shadowdaoandClaude Opus 5.5
3a6cab19ee
Dockerfile.litespeed / Dockerfile.lsphp: one global
ARG BASE_IMAGE=litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER}
used by every stage (incl. the emergency lsphp-src stage, which stays on
upstream repos). The stages that run lsphp-apt-upgrade.sh (litespeed final,
lsphp ext-build + final) take ARG PKG_CACHE=, ship pkg-cache-repos.sh +
keys/pkg-cache/, and wrap the upgrade in `pkg-cache-repos.sh apt` ...
`pkg-cache-repos.sh restore`. Without PKG_CACHE both are no-ops.
lsphp-apt-upgrade.sh: the madison gate also accepts ${PKG_CACHE}/litespeed/
as the lsphp source, but only when PKG_CACHE is set.
build-push.yaml: Build-LiteSpeed-Images and Build-LSPHP-Images resolve the
base digest directly from Docker Hub, probe the cache, set up buildx with
the registry mirror only for a pinned base, and pass BASE_IMAGE + PKG_CACHE.
OLS_VERSION (1.8.4) is now a job-level env read by both the digest lookup
and the build-arg.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
817 lines
41 KiB
YAML
817 lines
41 KiB
YAML
name: Cloud Apache Container
|
||
run-name: ${{ gitea.actor }} pushed a change to trunk
|
||
on:
|
||
push:
|
||
branches:
|
||
- trunk
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
# Shell gate. Runs FIRST and costs seconds; the images below do not depend on
|
||
# it (a red job here does not block a push that is otherwise fine), but it is
|
||
# the only place the ENTRYPOINT logic is executed at all. The .phpt suite and
|
||
# the Dockerfile's `lsphp -i` probe both test the extension, and both were
|
||
# green for the release whose entrypoint declared that same extension
|
||
# missing — see scripts/tests/lsphp-info-probe.test.sh for what went wrong
|
||
# and why it needed a test outside the image build to catch it.
|
||
Shell-Checks:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
# Runner images differ on whether they are root and whether sudo exists.
|
||
- name: Install shellcheck
|
||
run: |
|
||
if ! command -v shellcheck >/dev/null 2>&1; then
|
||
(apt-get update && apt-get install -y shellcheck) ||
|
||
(sudo apt-get update && sudo apt-get install -y shellcheck)
|
||
fi
|
||
shellcheck --version
|
||
|
||
- name: Syntax check every shell script
|
||
run: |
|
||
set -euo pipefail
|
||
find scripts ext -name '*.sh' -print0 | xargs -0 -n1 bash -n
|
||
|
||
# Deliberately NOT repo-wide. The older scripts (entrypoint.sh,
|
||
# entrypoint-fpm.sh, create-vhost.sh, create-php-config.sh,
|
||
# detect-memory.sh) carry pre-existing SC2154/SC2027 findings that predate
|
||
# this job; listing them here would make the gate red on arrival and
|
||
# therefore ignored. This is the set that is clean today — the scripts
|
||
# that run `set -o pipefail` plus the tests. Add files as they are fixed;
|
||
# do not add one that is not yet clean.
|
||
- name: shellcheck (warnings and above, on the clean set)
|
||
run: |
|
||
shellcheck -S warning \
|
||
scripts/entrypoint-lsphp.sh \
|
||
scripts/entrypoint-litespeed.sh \
|
||
scripts/entrypoint-shared-ols.sh \
|
||
scripts/render-shared-ols-config.sh \
|
||
scripts/ols-htaccess-watcher.sh \
|
||
scripts/create-vhost-litespeed.sh \
|
||
scripts/install-lscache-wp.sh \
|
||
scripts/lsphp-apt-upgrade.sh \
|
||
scripts/lsphp-src-build.sh \
|
||
scripts/lsphp-src-overlay.sh \
|
||
scripts/lsphp-abi-gate.sh \
|
||
scripts/tune-mpm.sh \
|
||
scripts/tests/lsphp-info-probe.test.sh \
|
||
scripts/tests/lsphp-abi-gate.test.sh \
|
||
.gitea/scripts/resolve-base-image.sh
|
||
|
||
- name: lsphp probe regression test
|
||
run: ./scripts/tests/lsphp-info-probe.test.sh
|
||
|
||
# The emergency php.net lsphp path (lsphp-source-emergency.yaml) keeps
|
||
# LiteSpeed's PECL .so files only if this gate says the Zend ABI is
|
||
# unchanged; prove here, on every push, that the gate can still FAIL.
|
||
- name: lsphp ABI gate regression test
|
||
run: |
|
||
if ! command -v pahole >/dev/null 2>&1 || ! command -v gcc >/dev/null 2>&1; then
|
||
(apt-get update && apt-get install -y gcc dwarves) ||
|
||
(sudo apt-get update && sudo apt-get install -y gcc dwarves)
|
||
fi
|
||
./scripts/tests/lsphp-abi-gate.test.sh
|
||
|
||
Build-and-Push:
|
||
runs-on: ubuntu-latest
|
||
strategy:
|
||
# One PHP version failing (e.g. an EOL stream) must not cancel the
|
||
# security builds of the others.
|
||
fail-fast: false
|
||
matrix:
|
||
phpver: [82, 83, 84, 85]
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
# Base image pinned by DIGEST, looked up directly at Docker Hub (never via
|
||
# the pkg-cache mirror), so the mirror can only serve content-addressed
|
||
# blobs that BuildKit verifies. If the lookup fails this job does NOT use
|
||
# the mirror and pulls the tag straight from Docker Hub. docs/pkg-cache.md.
|
||
- name: Resolve base image digest (Docker Hub, direct)
|
||
id: base
|
||
env:
|
||
BASE_TAG: almalinux/10-base:latest
|
||
run: |
|
||
set -uo pipefail
|
||
if ref=$(.gitea/scripts/resolve-base-image.sh "$BASE_TAG") && [[ "$ref" =~ ^[a-z0-9][a-z0-9._/-]*@sha256:[0-9a-f]{64}$ ]]; then
|
||
echo "base-image: ${BASE_TAG} -> ${ref} (digest from registry-1.docker.io)"
|
||
echo "image=${ref}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=true" >> "$GITHUB_OUTPUT"
|
||
else
|
||
echo "::warning::base image ${BASE_TAG}: Docker Hub digest lookup failed - pulling the tag directly from Docker Hub, pkg-cache registry mirror NOT used"
|
||
echo "image=${BASE_TAG}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=false" >> "$GITHUB_OUTPUT"
|
||
fi
|
||
|
||
# Internal package cache (CT130 pkg-cache, docs/pkg-cache.md). Used ONLY if
|
||
# it answers over TLS with our pinned CA; otherwise (down, unreachable,
|
||
# bad/expired cert) this job builds from the upstream repos and Docker Hub
|
||
# exactly as before. The repo cache and the registry mirror are probed
|
||
# separately so either can fail back on its own.
|
||
- name: Probe package cache
|
||
id: pkgcache
|
||
# The registry mirror is only used for a digest-pinned base image.
|
||
env:
|
||
BASE_PINNED: ${{ steps.base.outputs.pinned }}
|
||
run: |
|
||
url=""; mirror=""
|
||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
||
if [ "$BASE_PINNED" = true ] && curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
||
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<not used: Docker Hub direct>}"
|
||
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
||
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
||
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: Set up QEMU
|
||
uses: docker/setup-qemu-action@v3
|
||
|
||
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
||
# so the mirror is configured on the builder; BuildKit itself still falls
|
||
# back to Docker Hub if the mirror stops answering mid-run.
|
||
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
||
if: steps.pkgcache.outputs.mirror != ''
|
||
uses: docker/setup-buildx-action@v3
|
||
with:
|
||
buildkitd-config-inline: |
|
||
[registry."docker.io"]
|
||
mirrors = ["192.168.1.40:5000"]
|
||
[registry."192.168.1.40:5000"]
|
||
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
||
|
||
- name: Set up Docker Buildx
|
||
if: steps.pkgcache.outputs.mirror == ''
|
||
uses: docker/setup-buildx-action@v3
|
||
|
||
# Per-run cache-bust value. Each job's buildx builder is created fresh by
|
||
# setup-buildx-action (no cache-from/cache-to here), so today nothing is
|
||
# cached between runs — this keeps it that way if a cache is ever added:
|
||
# the package-upgrade layers consume CACHE_BUST and can never be reused.
|
||
- name: Cache-bust value
|
||
id: bust
|
||
env:
|
||
RUN_ID: ${{ gitea.run_id }}
|
||
run: echo "value=$(date -u +%Y%m%dT%H%M%SZ)-${RUN_ID}" >> "$GITHUB_OUTPUT"
|
||
|
||
# The minimum PHP version this build must ship: php.net's current release for
|
||
# the branch (over HTTPS). The Dockerfile fails if Remi gave us anything older,
|
||
# so lagging mirrors or replayed repo metadata can't ship a vulnerable PHP.
|
||
- name: Resolve current PHP release from php.net
|
||
id: phpmin
|
||
# Values reach the script via env, never via ${{ }} inside run: (a
|
||
# crafted string would otherwise be shell); outputs are regex-checked.
|
||
env:
|
||
PHPVER: ${{ matrix.phpver }}
|
||
run: |
|
||
set -euo pipefail
|
||
v="$PHPVER"; branch="${v:0:1}.${v:1}"
|
||
json=$(curl -fsS --retry 5 --max-time 60 "https://www.php.net/releases/index.php?json&max=1&version=${branch}")
|
||
min=$(printf '%s' "$json" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(next(iter(d)) if isinstance(d,dict) and d else "")')
|
||
if [ -z "$min" ]; then echo "::error::no php.net release found for ${branch}"; exit 1; fi
|
||
[[ "$min" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "::error::php.net returned a malformed version for ${branch}"; exit 1; }
|
||
echo "php.net current ${branch}: ${min}"
|
||
echo "min=${min}" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: Login to Gitea
|
||
uses: docker/login-action@v3
|
||
with:
|
||
registry: repo.anhonesthost.net
|
||
username: ${{ secrets.CI_USER }}
|
||
password: ${{ secrets.CI_TOKEN }}
|
||
|
||
- name: Build and Push Image
|
||
uses: docker/build-push-action@v6
|
||
with:
|
||
platforms: linux/amd64
|
||
push: true
|
||
build-args: |
|
||
PHPVER=${{ matrix.phpver }}
|
||
CACHE_BUST=${{ steps.bust.outputs.value }}
|
||
BASE_IMAGE=${{ steps.base.outputs.image }}
|
||
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
||
EXPECT_PHP_MIN=${{ steps.phpmin.outputs.min }}
|
||
tags: |
|
||
repo.anhonesthost.net/cloud-hosting-platform/cac:php${{ matrix.phpver }}
|
||
${{ matrix.phpver == '85' && 'repo.anhonesthost.net/cloud-hosting-platform/cac:latest' || '' }}
|
||
|
||
Build-FPM-Images:
|
||
runs-on: ubuntu-latest
|
||
strategy:
|
||
# One PHP version failing (e.g. an EOL stream) must not cancel the
|
||
# security builds of the others.
|
||
fail-fast: false
|
||
matrix:
|
||
phpver: [82, 83, 84, 85]
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
# Base image pinned by DIGEST, looked up directly at Docker Hub (never via
|
||
# the pkg-cache mirror), so the mirror can only serve content-addressed
|
||
# blobs that BuildKit verifies. If the lookup fails this job does NOT use
|
||
# the mirror and pulls the tag straight from Docker Hub. docs/pkg-cache.md.
|
||
- name: Resolve base image digest (Docker Hub, direct)
|
||
id: base
|
||
env:
|
||
BASE_TAG: almalinux/10-base:latest
|
||
run: |
|
||
set -uo pipefail
|
||
if ref=$(.gitea/scripts/resolve-base-image.sh "$BASE_TAG") && [[ "$ref" =~ ^[a-z0-9][a-z0-9._/-]*@sha256:[0-9a-f]{64}$ ]]; then
|
||
echo "base-image: ${BASE_TAG} -> ${ref} (digest from registry-1.docker.io)"
|
||
echo "image=${ref}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=true" >> "$GITHUB_OUTPUT"
|
||
else
|
||
echo "::warning::base image ${BASE_TAG}: Docker Hub digest lookup failed - pulling the tag directly from Docker Hub, pkg-cache registry mirror NOT used"
|
||
echo "image=${BASE_TAG}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=false" >> "$GITHUB_OUTPUT"
|
||
fi
|
||
|
||
# Internal package cache (CT130 pkg-cache, docs/pkg-cache.md). Used ONLY if
|
||
# it answers over TLS with our pinned CA; otherwise (down, unreachable,
|
||
# bad/expired cert) this job builds from the upstream repos and Docker Hub
|
||
# exactly as before. The repo cache and the registry mirror are probed
|
||
# separately so either can fail back on its own.
|
||
- name: Probe package cache
|
||
id: pkgcache
|
||
# The registry mirror is only used for a digest-pinned base image.
|
||
env:
|
||
BASE_PINNED: ${{ steps.base.outputs.pinned }}
|
||
run: |
|
||
url=""; mirror=""
|
||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
||
if [ "$BASE_PINNED" = true ] && curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
||
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<not used: Docker Hub direct>}"
|
||
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
||
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
||
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: Set up QEMU
|
||
uses: docker/setup-qemu-action@v3
|
||
|
||
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
||
# so the mirror is configured on the builder; BuildKit itself still falls
|
||
# back to Docker Hub if the mirror stops answering mid-run.
|
||
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
||
if: steps.pkgcache.outputs.mirror != ''
|
||
uses: docker/setup-buildx-action@v3
|
||
with:
|
||
buildkitd-config-inline: |
|
||
[registry."docker.io"]
|
||
mirrors = ["192.168.1.40:5000"]
|
||
[registry."192.168.1.40:5000"]
|
||
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
||
|
||
- name: Set up Docker Buildx
|
||
if: steps.pkgcache.outputs.mirror == ''
|
||
uses: docker/setup-buildx-action@v3
|
||
|
||
# Per-run cache-bust value. Each job's buildx builder is created fresh by
|
||
# setup-buildx-action (no cache-from/cache-to here), so today nothing is
|
||
# cached between runs — this keeps it that way if a cache is ever added:
|
||
# the package-upgrade layers consume CACHE_BUST and can never be reused.
|
||
- name: Cache-bust value
|
||
id: bust
|
||
env:
|
||
RUN_ID: ${{ gitea.run_id }}
|
||
run: echo "value=$(date -u +%Y%m%dT%H%M%SZ)-${RUN_ID}" >> "$GITHUB_OUTPUT"
|
||
|
||
# The minimum PHP version this build must ship: php.net's current release for
|
||
# the branch (over HTTPS). The Dockerfile fails if Remi gave us anything older,
|
||
# so lagging mirrors or replayed repo metadata can't ship a vulnerable PHP.
|
||
- name: Resolve current PHP release from php.net
|
||
id: phpmin
|
||
# Values reach the script via env, never via ${{ }} inside run: (a
|
||
# crafted string would otherwise be shell); outputs are regex-checked.
|
||
env:
|
||
PHPVER: ${{ matrix.phpver }}
|
||
run: |
|
||
set -euo pipefail
|
||
v="$PHPVER"; branch="${v:0:1}.${v:1}"
|
||
json=$(curl -fsS --retry 5 --max-time 60 "https://www.php.net/releases/index.php?json&max=1&version=${branch}")
|
||
min=$(printf '%s' "$json" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(next(iter(d)) if isinstance(d,dict) and d else "")')
|
||
if [ -z "$min" ]; then echo "::error::no php.net release found for ${branch}"; exit 1; fi
|
||
[[ "$min" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "::error::php.net returned a malformed version for ${branch}"; exit 1; }
|
||
echo "php.net current ${branch}: ${min}"
|
||
echo "min=${min}" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: Login to Gitea
|
||
uses: docker/login-action@v3
|
||
with:
|
||
registry: repo.anhonesthost.net
|
||
username: ${{ secrets.CI_USER }}
|
||
password: ${{ secrets.CI_TOKEN }}
|
||
|
||
- name: Build and Push FPM Image
|
||
uses: docker/build-push-action@v6
|
||
with:
|
||
file: ./Dockerfile.fpm
|
||
platforms: linux/amd64
|
||
push: true
|
||
build-args: |
|
||
PHPVER=${{ matrix.phpver }}
|
||
CACHE_BUST=${{ steps.bust.outputs.value }}
|
||
BASE_IMAGE=${{ steps.base.outputs.image }}
|
||
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
||
EXPECT_PHP_MIN=${{ steps.phpmin.outputs.min }}
|
||
tags: |
|
||
repo.anhonesthost.net/cloud-hosting-platform/cac-fpm:php${{ matrix.phpver }}
|
||
${{ matrix.phpver == '85' && 'repo.anhonesthost.net/cloud-hosting-platform/cac-fpm:latest' || '' }}
|
||
|
||
Build-LiteSpeed-Images:
|
||
runs-on: ubuntu-latest
|
||
# One place for the OLS base tag: digest lookup and build-args both read it.
|
||
# OLS_VERSION pinned to 1.8.4 (see the build step); Dockerfile default differs.
|
||
env:
|
||
OLS_VERSION: "1.8.4"
|
||
strategy:
|
||
# One PHP version failing (e.g. an EOL stream) must not cancel the
|
||
# security builds of the others.
|
||
fail-fast: false
|
||
matrix:
|
||
# PHP 7.4/8.0 deliberately excluded — the LiteSpeed prebuilt base
|
||
# images stop at older OLS releases for those PHP versions, and the
|
||
# cac-litespeed tier is a paid premium offering: 8.1+ is the
|
||
# modernization story we're selling.
|
||
phpver: [82, 83, 84, 85]
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
# Base image pinned by DIGEST, looked up directly at Docker Hub (never via
|
||
# the pkg-cache mirror), so the mirror can only serve content-addressed
|
||
# blobs that BuildKit verifies. If the lookup fails this job does NOT use
|
||
# the mirror and pulls the tag straight from Docker Hub. docs/pkg-cache.md.
|
||
- name: Resolve base image digest (Docker Hub, direct)
|
||
id: base
|
||
env:
|
||
BASE_TAG: litespeedtech/openlitespeed:${{ env.OLS_VERSION }}-lsphp${{ matrix.phpver }}
|
||
run: |
|
||
set -uo pipefail
|
||
if ref=$(.gitea/scripts/resolve-base-image.sh "$BASE_TAG") && [[ "$ref" =~ ^[a-z0-9][a-z0-9._/-]*@sha256:[0-9a-f]{64}$ ]]; then
|
||
echo "base-image: ${BASE_TAG} -> ${ref} (digest from registry-1.docker.io)"
|
||
echo "image=${ref}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=true" >> "$GITHUB_OUTPUT"
|
||
else
|
||
echo "::warning::base image ${BASE_TAG}: Docker Hub digest lookup failed - pulling the tag directly from Docker Hub, pkg-cache registry mirror NOT used"
|
||
echo "image=${BASE_TAG}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=false" >> "$GITHUB_OUTPUT"
|
||
fi
|
||
|
||
# Internal package cache (CT130 pkg-cache, docs/pkg-cache.md). Used ONLY if
|
||
# it answers over TLS with our pinned CA; otherwise (down, unreachable,
|
||
# bad/expired cert) this job builds from the upstream repos and Docker Hub
|
||
# exactly as before. The repo cache and the registry mirror are probed
|
||
# separately so either can fail back on its own.
|
||
- name: Probe package cache
|
||
id: pkgcache
|
||
# The registry mirror is only used for a digest-pinned base image.
|
||
env:
|
||
BASE_PINNED: ${{ steps.base.outputs.pinned }}
|
||
run: |
|
||
url=""; mirror=""
|
||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
||
if [ "$BASE_PINNED" = true ] && curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
||
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<not used: Docker Hub direct>}"
|
||
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
||
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
||
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: Set up QEMU
|
||
uses: docker/setup-qemu-action@v3
|
||
|
||
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
||
# so the mirror is configured on the builder; BuildKit itself still falls
|
||
# back to Docker Hub if the mirror stops answering mid-run.
|
||
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
||
if: steps.pkgcache.outputs.mirror != ''
|
||
uses: docker/setup-buildx-action@v3
|
||
with:
|
||
buildkitd-config-inline: |
|
||
[registry."docker.io"]
|
||
mirrors = ["192.168.1.40:5000"]
|
||
[registry."192.168.1.40:5000"]
|
||
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
||
|
||
- name: Set up Docker Buildx
|
||
if: steps.pkgcache.outputs.mirror == ''
|
||
uses: docker/setup-buildx-action@v3
|
||
|
||
# Per-run cache-bust value. Each job's buildx builder is created fresh by
|
||
# setup-buildx-action (no cache-from/cache-to here), so today nothing is
|
||
# cached between runs — this keeps it that way if a cache is ever added:
|
||
# the package-upgrade layers consume CACHE_BUST and can never be reused.
|
||
- name: Cache-bust value
|
||
id: bust
|
||
env:
|
||
RUN_ID: ${{ gitea.run_id }}
|
||
run: echo "value=$(date -u +%Y%m%dT%H%M%SZ)-${RUN_ID}" >> "$GITHUB_OUTPUT"
|
||
|
||
# Ask the LiteSpeed apt repo (the same one the base image's apt uses) for the
|
||
# CURRENT lsphp version. The Dockerfile asserts the installed package equals
|
||
# this (build fails if the repo changed mid-build — just re-run) and writes
|
||
# it into the image labels org.whp.php-version / org.whp.lsphp-package-version.
|
||
- name: Resolve current lsphp${{ matrix.phpver }} from the LiteSpeed repo
|
||
id: lsphp
|
||
# HTTPS (rpms.litespeedtech.com serves it; measured 2026-10-21), values via
|
||
# env, and both outputs regex-checked before they reach GITHUB_OUTPUT.
|
||
env:
|
||
PHPVER: ${{ matrix.phpver }}
|
||
run: |
|
||
set -euo pipefail
|
||
idx=$(curl -fsS --proto '=https' --retry 3 --max-time 60 https://rpms.litespeedtech.com/debian/dists/noble/main/binary-amd64/Packages)
|
||
pkg=$(printf '%s\n' "$idx" | awk -v p="lsphp${PHPVER}" '/^Package: /{n=$2} /^Version: / && n==p {print $2}' | sort -V | tail -n1)
|
||
if [ -z "$pkg" ]; then echo "::error::lsphp${PHPVER} not found in the LiteSpeed repo index"; exit 1; fi
|
||
php="${pkg%%-*}"
|
||
[[ "$pkg" =~ ^[0-9][0-9A-Za-z.+~:-]*$ ]] || { echo "::error::malformed lsphp${PHPVER} package version in the repo index"; exit 1; }
|
||
[[ "$php" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "::error::malformed PHP version '${php}' derived from lsphp${PHPVER} ${pkg}"; exit 1; }
|
||
echo "lsphp${PHPVER} in repo: $pkg (PHP ${php})"
|
||
echo "pkg=$pkg" >> "$GITHUB_OUTPUT"
|
||
echo "php=${php}" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: Login to Gitea
|
||
uses: docker/login-action@v3
|
||
with:
|
||
registry: repo.anhonesthost.net
|
||
username: ${{ secrets.CI_USER }}
|
||
password: ${{ secrets.CI_TOKEN }}
|
||
|
||
# A php.net emergency build (lsphp-source-emergency.yaml) may be what
|
||
# :phpNN points at right now. While LiteSpeed still lags, a normal build
|
||
# would silently put the VULNERABLE packaged lsphp back. Refuse instead;
|
||
# the job goes green again by itself once the LiteSpeed repo catches up.
|
||
# Fail-open if the tag cannot be inspected (first build, registry blip).
|
||
- name: Do not roll back a newer php.net emergency image
|
||
env:
|
||
PHPVER: ${{ matrix.phpver }}
|
||
NEW_PHP: ${{ steps.lsphp.outputs.php }}
|
||
run: |
|
||
set -euo pipefail
|
||
ref="repo.anhonesthost.net/cloud-hosting-platform/cac-litespeed:php${PHPVER}"
|
||
src=$(docker buildx imagetools inspect "$ref" --format '{{ index .Image.Config.Labels "org.whp.lsphp-source" }}' 2>/dev/null || true)
|
||
cur=$(docker buildx imagetools inspect "$ref" --format '{{ index .Image.Config.Labels "org.whp.php-version" }}' 2>/dev/null || true)
|
||
new="$NEW_PHP"
|
||
echo "published $ref: source=${src:-?} php=${cur:-?}; this build: packaged $new"
|
||
if [ "$src" = "php.net" ] && [ "$cur" != "$new" ] && [ "$(printf '%s\n%s\n' "$cur" "$new" | sort -V | tail -n1)" = "$cur" ]; then
|
||
echo "::error::$ref is a php.net emergency build of PHP $cur; LiteSpeed still ships $new. Not overwriting it with an older PHP. Re-run lsphp-source-emergency.yaml for a newer fix, or wait for LiteSpeed."
|
||
exit 1
|
||
fi
|
||
|
||
- name: Build and Push LiteSpeed Image
|
||
uses: docker/build-push-action@v6
|
||
with:
|
||
file: ./Dockerfile.litespeed
|
||
platforms: linux/amd64
|
||
push: true
|
||
build-args: |
|
||
PHPVER=${{ matrix.phpver }}
|
||
OLS_VERSION=${{ env.OLS_VERSION }}
|
||
BASE_IMAGE=${{ steps.base.outputs.image }}
|
||
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
||
CACHE_BUST=${{ steps.bust.outputs.value }}
|
||
EXPECT_LSPHP_PKG=${{ steps.lsphp.outputs.pkg }}
|
||
EXPECT_PHP_VERSION=${{ steps.lsphp.outputs.php }}
|
||
# OLS_VERSION pinned to 1.8.4. It was the only release with an lsphp81
|
||
# variant; 8.1 and older are no longer built (2026-10-21), so the pin
|
||
# can move to a newer OLS release after a local rebuild test.
|
||
# See spec: docs/superpowers/specs/2026-06-01-cac-litespeed-design.md
|
||
tags: |
|
||
repo.anhonesthost.net/cloud-hosting-platform/cac-litespeed:php${{ matrix.phpver }}
|
||
${{ matrix.phpver == '85' && 'repo.anhonesthost.net/cloud-hosting-platform/cac-litespeed:latest' || '' }}
|
||
|
||
Build-LSPHP-Images:
|
||
runs-on: ubuntu-latest
|
||
# One place for the OLS base tag: digest lookup and build-args both read it.
|
||
# OLS_VERSION pinned to 1.8.4 (see the build step); Dockerfile default differs.
|
||
env:
|
||
OLS_VERSION: "1.8.4"
|
||
strategy:
|
||
# One PHP version failing (e.g. an EOL stream) must not cancel the
|
||
# security builds of the others.
|
||
fail-fast: false
|
||
matrix:
|
||
# Same PHP matrix as cac-litespeed (81–85): cac-lsphp is the detached
|
||
# backend for the shared-ols tier and shares the litespeed prebuilt
|
||
# base, which only ships lsphp for 8.1+. Keep this matrix in lockstep
|
||
# with Build-LiteSpeed-Images.
|
||
phpver: [82, 83, 84, 85]
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
# Base image pinned by DIGEST, looked up directly at Docker Hub (never via
|
||
# the pkg-cache mirror), so the mirror can only serve content-addressed
|
||
# blobs that BuildKit verifies. If the lookup fails this job does NOT use
|
||
# the mirror and pulls the tag straight from Docker Hub. docs/pkg-cache.md.
|
||
- name: Resolve base image digest (Docker Hub, direct)
|
||
id: base
|
||
env:
|
||
BASE_TAG: litespeedtech/openlitespeed:${{ env.OLS_VERSION }}-lsphp${{ matrix.phpver }}
|
||
run: |
|
||
set -uo pipefail
|
||
if ref=$(.gitea/scripts/resolve-base-image.sh "$BASE_TAG") && [[ "$ref" =~ ^[a-z0-9][a-z0-9._/-]*@sha256:[0-9a-f]{64}$ ]]; then
|
||
echo "base-image: ${BASE_TAG} -> ${ref} (digest from registry-1.docker.io)"
|
||
echo "image=${ref}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=true" >> "$GITHUB_OUTPUT"
|
||
else
|
||
echo "::warning::base image ${BASE_TAG}: Docker Hub digest lookup failed - pulling the tag directly from Docker Hub, pkg-cache registry mirror NOT used"
|
||
echo "image=${BASE_TAG}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=false" >> "$GITHUB_OUTPUT"
|
||
fi
|
||
|
||
# Internal package cache (CT130 pkg-cache, docs/pkg-cache.md). Used ONLY if
|
||
# it answers over TLS with our pinned CA; otherwise (down, unreachable,
|
||
# bad/expired cert) this job builds from the upstream repos and Docker Hub
|
||
# exactly as before. The repo cache and the registry mirror are probed
|
||
# separately so either can fail back on its own.
|
||
- name: Probe package cache
|
||
id: pkgcache
|
||
# The registry mirror is only used for a digest-pinned base image.
|
||
env:
|
||
BASE_PINNED: ${{ steps.base.outputs.pinned }}
|
||
run: |
|
||
url=""; mirror=""
|
||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
||
if [ "$BASE_PINNED" = true ] && curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
||
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<not used: Docker Hub direct>}"
|
||
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
||
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
||
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: Set up QEMU
|
||
uses: docker/setup-qemu-action@v3
|
||
|
||
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
||
# so the mirror is configured on the builder; BuildKit itself still falls
|
||
# back to Docker Hub if the mirror stops answering mid-run.
|
||
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
||
if: steps.pkgcache.outputs.mirror != ''
|
||
uses: docker/setup-buildx-action@v3
|
||
with:
|
||
buildkitd-config-inline: |
|
||
[registry."docker.io"]
|
||
mirrors = ["192.168.1.40:5000"]
|
||
[registry."192.168.1.40:5000"]
|
||
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
||
|
||
- name: Set up Docker Buildx
|
||
if: steps.pkgcache.outputs.mirror == ''
|
||
uses: docker/setup-buildx-action@v3
|
||
|
||
# Per-run cache-bust value. Each job's buildx builder is created fresh by
|
||
# setup-buildx-action (no cache-from/cache-to here), so today nothing is
|
||
# cached between runs — this keeps it that way if a cache is ever added:
|
||
# the package-upgrade layers consume CACHE_BUST and can never be reused.
|
||
- name: Cache-bust value
|
||
id: bust
|
||
env:
|
||
RUN_ID: ${{ gitea.run_id }}
|
||
run: echo "value=$(date -u +%Y%m%dT%H%M%SZ)-${RUN_ID}" >> "$GITHUB_OUTPUT"
|
||
|
||
# Ask the LiteSpeed apt repo (the same one the base image's apt uses) for the
|
||
# CURRENT lsphp version. The Dockerfile asserts the installed package equals
|
||
# this (build fails if the repo changed mid-build — just re-run) and writes
|
||
# it into the image labels org.whp.php-version / org.whp.lsphp-package-version.
|
||
- name: Resolve current lsphp${{ matrix.phpver }} from the LiteSpeed repo
|
||
id: lsphp
|
||
# HTTPS (rpms.litespeedtech.com serves it; measured 2026-10-21), values via
|
||
# env, and both outputs regex-checked before they reach GITHUB_OUTPUT.
|
||
env:
|
||
PHPVER: ${{ matrix.phpver }}
|
||
run: |
|
||
set -euo pipefail
|
||
idx=$(curl -fsS --proto '=https' --retry 3 --max-time 60 https://rpms.litespeedtech.com/debian/dists/noble/main/binary-amd64/Packages)
|
||
pkg=$(printf '%s\n' "$idx" | awk -v p="lsphp${PHPVER}" '/^Package: /{n=$2} /^Version: / && n==p {print $2}' | sort -V | tail -n1)
|
||
if [ -z "$pkg" ]; then echo "::error::lsphp${PHPVER} not found in the LiteSpeed repo index"; exit 1; fi
|
||
php="${pkg%%-*}"
|
||
[[ "$pkg" =~ ^[0-9][0-9A-Za-z.+~:-]*$ ]] || { echo "::error::malformed lsphp${PHPVER} package version in the repo index"; exit 1; }
|
||
[[ "$php" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "::error::malformed PHP version '${php}' derived from lsphp${PHPVER} ${pkg}"; exit 1; }
|
||
echo "lsphp${PHPVER} in repo: $pkg (PHP ${php})"
|
||
echo "pkg=$pkg" >> "$GITHUB_OUTPUT"
|
||
echo "php=${php}" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: Login to Gitea
|
||
uses: docker/login-action@v3
|
||
with:
|
||
registry: repo.anhonesthost.net
|
||
username: ${{ secrets.CI_USER }}
|
||
password: ${{ secrets.CI_TOKEN }}
|
||
|
||
# A php.net emergency build (lsphp-source-emergency.yaml) may be what
|
||
# :phpNN points at right now. While LiteSpeed still lags, a normal build
|
||
# would silently put the VULNERABLE packaged lsphp back. Refuse instead;
|
||
# the job goes green again by itself once the LiteSpeed repo catches up.
|
||
# Fail-open if the tag cannot be inspected (first build, registry blip).
|
||
- name: Do not roll back a newer php.net emergency image
|
||
env:
|
||
PHPVER: ${{ matrix.phpver }}
|
||
NEW_PHP: ${{ steps.lsphp.outputs.php }}
|
||
run: |
|
||
set -euo pipefail
|
||
ref="repo.anhonesthost.net/cloud-hosting-platform/cac-lsphp:php${PHPVER}"
|
||
src=$(docker buildx imagetools inspect "$ref" --format '{{ index .Image.Config.Labels "org.whp.lsphp-source" }}' 2>/dev/null || true)
|
||
cur=$(docker buildx imagetools inspect "$ref" --format '{{ index .Image.Config.Labels "org.whp.php-version" }}' 2>/dev/null || true)
|
||
new="$NEW_PHP"
|
||
echo "published $ref: source=${src:-?} php=${cur:-?}; this build: packaged $new"
|
||
if [ "$src" = "php.net" ] && [ "$cur" != "$new" ] && [ "$(printf '%s\n%s\n' "$cur" "$new" | sort -V | tail -n1)" = "$cur" ]; then
|
||
echo "::error::$ref is a php.net emergency build of PHP $cur; LiteSpeed still ships $new. Not overwriting it with an older PHP. Re-run lsphp-source-emergency.yaml for a newer fix, or wait for LiteSpeed."
|
||
exit 1
|
||
fi
|
||
|
||
- name: Build and Push lsphp Image
|
||
uses: docker/build-push-action@v6
|
||
with:
|
||
file: ./Dockerfile.lsphp
|
||
platforms: linux/amd64
|
||
push: true
|
||
build-args: |
|
||
PHPVER=${{ matrix.phpver }}
|
||
OLS_VERSION=${{ env.OLS_VERSION }}
|
||
BASE_IMAGE=${{ steps.base.outputs.image }}
|
||
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
||
CACHE_BUST=${{ steps.bust.outputs.value }}
|
||
EXPECT_LSPHP_PKG=${{ steps.lsphp.outputs.pkg }}
|
||
EXPECT_PHP_VERSION=${{ steps.lsphp.outputs.php }}
|
||
# OLS_VERSION pinned to 1.8.4 to match Build-LiteSpeed-Images — same
|
||
# prebuilt base, same lsphp binaries. Bump both together.
|
||
tags: |
|
||
repo.anhonesthost.net/cloud-hosting-platform/cac-lsphp:php${{ matrix.phpver }}
|
||
${{ matrix.phpver == '85' && 'repo.anhonesthost.net/cloud-hosting-platform/cac-lsphp:latest' || '' }}
|
||
|
||
Build-Shared-httpd:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
# Base image pinned by DIGEST, looked up directly at Docker Hub (never via
|
||
# the pkg-cache mirror), so the mirror can only serve content-addressed
|
||
# blobs that BuildKit verifies. If the lookup fails this job does NOT use
|
||
# the mirror and pulls the tag straight from Docker Hub. docs/pkg-cache.md.
|
||
- name: Resolve base image digest (Docker Hub, direct)
|
||
id: base
|
||
env:
|
||
BASE_TAG: almalinux/10-base:latest
|
||
run: |
|
||
set -uo pipefail
|
||
if ref=$(.gitea/scripts/resolve-base-image.sh "$BASE_TAG") && [[ "$ref" =~ ^[a-z0-9][a-z0-9._/-]*@sha256:[0-9a-f]{64}$ ]]; then
|
||
echo "base-image: ${BASE_TAG} -> ${ref} (digest from registry-1.docker.io)"
|
||
echo "image=${ref}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=true" >> "$GITHUB_OUTPUT"
|
||
else
|
||
echo "::warning::base image ${BASE_TAG}: Docker Hub digest lookup failed - pulling the tag directly from Docker Hub, pkg-cache registry mirror NOT used"
|
||
echo "image=${BASE_TAG}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=false" >> "$GITHUB_OUTPUT"
|
||
fi
|
||
|
||
# Internal package cache (CT130 pkg-cache, docs/pkg-cache.md). Used ONLY if
|
||
# it answers over TLS with our pinned CA; otherwise (down, unreachable,
|
||
# bad/expired cert) this job builds from the upstream repos and Docker Hub
|
||
# exactly as before. The repo cache and the registry mirror are probed
|
||
# separately so either can fail back on its own.
|
||
- name: Probe package cache
|
||
id: pkgcache
|
||
# The registry mirror is only used for a digest-pinned base image.
|
||
env:
|
||
BASE_PINNED: ${{ steps.base.outputs.pinned }}
|
||
run: |
|
||
url=""; mirror=""
|
||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
||
if [ "$BASE_PINNED" = true ] && curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
||
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<not used: Docker Hub direct>}"
|
||
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
||
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
||
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: Set up QEMU
|
||
uses: docker/setup-qemu-action@v3
|
||
|
||
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
||
# so the mirror is configured on the builder; BuildKit itself still falls
|
||
# back to Docker Hub if the mirror stops answering mid-run.
|
||
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
||
if: steps.pkgcache.outputs.mirror != ''
|
||
uses: docker/setup-buildx-action@v3
|
||
with:
|
||
buildkitd-config-inline: |
|
||
[registry."docker.io"]
|
||
mirrors = ["192.168.1.40:5000"]
|
||
[registry."192.168.1.40:5000"]
|
||
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
||
|
||
- name: Set up Docker Buildx
|
||
if: steps.pkgcache.outputs.mirror == ''
|
||
uses: docker/setup-buildx-action@v3
|
||
|
||
- name: Login to Gitea
|
||
uses: docker/login-action@v3
|
||
with:
|
||
registry: repo.anhonesthost.net
|
||
username: ${{ secrets.CI_USER }}
|
||
password: ${{ secrets.CI_TOKEN }}
|
||
|
||
- name: Build and Push Shared httpd Image
|
||
uses: docker/build-push-action@v6
|
||
with:
|
||
file: ./Dockerfile.shared-httpd
|
||
platforms: linux/amd64
|
||
push: true
|
||
build-args: |
|
||
BASE_IMAGE=${{ steps.base.outputs.image }}
|
||
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
||
tags: |
|
||
repo.anhonesthost.net/cloud-hosting-platform/shared-httpd:latest
|
||
|
||
Build-Shared-OLS:
|
||
runs-on: ubuntu-latest
|
||
# One place for the OLS base tag: digest lookup and build-args both read it.
|
||
env:
|
||
OLS_VERSION: "1.8.4"
|
||
PHPVER: "83"
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
# Base image pinned by DIGEST, looked up directly at Docker Hub (never via
|
||
# the pkg-cache mirror), so the mirror can only serve content-addressed
|
||
# blobs that BuildKit verifies. If the lookup fails this job does NOT use
|
||
# the mirror and pulls the tag straight from Docker Hub. docs/pkg-cache.md.
|
||
- name: Resolve base image digest (Docker Hub, direct)
|
||
id: base
|
||
env:
|
||
BASE_TAG: litespeedtech/openlitespeed:${{ env.OLS_VERSION }}-lsphp${{ env.PHPVER }}
|
||
run: |
|
||
set -uo pipefail
|
||
if ref=$(.gitea/scripts/resolve-base-image.sh "$BASE_TAG") && [[ "$ref" =~ ^[a-z0-9][a-z0-9._/-]*@sha256:[0-9a-f]{64}$ ]]; then
|
||
echo "base-image: ${BASE_TAG} -> ${ref} (digest from registry-1.docker.io)"
|
||
echo "image=${ref}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=true" >> "$GITHUB_OUTPUT"
|
||
else
|
||
echo "::warning::base image ${BASE_TAG}: Docker Hub digest lookup failed - pulling the tag directly from Docker Hub, pkg-cache registry mirror NOT used"
|
||
echo "image=${BASE_TAG}" >> "$GITHUB_OUTPUT"
|
||
echo "pinned=false" >> "$GITHUB_OUTPUT"
|
||
fi
|
||
|
||
# Internal package cache (CT130 pkg-cache, docs/pkg-cache.md). Used ONLY if
|
||
# it answers over TLS with our pinned CA; otherwise (down, unreachable,
|
||
# bad/expired cert) this job builds from the upstream repos and Docker Hub
|
||
# exactly as before. The repo cache and the registry mirror are probed
|
||
# separately so either can fail back on its own.
|
||
- name: Probe package cache
|
||
id: pkgcache
|
||
# The registry mirror is only used for a digest-pinned base image.
|
||
env:
|
||
BASE_PINNED: ${{ steps.base.outputs.pinned }}
|
||
run: |
|
||
url=""; mirror=""
|
||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
||
if [ "$BASE_PINNED" = true ] && curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
||
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<not used: Docker Hub direct>}"
|
||
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
||
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
||
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: Set up QEMU
|
||
uses: docker/setup-qemu-action@v3
|
||
|
||
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
||
# so the mirror is configured on the builder; BuildKit itself still falls
|
||
# back to Docker Hub if the mirror stops answering mid-run.
|
||
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
||
if: steps.pkgcache.outputs.mirror != ''
|
||
uses: docker/setup-buildx-action@v3
|
||
with:
|
||
buildkitd-config-inline: |
|
||
[registry."docker.io"]
|
||
mirrors = ["192.168.1.40:5000"]
|
||
[registry."192.168.1.40:5000"]
|
||
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
||
|
||
- name: Set up Docker Buildx
|
||
if: steps.pkgcache.outputs.mirror == ''
|
||
uses: docker/setup-buildx-action@v3
|
||
|
||
- name: Login to Gitea
|
||
uses: docker/login-action@v3
|
||
with:
|
||
registry: repo.anhonesthost.net
|
||
username: ${{ secrets.CI_USER }}
|
||
password: ${{ secrets.CI_TOKEN }}
|
||
|
||
- name: Build and Push Shared OLS Image
|
||
uses: docker/build-push-action@v6
|
||
with:
|
||
file: ./Dockerfile.shared-ols
|
||
platforms: linux/amd64
|
||
push: true
|
||
# Single image (runs no PHP). PHPVER just selects the OLS base tag;
|
||
# pinned to 83 / OLS 1.8.4 to match the rest of the litespeed family.
|
||
build-args: |
|
||
PHPVER=${{ env.PHPVER }}
|
||
OLS_VERSION=${{ env.OLS_VERSION }}
|
||
BASE_IMAGE=${{ steps.base.outputs.image }}
|
||
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
||
tags: |
|
||
repo.anhonesthost.net/cloud-hosting-platform/shared-ols:latest
|