout repository
22+
uses: actions/checkout@v4
23+
with:
24+
token: ${{ secrets.PAT_TOKEN }}
25+
fetch-depth: 0
26+
27+
- name: Detect source branch and bump version
28+
id: bump
29+
run: |
30+
# ── Detect source branch from merge commit subject ──────────────────
31+
# Standard merge commit message: "Merge branch 'feature/foo' into dev"
32+
MERGE_SUBJECT="$(git log --merges -1 --pretty=%s HEAD)"
33+
echo "Merge subject: ${MERGE_SUBJECT}"
34+
35+
SOURCE=$(echo "$MERGE_SUBJECT" | sed -n "s/Merge branch '\([^']*\)'.*/\1/p")
36+
SOURCE="${SOURCE#origin/}" # strip remote prefix if present
37+
38+
if [[ -z "$SOURCE" ]]; then
39+
SOURCE="unknown"
40+
echo "::warning::Could not detect source branch; defaulting to 'unknown' (no bump)."
41+
fi
42+
echo "Detected source branch: ${SOURCE}"
43+
44+
# ── Read and parse current VERSION ──────────────────────────────────
45+
RAW="$(cat VERSION | tr -d '[:space:]')"
46+
CLEAN="${RAW#v}" # strip leading v
47+
CLEAN="${CLEAN%-dev}" # strip any existing -dev suffix
48+
IFS='.' read -r MAJOR MINOR PATCH <<< "$CLEAN"
49+
50+
# ── Apply bump based on branch prefix ────────────────────────────────
51+
PREFIX="${SOURCE%%/*}"
52+
case "$PREFIX" in
53+
feature)
54+
MINOR=$(( MINOR + 1 )); PATCH=0
55+
;;
56+
bugfix|hotfix)
57+
PATCH=$(( PATCH + 1 ))
58+
;;
59+
release)
60+
MAJOR=$(( MAJOR + 1 )); MINOR=0; PATCH=0
61+
;;
62+
*)
63+
# unknown / no recognisable prefix → no bump
64+
;;
65+
esac
66+
67+
# ── Compose new version with -dev suffix ─────────────────────────────
68+
NEW_VERSION="v${MAJOR}.${MINOR}.${PATCH}-dev"
69+
echo "${NEW_VERSION}" > VERSION
70+
71+
echo "version=${NEW_VERSION}" >> "$GITHUB_OUTPUT"
72+
echo "New version: ${NEW_VERSION}"
73+
74+
- name: Commit and push updated VERSION
75+
run: |
76+
git config user.name "github-actions[bot]"
77+
git config user.email "github-actions[bot]@users.noreply.github.com"
78+
git add VERSION
79+
git commit -m "chore: bump version to ${{ steps.bump.outputs.version }} [skip ci]"
80+
git push
81+
82+
build-and-push:
83+
name: Build & Push ${{ matrix.container }}
84+
needs: bump-version
85+
runs-on: ubuntu-latest
86+
strategy:
87+
fail-fast: false
88+
matrix:
89+
container:
90+
- detector
91+
- inspector
92+
- logcollector
93+
- logserver
94+
- prefilter
95+
- monitoring
96+
- alerter
97+
permissions:
98+
contents: read
99+
packages: write
100+
id-token: write
101+
102+
steps:
103+
- name: Checkout repository
104+
uses: actions/checkout@v4
105+
with:
106+
ref: dev # pick up the commit that includes the updated VERSION
107+
108+
- name: Setup Docker buildx
109+
uses: docker/setup-buildx-action@v3
110+
111+
- name: Log into registry ${{ env.REGISTRY }}
112+
uses: docker/login-action@v3
113+
with:
114+
registry: ${{ env.REGISTRY }}
115+
username: ${{ github.actor }}
116+
password: ${{ secrets.GITHUB_TOKEN }}
117+
118+
- name: Extract Docker metadata
119+
id: meta
120+
uses: docker/metadata-action@v5
121+
with:
122+
images: ${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.container }}
123+
tags: |
124+
type=raw,value=${{ needs.bump-version.outputs.new_version }}
125+
type=raw,value=latest-dev
126+
127+
- name: Build and push Docker image
128+
uses: docker/build-push-action@v5
129+
with:
130+
context: .
131+
push: true
132+
tags: ${{ steps.meta.outputs.tags }}
133+
labels: ${{ steps.meta.outputs.labels }}
134+
file: ./docker/dockerfiles/Dockerfile.${{ matrix.container }}
135+
cache-from: type=gha
136+
cache-to: type=gha,mode=max

‎.github/workflows/publish_main.yml‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
name: Publish Docker Images (main)
2+
3+
# Triggers on direct pushes to 'main', which includes PR/merge-commit merges.
4+
on:
5+
push:
6+
branches: [ "main" ]
7+
8+
env:
9+
REGISTRY: ghcr.io
10+
11+
jobs:
12+
bump-version:
13+
name: Bump VERSION file
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: write # needed to push back VERSION + Git tag
17+
outputs:
18+
new_version: ${{ steps.bump.outputs.version }}
19+
20+
steps:
21+
- name: Checkout repository
22+
uses: actions/checkout@v4
23+
with:
24+
token: ${{ secrets.PAT_TOKEN }}
25+
fetch-depth: 0
26+
27+
- name: Detect source branch and bump version
28+
id: bump
29+
run: |
30+
# ── Detect source branch from merge commit subject ──────────────────
31+
# Standard merge commit message: "Merge branch 'feature/foo' into main"
32+
MERGE_SUBJECT="$(git log --merges -1 --pretty=%s HEAD)"
33+
echo "Merge subject: ${MERGE_SUBJECT}"
34+
35+
SOURCE=$(echo "$MERGE_SUBJECT" | sed -n "s/Merge branch '\([^']*\)'.*/\1/p")
36+
SOURCE="${SOURCE#origin/}" # strip remote prefix if present
37+
38+
if [[ -z "$SOURCE" ]]; then
39+
SOURCE="unknown"
40+
echo "::warning::Could not detect source branch; defaulting to 'unknown' (no bump)."
41+
fi
42+
echo "Detected source branch: ${SOURCE}"
43+
44+
# ── Read and parse current VERSION ──────────────────────────────────
45+
RAW="$(cat VERSION | tr -d '[:space:]')"
46+
CLEAN="${RAW#v}" # strip leading v
47+
CLEAN="${CLEAN%-dev}" # strip any existing -dev suffix
48+
IFS='.' read -r MAJOR MINOR PATCH <<< "$CLEAN"
49+
50+
# ── Decide bump strategy ─────────────────────────────────────────────
51+
# When the source branch is 'dev', the version was already incremented
52+
# on the dev side — just promote it by stripping '-dev' (no new bump).
53+
# For any other source branch, apply the normal semver bump.
54+
if [[ "$SOURCE" != "dev" ]]; then
55+
PREFIX="${SOURCE%%/*}"
56+
case "$PREFIX" in
57+
feature)
58+
MINOR=$(( MINOR + 1 )); PATCH=0
59+
;;
60+
bugfix|hotfix)
61+
PATCH=$(( PATCH + 1 ))
62+
;;
63+
release)
64+
MAJOR=$(( MAJOR + 1 )); MINOR=0; PATCH=0
65+
;;
66+
*)
67+
# unknown prefix → no bump
68+
;;
69+
esac
70+
fi
71+
72+
# ── Compose new version (no -dev suffix on main) ─────────────────────
73+
NEW_VERSION="v${MAJOR}.${MINOR}.${PATCH}"
74+
echo "${NEW_VERSION}" > VERSION
75+
76+
echo "version=${NEW_VERSION}" >> "$GITHUB_OUTPUT"
77+
echo "New version: ${NEW_VERSION}"
78+
79+
- name: Commit and push updated VERSION
80+
run: |
81+
git config user.name "github-actions[bot]"
82+
git config user.email "github-actions[bot]@users.noreply.github.com"
83+
git add VERSION
84+
git commit -m "chore: release ${{ steps.bump.outputs.version }} [skip ci]"
85+
git push
86+
87+
- name: Create and push Git release tag
88+
run: |
89+
git tag "${{ steps.bump.outputs.version }}"
90+
git push origin "${{ steps.bump.outputs.version }}"
91+
92+
build-and-push:
93+
name: Build & Push ${{ matrix.container }}
94+
needs: bump-version
95+
runs-on: ubuntu-latest
96+
strategy:
97+
fail-fast: false
98+
matrix:
99+
container:
100+
- detector
101+
- inspector
102+
- logcollector
103+
- logserver
104+
- prefilter
105+
- monitoring
106+
- alerter
107+
permissions:
108+
contents: read
109+
packages: write
110+
id-token: write
111+
112+
steps:
113+
- name: Checkout repository
114+
uses: actions/checkout@v4
115+
with:
116+
ref: main # pick up the commit that includes the updated VERSION
117+
118+
- name: Derive partial version tags
119+
id: version
120+
run: |
121+
VERSION="$(cat VERSION | tr -d '[:space:]')"
122+
CLEAN="${VERSION#v}"
123+
MAJOR="${CLEAN%%.*}"
124+
MINOR_PATCH="${CLEAN#*.}"
125+
MINOR="${MINOR_PATCH%%.*}"
126+
echo "major=v${MAJOR}" >> "$GITHUB_OUTPUT"
127+
echo "major_minor=v${MAJOR}.${MINOR}" >> "$GITHUB_OUTPUT"
128+
129+
- name: Setup Docker buildx
130+
uses: docker/setup-buildx-action@v3
131+
132+
- name: Log into registry ${{ env.REGISTRY }}
133+
uses: docker/login-action@v3
134+
with:
135+
registry: ${{ env.REGISTRY }}
136+
username: ${{ github.actor }}
137+
password: ${{ secrets.GITHUB_TOKEN }}
138+
139+
- name: Extract Docker metadata
140+
id: meta
141+
uses: docker/metadata-action@v5
142+
with:
143+
images: ${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.container }}
144+
tags: |
145+
type=raw,value=${{ needs.bump-version.outputs.new_version }}
146+
type=raw,value=${{ steps.version.outputs.major_minor }}
147+
type=raw,value=${{ steps.version.outputs.major }}
148+
type=raw,value=latest
149+
150+
- name: Build and push Docker image
151+
uses: docker/build-push-action@v5
152+
with:
153+
context: .
154+
push: true
155+
tags: ${{ steps.meta.outputs.tags }}
156+
labels: ${{ steps.meta.outputs.labels }}
157+
file: ./docker/dockerfiles/Dockerfile.${{ matrix.container }}
158+
cache-from: type=gha
159+
cache-to: type=gha,mode=max

‎VERSION‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
v1.0.0

‎config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ pipeline:
122122

123123
zeek:
124124
sensors:
125-
zeek-1:
125+
zeek:
126126
static_analysis: true
127127
protocols:
128128
- dns

0 commit comments

Comments
 (0)