Orchids Desktop
8341c98e38
Some checks failed
Memory limit test (temporary branch) / limit-visible (push) Successful in 3s
Memory limit test (temporary branch) / plain-step-uses-2gb (push) Failing after 8s
Memory limit test (temporary branch) / kaniko-run-step-uses-2gb (push) Failing after 27s
Memory limit test (temporary branch) / kaniko-normal-build (push) Successful in 6s
92 lines
4 KiB
Bash
Executable file
92 lines
4 KiB
Bash
Executable file
#!/busybox/sh
|
|
# scotty-git shared action: build and push a container image with Kaniko.
|
|
# Inputs arrive as INPUT_<NAME> environment variables (see action.yml).
|
|
# Never prints credentials. The registry login only exists inside this short-lived container.
|
|
set -eu
|
|
|
|
fail() { printf '::error::%s\n' "$*"; exit 1; }
|
|
|
|
DESTINATION=${INPUT_DESTINATION:-}
|
|
CONTEXT=${INPUT_CONTEXT:-.}
|
|
DOCKERFILE=${INPUT_DOCKERFILE:-Dockerfile}
|
|
PUSH=${INPUT_PUSH:-true}
|
|
REGISTRY=${INPUT_REGISTRY:-}
|
|
USERNAME=${INPUT_USERNAME:-}
|
|
PASSWORD=${INPUT_PASSWORD:-}
|
|
GCP_KEY_JSON=${INPUT_GCP_KEY_JSON:-}
|
|
CACHE_REPO=${INPUT_CACHE_REPO:-}
|
|
BUILD_ARGS=${INPUT_BUILD_ARGS:-}
|
|
EXTRA_ARGS=${INPUT_EXTRA_ARGS:-}
|
|
|
|
# ---- Source: the repository the job already checked out ----
|
|
WS=${GITHUB_WORKSPACE:-}
|
|
if [ -z "$WS" ] || [ ! -d "$WS" ]; then fail "No checked-out workspace found. Add 'uses: actions/checkout@v4' before this step."; fi
|
|
if [ ! -d "$WS/$CONTEXT" ]; then fail "Build context '$CONTEXT' does not exist in the repository."; fi
|
|
if [ ! -f "$WS/$DOCKERFILE" ]; then fail "Dockerfile '$DOCKERFILE' not found in the repository."; fi
|
|
|
|
# ---- Destinations ----
|
|
DESTS=$(printf '%s' "$DESTINATION" | tr ',\n' ' ')
|
|
if [ "$PUSH" = "true" ] && [ -z "$(printf '%s' "$DESTS" | tr -d ' ')" ]; then
|
|
fail "'destination' is required when push is true."
|
|
fi
|
|
|
|
# ---- Registry login (written only inside this container) ----
|
|
mkdir -p /kaniko/.docker
|
|
if [ -z "$REGISTRY" ]; then
|
|
for d in $DESTS; do REGISTRY=${d%%/*}; break; done
|
|
if [ -z "$REGISTRY" ] && [ -n "$CACHE_REPO" ]; then REGISTRY=${CACHE_REPO%%/*}; fi
|
|
fi
|
|
AUTH=""
|
|
if [ -n "$GCP_KEY_JSON" ]; then
|
|
AUTH=$(printf '_json_key:%s' "$GCP_KEY_JSON" | base64 | tr -d '\n')
|
|
elif [ -n "$USERNAME" ] && [ -n "$PASSWORD" ]; then
|
|
AUTH=$(printf '%s:%s' "$USERNAME" "$PASSWORD" | base64 | tr -d '\n')
|
|
elif [ -n "$USERNAME" ] || [ -n "$PASSWORD" ]; then
|
|
fail "Set both 'username' and 'password', or neither."
|
|
fi
|
|
if [ -n "$AUTH" ]; then
|
|
if [ -z "$REGISTRY" ]; then fail "Could not tell which registry the credentials are for; set 'registry'."; fi
|
|
printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$REGISTRY" "$AUTH" > /kaniko/.docker/config.json
|
|
echo "Logged in to $REGISTRY for this build."
|
|
fi
|
|
|
|
# ---- Executor flags ----
|
|
set -- --context "dir://$WS/$CONTEXT" --dockerfile "$WS/$DOCKERFILE" --cleanup
|
|
if [ "$PUSH" = "true" ]; then
|
|
for d in $DESTS; do set -- "$@" --destination "$d"; done
|
|
set -- "$@" --digest-file /kaniko/digest
|
|
else
|
|
set -- "$@" --no-push
|
|
for d in $DESTS; do set -- "$@" --destination "$d"; done
|
|
fi
|
|
if [ -n "$CACHE_REPO" ]; then set -- "$@" --cache=true --cache-repo "$CACHE_REPO"; fi
|
|
OLDIFS=$IFS
|
|
IFS='
|
|
'
|
|
for a in $BUILD_ARGS; do
|
|
if [ -n "$a" ]; then set -- "$@" --build-arg "$a"; fi
|
|
done
|
|
IFS=$OLDIFS
|
|
# shellcheck disable=SC2086 # extra_args is deliberately split into separate flags
|
|
if [ -n "$EXTRA_ARGS" ]; then set -- "$@" $EXTRA_ARGS; fi
|
|
|
|
echo "Building $DOCKERFILE (context: $CONTEXT)$( [ "$PUSH" = "true" ] && echo " -> $DESTS" || echo ", not pushing")"
|
|
# Keep a copy of the output: when a RUN step (not Kaniko itself) is killed for memory,
|
|
# Kaniko exits 1 and only its message says "exit status 137".
|
|
{ /kaniko/executor "$@" 2>&1; echo "$?" > /kaniko/exit-code; } | tee /kaniko/build.log
|
|
RC=$(cat /kaniko/exit-code 2>/dev/null || echo 1)
|
|
if [ "$RC" -ne 0 ] && grep -q 'exit status 137' /kaniko/build.log; then RC=137; fi
|
|
if [ "$RC" -eq 137 ]; then
|
|
LIMIT="${SCOTTY_GIT_JOB_MEMORY_LIMIT:-1.5 GB}"
|
|
fail "Build stopped: this job hit scotty-git's per-job memory limit ($LIMIT) and was killed (exit code 137). The limit protects the shared git server. Reduce the build's memory use (e.g. fewer parallel steps in the Dockerfile, smaller dependencies), or ask the scotty-git admins for a larger runner."
|
|
elif [ "$RC" -ne 0 ]; then
|
|
fail "Kaniko build failed (exit code $RC). See the Kaniko output above for the failing step."
|
|
fi
|
|
|
|
# ---- Output ----
|
|
if [ "$PUSH" = "true" ] && [ -f /kaniko/digest ]; then
|
|
DIGEST=$(cat /kaniko/digest)
|
|
echo "Pushed: $DIGEST"
|
|
if [ -n "${GITHUB_OUTPUT:-}" ]; then echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"; fi
|
|
fi
|
|
exit 0
|