Skip to content

Commit c4e5cbf

Browse files
danny-aviladanny-avila
authored
ci: gate the legacy mirror behind an environment (#328)
1 parent 0029515 commit c4e5cbf

2 files changed

Lines changed: 68 additions & 32 deletions

File tree

‎.github/workflows/docker-build-workflow.yaml‎

Lines changed: 34 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -64,20 +64,36 @@ jobs:
6464
platforms: linux/amd64,linux/arm64
6565
target: ${{ matrix.target }}
6666

67-
# After the repository moves to another owner, deployments still pull the old
68-
# GHCR namespace. Copying each published tag there keeps them updating until the
69-
# deprecation window closes. Copies are cross-repo blob mounts within GHCR, so no
70-
# image data is rebuilt or re-uploaded.
71-
#
72-
# Set the LEGACY_GHCR_OWNER variable and the LEGACY_GHCR_TOKEN secret (a token with
73-
# write:packages for that owner) to turn this on. It stays off when either is unset,
74-
# and while the owner still matches the one publishing the images.
75-
- name: Mirror tags to the legacy namespace
76-
if: ${{ vars.LEGACY_GHCR_OWNER != '' }}
77-
continue-on-error: true
67+
# After the repository moved to another owner, deployments still pull the old GHCR
68+
# namespace. Copying each published tag there keeps them updating until the deprecation
69+
# window closes. Copies are cross-repo blob mounts within GHCR, so no image data is
70+
# rebuilt or re-uploaded.
71+
#
72+
# It runs in its own job so the credential that can write to the legacy namespace lives
73+
# in an environment, out of reach of workflows on other branches, and so a mirror failure
74+
# cannot fail a publish.
75+
#
76+
# Set the LEGACY_GHCR_OWNER variable and the LEGACY_GHCR_TOKEN secret (a token with
77+
# write:packages for that owner) to turn this on.
78+
mirror:
79+
name: Mirror ${{ matrix.image_name }} to the legacy namespace
80+
if: ${{ vars.LEGACY_GHCR_OWNER != '' }}
81+
needs: build
82+
runs-on: ubuntu-latest
83+
timeout-minutes: 15
84+
continue-on-error: true
85+
environment: legacy-mirror
86+
strategy:
87+
fail-fast: false
88+
matrix:
89+
image_name: [librechat-rag-api-dev, librechat-rag-api-dev-lite]
90+
91+
steps:
92+
- name: Copy the published tags
7893
env:
7994
LEGACY_OWNER: ${{ vars.LEGACY_GHCR_OWNER }}
8095
LEGACY_TOKEN: ${{ secrets.LEGACY_GHCR_TOKEN }}
96+
IMAGE_NAME: ${{ matrix.image_name }}
8197
TAGS: "${{ github.sha }} ${{ inputs.tag }}"
8298
run: |
8399
set -euo pipefail
@@ -92,12 +108,14 @@ jobs:
92108
exit 0
93109
fi
94110
95-
# The pull side needs this login too: it replaces the GITHUB_TOKEN credential
96-
# for ghcr.io, and both namespaces are read with it.
111+
# Registry names must be lowercase, and the repository owner is not guaranteed to be.
112+
source_image="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/${IMAGE_NAME}"
113+
legacy_image="ghcr.io/${legacy_owner}/${IMAGE_NAME}"
114+
115+
# This login reads both namespaces: it replaces the default ghcr.io credential.
97116
echo "$LEGACY_TOKEN" | docker login ghcr.io -u "$legacy_owner" --password-stdin
98117
99-
legacy_image="ghcr.io/${legacy_owner}/${GHCR_IMAGE##*/}"
100118
for tag in $TAGS; do
101-
echo "Mirroring ${GHCR_IMAGE}:${tag} -> ${legacy_image}:${tag}"
102-
docker buildx imagetools create -t "${legacy_image}:${tag}" "${GHCR_IMAGE}:${tag}"
119+
echo "Mirroring ${source_image}:${tag} -> ${legacy_image}:${tag}"
120+
docker buildx imagetools create -t "${legacy_image}:${tag}" "${source_image}:${tag}"
103121
done

‎.github/workflows/images.yaml‎

Lines changed: 34 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -78,20 +78,36 @@ jobs:
7878
cache-from: type=gha
7979
cache-to: type=gha,mode=max
8080

81-
# After the repository moves to another owner, deployments still pull the old
82-
# GHCR namespace. Copying each published tag there keeps them updating until the
83-
# deprecation window closes. Copies are cross-repo blob mounts within GHCR, so no
84-
# image data is rebuilt or re-uploaded.
85-
#
86-
# Set the LEGACY_GHCR_OWNER variable and the LEGACY_GHCR_TOKEN secret (a token with
87-
# write:packages for that owner) to turn this on. It stays off when either is unset,
88-
# and while the owner still matches the one publishing the images.
89-
- name: Mirror tags to the legacy namespace
90-
if: ${{ vars.LEGACY_GHCR_OWNER != '' }}
91-
continue-on-error: true
81+
# After the repository moved to another owner, deployments still pull the old GHCR
82+
# namespace. Copying each published tag there keeps them updating until the deprecation
83+
# window closes. Copies are cross-repo blob mounts within GHCR, so no image data is
84+
# rebuilt or re-uploaded.
85+
#
86+
# It runs in its own job so the credential that can write to the legacy namespace lives
87+
# in an environment, out of reach of workflows on other branches, and so a mirror failure
88+
# cannot fail a publish.
89+
#
90+
# Set the LEGACY_GHCR_OWNER variable and the LEGACY_GHCR_TOKEN secret (a token with
91+
# write:packages for that owner) to turn this on.
92+
mirror:
93+
name: Mirror ${{ matrix.image_name }} to the legacy namespace
94+
if: ${{ vars.LEGACY_GHCR_OWNER != '' }}
95+
needs: build
96+
runs-on: ubuntu-latest
97+
timeout-minutes: 15
98+
continue-on-error: true
99+
environment: legacy-mirror
100+
strategy:
101+
fail-fast: false
102+
matrix:
103+
image_name: [librechat-rag-api-dev, librechat-rag-api-dev-lite]
104+
105+
steps:
106+
- name: Copy the published tags
92107
env:
93108
LEGACY_OWNER: ${{ vars.LEGACY_GHCR_OWNER }}
94109
LEGACY_TOKEN: ${{ secrets.LEGACY_GHCR_TOKEN }}
110+
IMAGE_NAME: ${{ matrix.image_name }}
95111
TAGS: "${{ github.sha }} latest"
96112
run: |
97113
set -euo pipefail
@@ -106,12 +122,14 @@ jobs:
106122
exit 0
107123
fi
108124
109-
# The pull side needs this login too: it replaces the GITHUB_TOKEN credential
110-
# for ghcr.io, and both namespaces are read with it.
125+
# Registry names must be lowercase, and the repository owner is not guaranteed to be.
126+
source_image="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/${IMAGE_NAME}"
127+
legacy_image="ghcr.io/${legacy_owner}/${IMAGE_NAME}"
128+
129+
# This login reads both namespaces: it replaces the default ghcr.io credential.
111130
echo "$LEGACY_TOKEN" | docker login ghcr.io -u "$legacy_owner" --password-stdin
112131
113-
legacy_image="ghcr.io/${legacy_owner}/${GHCR_IMAGE##*/}"
114132
for tag in $TAGS; do
115-
echo "Mirroring ${GHCR_IMAGE}:${tag} -> ${legacy_image}:${tag}"
116-
docker buildx imagetools create -t "${legacy_image}:${tag}" "${GHCR_IMAGE}:${tag}"
133+
echo "Mirroring ${source_image}:${tag} -> ${legacy_image}:${tag}"
134+
docker buildx imagetools create -t "${legacy_image}:${tag}" "${source_image}:${tag}"
117135
done

0 commit comments

Comments
 (0)