Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 snyk-bot
|
9593aac622 |
@@ -1,172 +0,0 @@
|
||||
name: CI/CD for Psiphon Docker
|
||||
|
||||
on:
|
||||
# Poll upstream Psiphon releases periodically (real builds)
|
||||
schedule:
|
||||
- cron: "0 */6 * * *" # every 6 hours
|
||||
|
||||
# Manual runs, with an option to do a dry run (no push)
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
dry_run:
|
||||
description: "Dry run (build but DO NOT push to Docker Hub)"
|
||||
required: false
|
||||
default: "true"
|
||||
type: choice
|
||||
options:
|
||||
- "true"
|
||||
- "false"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
env:
|
||||
DOCKERHUB_REPO: swarupsengupta2007/psiphon
|
||||
TARGET_PLATFORMS: linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6
|
||||
|
||||
jobs:
|
||||
build-and-push:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up QEMU (for multi-arch)
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Determine dry-run mode
|
||||
id: dryrun
|
||||
run: |
|
||||
if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.dry_run }}" = "true" ]; then
|
||||
echo "dry_run=true" >> "$GITHUB_OUTPUT"
|
||||
echo "Running in DRY-RUN mode (no push to Docker Hub)."
|
||||
else
|
||||
echo "dry_run=false" >> "$GITHUB_OUTPUT"
|
||||
echo "Running in NORMAL mode (will push to Docker Hub if needed)."
|
||||
fi
|
||||
|
||||
- name: Get latest psiphon-tunnel-core release & Go version
|
||||
id: psiphon
|
||||
run: |
|
||||
API_URL="https://api.github.com/repos/Psiphon-Labs/psiphon-tunnel-core/releases/latest"
|
||||
|
||||
echo "Fetching latest release from ${API_URL}"
|
||||
RESPONSE=$(curl -fsSL "$API_URL")
|
||||
|
||||
LATEST_TAG=$(echo "$RESPONSE" | jq -r '.tag_name')
|
||||
if [ -z "$LATEST_TAG" ] || [ "$LATEST_TAG" = "null" ]; then
|
||||
echo "Failed to fetch latest tag from Psiphon-Labs/psiphon-tunnel-core"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
VERSION=${LATEST_TAG#v}
|
||||
|
||||
echo "Latest upstream tag: $LATEST_TAG"
|
||||
echo "Normalized version (without v): $VERSION"
|
||||
|
||||
GO_MOD_URL="https://raw.githubusercontent.com/Psiphon-Labs/psiphon-tunnel-core/${LATEST_TAG}/go.mod"
|
||||
echo "Fetching go.mod from: $GO_MOD_URL"
|
||||
|
||||
curl -fsSL "$GO_MOD_URL" -o /tmp/go.mod
|
||||
|
||||
GO_VERSION=$(awk '/^go [0-9]+\.[0-9]+/ {print $2; exit}' /tmp/go.mod)
|
||||
if [ -z "$GO_VERSION" ]; then
|
||||
echo "Could not determine Go version from go.mod; contents:"
|
||||
cat /tmp/go.mod
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Detected Go version from go.mod: $GO_VERSION"
|
||||
|
||||
echo "latest_tag=$LATEST_TAG" >> "$GITHUB_OUTPUT"
|
||||
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
||||
echo "go_version=$GO_VERSION" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Check if this Psiphon version tag already exists on Docker Hub
|
||||
id: check
|
||||
env:
|
||||
DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
|
||||
VERSION: ${{ steps.psiphon.outputs.version }}
|
||||
run: |
|
||||
echo "Checking if ${DOCKERHUB_REPO}:${VERSION} exists on Docker Hub..."
|
||||
|
||||
STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||
"https://hub.docker.com/v2/repositories/${DOCKERHUB_REPO}/tags/${VERSION}/")
|
||||
|
||||
echo "HTTP status from Docker Hub: $STATUS"
|
||||
|
||||
if [ "$STATUS" -eq 200 ]; then
|
||||
echo "exists=true" >> "$GITHUB_OUTPUT"
|
||||
echo "Image tag ${DOCKERHUB_REPO}:${VERSION} already exists on Docker Hub."
|
||||
else
|
||||
echo "exists=false" >> "$GITHUB_OUTPUT"
|
||||
echo "Image tag ${DOCKERHUB_REPO}:${VERSION} does not exist yet."
|
||||
fi
|
||||
|
||||
- name: Build and (maybe) push multi-arch image
|
||||
# In dry-run: always build (even if tag exists), but do NOT push.
|
||||
# In normal mode: only build if tag does not exist, and push.
|
||||
if: steps.dryrun.outputs.dry_run == 'true' || steps.check.outputs.exists != 'true'
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: ./Dockerfile
|
||||
platforms: ${{ env.TARGET_PLATFORMS }}
|
||||
push: ${{ steps.dryrun.outputs.dry_run != 'true' }}
|
||||
tags: |
|
||||
${{ env.DOCKERHUB_REPO }}:${{ steps.psiphon.outputs.version }}
|
||||
${{ env.DOCKERHUB_REPO }}:latest
|
||||
build-args: |
|
||||
TARGETS= ${{ env.TARGET_PLATFORMS }}
|
||||
GO_VERSION=${{ steps.psiphon.outputs.go_version }}
|
||||
PSIPHON_VERSION=${{ steps.psiphon.outputs.version }}
|
||||
|
||||
- name: Summary of run (dry-run vs real)
|
||||
if: always()
|
||||
env:
|
||||
DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
|
||||
VERSION: ${{ steps.psiphon.outputs.version }}
|
||||
LATEST_TAG: ${{ steps.psiphon.outputs.latest_tag }}
|
||||
GO_VERSION: ${{ steps.psiphon.outputs.go_version }}
|
||||
DRY_RUN: ${{ steps.dryrun.outputs.dry_run }}
|
||||
EXISTS: ${{ steps.check.outputs.exists }}
|
||||
TARGET_PLATFORMS: ${{ env.TARGET_PLATFORMS }}
|
||||
run: |
|
||||
echo "================= CI SUMMARY ================="
|
||||
echo "Upstream Psiphon tag: ${LATEST_TAG}"
|
||||
echo "Normalized version: ${VERSION}"
|
||||
echo "Go toolchain version: ${GO_VERSION}"
|
||||
echo "Target platforms: ${TARGET_PLATFORMS}"
|
||||
echo "Dry-run mode: ${DRY_RUN}"
|
||||
echo "Tag existed on DockerHub: ${EXISTS}"
|
||||
echo "Image tags considered: ${DOCKERHUB_REPO}:${VERSION}, ${DOCKERHUB_REPO}:latest"
|
||||
|
||||
if [ "$DRY_RUN" = "true" ]; then
|
||||
echo ""
|
||||
echo "Result: DRY-RUN"
|
||||
echo " - Image was BUILT locally on the runner."
|
||||
echo " - Image was NOT pushed to Docker Hub."
|
||||
else
|
||||
if [ "$EXISTS" = "true" ]; then
|
||||
echo ""
|
||||
echo "Result: SKIPPED PUSH"
|
||||
echo " - Image tag already existed on Docker Hub."
|
||||
echo " - No new image was built/pushed."
|
||||
else
|
||||
echo ""
|
||||
echo "Result: REAL BUILD & PUSH"
|
||||
echo " - Multi-arch image was built."
|
||||
echo " - Pushed: ${DOCKERHUB_REPO}:${VERSION} and :latest"
|
||||
fi
|
||||
fi
|
||||
echo "==============================================="
|
||||
+4
-4
@@ -17,7 +17,7 @@ fi
|
||||
/go/build.sh ${ARGS}
|
||||
__SCRIPT__
|
||||
|
||||
FROM alpine:3.23.2
|
||||
FROM alpine:3.22.2
|
||||
ARG TARGETOS
|
||||
ARG TARGETARCH
|
||||
ARG TARGETVARIANT
|
||||
@@ -26,7 +26,7 @@ RUN --mount=type=bind,from=psiphon_builder,source=/go/dist,target=/tmp/psiphon \
|
||||
<<__SCRIPT__
|
||||
apk add --no-cache tini
|
||||
cp /tmp/assets/start-psiphon /usr/local/bin/start-psiphon
|
||||
cp /tmp/assets/healthcheck /usr/local/bin/healthcheck
|
||||
cp /tmp/assets/healtcheck /usr/local/bin/healtcheck
|
||||
mkdir -p /etc/psiphon
|
||||
cp /tmp/assets/psiphon.config /etc/psiphon/psiphon.config
|
||||
if [ -z "${TARGETVARIANT}" ]; then
|
||||
@@ -35,9 +35,9 @@ RUN --mount=type=bind,from=psiphon_builder,source=/go/dist,target=/tmp/psiphon \
|
||||
cp /tmp/psiphon/psiphon_${TARGETOS}_${TARGETARCH}_${TARGETVARIANT} /usr/local/bin/psiphon
|
||||
fi
|
||||
chmod +x /usr/local/bin/start-psiphon
|
||||
chmod +x /usr/local/bin/healthcheck
|
||||
chmod +x /usr/local/bin/healtcheck
|
||||
chmod +x /usr/local/bin/psiphon
|
||||
__SCRIPT__
|
||||
ENTRYPOINT ["/sbin/tini", "--"]
|
||||
CMD ["/usr/local/bin/start-psiphon"]
|
||||
HEALTHCHECK --interval=30s --timeout=5s --start-period=2m --retries=3 CMD healthcheck
|
||||
HEALTHCHECK --interval=30s --timeout=5s --start-period=2m --retries=3 CMD healtcheck
|
||||
|
||||
@@ -3,17 +3,12 @@
|
||||
set -euo pipefail
|
||||
IFS=$'\n\t'
|
||||
|
||||
MYPATH=$(dirname "$(readlink -f "$0")")
|
||||
source "${MYPATH}/latest_version.sh"
|
||||
|
||||
function help_message() {
|
||||
echo "Usage: $0 [OPTIONS]"
|
||||
echo "Options:"
|
||||
echo " --targets, -t <targets> Comma-separated list of target platforms (default: current, use 'all' for all supported targets)"
|
||||
echo " --version, -v <version> Psiphon version to build (default: latest available)"
|
||||
echo " --go, -g <version> Go version to use (default: 1.22.7)"
|
||||
echo " --nodockerhub Don't push image to docker.io"
|
||||
echo " --noghcr Don't push image to gchr.io"
|
||||
echo " --load Load the built image into local Docker (cannot be used with --push)"
|
||||
echo " --push Push the built image to Docker Hub (cannot be used with --load)"
|
||||
echo " --supported-targets Show supported targets and exit"
|
||||
@@ -24,8 +19,6 @@ function help_message() {
|
||||
|
||||
EXTRA_BUILD_ARGS=""
|
||||
VERSION=""
|
||||
PUSH_DOCKERHUB=1
|
||||
PUSH_GHCR=1
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
@@ -56,14 +49,6 @@ while [[ $# -gt 0 ]]; do
|
||||
GO_VERSION="$2"
|
||||
shift 2
|
||||
;;
|
||||
--nodockerhub)
|
||||
PUSH_DOCKERHUB=0
|
||||
shift
|
||||
;;
|
||||
--noghcr)
|
||||
PUSH_GHCR=0
|
||||
shift
|
||||
;;
|
||||
--supported-targets)
|
||||
echo "Supported targets: $(get_supported_targets)"
|
||||
exit 0
|
||||
@@ -95,11 +80,6 @@ while [[ $# -gt 0 ]]; do
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ "${PUSH_GHCR}" == "0" && "${PUSH_DOCKERHUB}" == "0" && "${EXTRA_BUILD_ARGS}" == "--push" ]]; then
|
||||
echo "Cannot disable both ghcr and dockerhub with --push"
|
||||
help_message
|
||||
fi
|
||||
|
||||
TARGETS=${TARGETS:-"current"}
|
||||
GO_VERSION=${GO_VERSION:-1.22.7}
|
||||
|
||||
@@ -124,20 +104,9 @@ fi
|
||||
|
||||
DECIPHERED_TARGETS=$(decipher_targets "${TARGETS}")
|
||||
|
||||
TAGS=()
|
||||
|
||||
if [[ "${PUSH_DOCKERHUB}" == "1" ]]; then
|
||||
TAGS+=(-t swarupsengupta2007/psiphon:"${VERSION#v}")
|
||||
TAGS+=(-t swarupsengupta2007/psiphon:latest)
|
||||
fi
|
||||
|
||||
if [[ "${PUSH_GHCR}" == "1" ]]; then
|
||||
TAGS+=(-t ghcr.io/swarupsengupta2007/psiphon:"${VERSION#v}")
|
||||
TAGS+=(-t ghcr.io/swarupsengupta2007/psiphon:latest)
|
||||
fi
|
||||
|
||||
echo docker buildx build \
|
||||
docker buildx build \
|
||||
"${DOCKER_BUILD_ARGS[@]}" \
|
||||
"${TAGS[@]}" \
|
||||
-t swarupsengupta2007/psiphon:"${VERSION#v}" \
|
||||
-t swarupsengupta2007/psiphon:latest \
|
||||
--platform "${DECIPHERED_TARGETS}" . \
|
||||
${EXTRA_BUILD_ARGS}
|
||||
|
||||
Reference in New Issue
Block a user