Orchids Desktop
5ca003ad5c
All checks were successful
Self-test kaniko-build / build-without-push (push) Successful in 6s
Every job on the scotty-git runner is now limited to 1.5 GB of memory (--memory=1536m, set on the runner) so no workflow can take down the git server it shares a VM with. When a build step is stopped by that limit, Kaniko only reports "exit status 137"; the action now prints a clear error naming the limit and what to do. README gains a "Runner limits" section that explains exit code 137 for every workflow, not just image builds. Tested on a temporary branch: a 2 GB step is stopped at ~1.5 GB, the Kaniko message appears, and a normal build still succeeds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
92 lines
4 KiB
Bash
Executable file
92 lines
4 KiB
Bash
Executable file
#!/busybox/sh
|
|
# scotty-git shared action: build and push a container image with Kaniko.
|
|
# Inputs arrive as INPUT_<NAME> environment variables (see action.yml).
|
|
# Never prints credentials. The registry login only exists inside this short-lived container.
|
|
set -eu
|
|
|
|
fail() { printf '::error::%s\n' "$*"; exit 1; }
|
|
|
|
DESTINATION=${INPUT_DESTINATION:-}
|
|
CONTEXT=${INPUT_CONTEXT:-.}
|
|
DOCKERFILE=${INPUT_DOCKERFILE:-Dockerfile}
|
|
PUSH=${INPUT_PUSH:-true}
|
|
REGISTRY=${INPUT_REGISTRY:-}
|
|
USERNAME=${INPUT_USERNAME:-}
|
|
PASSWORD=${INPUT_PASSWORD:-}
|
|
GCP_KEY_JSON=${INPUT_GCP_KEY_JSON:-}
|
|
CACHE_REPO=${INPUT_CACHE_REPO:-}
|
|
BUILD_ARGS=${INPUT_BUILD_ARGS:-}
|
|
EXTRA_ARGS=${INPUT_EXTRA_ARGS:-}
|
|
|
|
# ---- Source: the repository the job already checked out ----
|
|
WS=${GITHUB_WORKSPACE:-}
|
|
if [ -z "$WS" ] || [ ! -d "$WS" ]; then fail "No checked-out workspace found. Add 'uses: actions/checkout@v4' before this step."; fi
|
|
if [ ! -d "$WS/$CONTEXT" ]; then fail "Build context '$CONTEXT' does not exist in the repository."; fi
|
|
if [ ! -f "$WS/$DOCKERFILE" ]; then fail "Dockerfile '$DOCKERFILE' not found in the repository."; fi
|
|
|
|
# ---- Destinations ----
|
|
DESTS=$(printf '%s' "$DESTINATION" | tr ',\n' ' ')
|
|
if [ "$PUSH" = "true" ] && [ -z "$(printf '%s' "$DESTS" | tr -d ' ')" ]; then
|
|
fail "'destination' is required when push is true."
|
|
fi
|
|
|
|
# ---- Registry login (written only inside this container) ----
|
|
mkdir -p /kaniko/.docker
|
|
if [ -z "$REGISTRY" ]; then
|
|
for d in $DESTS; do REGISTRY=${d%%/*}; break; done
|
|
if [ -z "$REGISTRY" ] && [ -n "$CACHE_REPO" ]; then REGISTRY=${CACHE_REPO%%/*}; fi
|
|
fi
|
|
AUTH=""
|
|
if [ -n "$GCP_KEY_JSON" ]; then
|
|
AUTH=$(printf '_json_key:%s' "$GCP_KEY_JSON" | base64 | tr -d '\n')
|
|
elif [ -n "$USERNAME" ] && [ -n "$PASSWORD" ]; then
|
|
AUTH=$(printf '%s:%s' "$USERNAME" "$PASSWORD" | base64 | tr -d '\n')
|
|
elif [ -n "$USERNAME" ] || [ -n "$PASSWORD" ]; then
|
|
fail "Set both 'username' and 'password', or neither."
|
|
fi
|
|
if [ -n "$AUTH" ]; then
|
|
if [ -z "$REGISTRY" ]; then fail "Could not tell which registry the credentials are for; set 'registry'."; fi
|
|
printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$REGISTRY" "$AUTH" > /kaniko/.docker/config.json
|
|
echo "Logged in to $REGISTRY for this build."
|
|
fi
|
|
|
|
# ---- Executor flags ----
|
|
set -- --context "dir://$WS/$CONTEXT" --dockerfile "$WS/$DOCKERFILE" --cleanup
|
|
if [ "$PUSH" = "true" ]; then
|
|
for d in $DESTS; do set -- "$@" --destination "$d"; done
|
|
set -- "$@" --digest-file /kaniko/digest
|
|
else
|
|
set -- "$@" --no-push
|
|
for d in $DESTS; do set -- "$@" --destination "$d"; done
|
|
fi
|
|
if [ -n "$CACHE_REPO" ]; then set -- "$@" --cache=true --cache-repo "$CACHE_REPO"; fi
|
|
OLDIFS=$IFS
|
|
IFS='
|
|
'
|
|
for a in $BUILD_ARGS; do
|
|
if [ -n "$a" ]; then set -- "$@" --build-arg "$a"; fi
|
|
done
|
|
IFS=$OLDIFS
|
|
# shellcheck disable=SC2086 # extra_args is deliberately split into separate flags
|
|
if [ -n "$EXTRA_ARGS" ]; then set -- "$@" $EXTRA_ARGS; fi
|
|
|
|
echo "Building $DOCKERFILE (context: $CONTEXT)$( [ "$PUSH" = "true" ] && echo " -> $DESTS" || echo ", not pushing")"
|
|
# Keep a copy of the output: when a RUN step (not Kaniko itself) is killed for memory,
|
|
# Kaniko exits 1 and only its message says "exit status 137".
|
|
{ /kaniko/executor "$@" 2>&1; echo "$?" > /kaniko/exit-code; } | tee /kaniko/build.log
|
|
RC=$(cat /kaniko/exit-code 2>/dev/null || echo 1)
|
|
if [ "$RC" -ne 0 ] && grep -q 'exit status 137' /kaniko/build.log; then RC=137; fi
|
|
if [ "$RC" -eq 137 ]; then
|
|
LIMIT="${SCOTTY_GIT_JOB_MEMORY_LIMIT:-1.5 GB}"
|
|
fail "Build stopped: this job hit scotty-git's per-job memory limit ($LIMIT) and was killed (exit code 137). The limit protects the shared git server. Reduce the build's memory use (e.g. fewer parallel steps in the Dockerfile, smaller dependencies), or ask the scotty-git admins for a larger runner."
|
|
elif [ "$RC" -ne 0 ]; then
|
|
fail "Kaniko build failed (exit code $RC). See the Kaniko output above for the failing step."
|
|
fi
|
|
|
|
# ---- Output ----
|
|
if [ "$PUSH" = "true" ] && [ -f /kaniko/digest ]; then
|
|
DIGEST=$(cat /kaniko/digest)
|
|
echo "Pushed: $DIGEST"
|
|
if [ -n "${GITHUB_OUTPUT:-}" ]; then echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"; fi
|
|
fi
|
|
exit 0
|