Rework GitHub Release and Docker Actions

.github/workflows/docker.yml

@@ -9,6 +9,11 @@ on:
 jobs:
   ubuntu:
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
     steps:
     - name: Print environment
       shell: bash
@@ -18,6 +23,8 @@ jobs:
     - uses: actions/setup-python@v5
       with:
         python-version: '3.10'
+        cache: 'pip'
+
     - name: Install dependencies
       run: python3 -m pip install -r docker/requirements.txt
     - name: Install opengrok-tools so that pylint can perform the checks
@@ -33,18 +40,46 @@ jobs:
       run: black --check docker/*.py
     - name: Run isort in check mode
       run: isort --settings-file docker/.isort.cfg docker/*.py  --check --diff
-    - name: Build and optionally push Docker image
-      env:
-        DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-        OPENGROK_REPO_SLUG: ${{ github.repository }}
-        OPENGROK_REF: ${{ github.ref }}
-      run: ./dev/docker.sh
-    - name: Install Python pre-requisites
-      run: python3 -m pip install requests
-    - name: Optionally update README on Docker hub
-      env:
-        OPENGROK_REPO_SLUG: ${{ github.repository }}
-        DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-      run: ./dev/dockerhub_readme.py
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.repository_owner }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v3
+      if: ${{ vars.DOCKER_SLUG != '' }} && ${{ github.event_name != 'pull_request' }}
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+    - name: Extract metadata (tags, labels) for Docker
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: |
+          ${{ vars.DOCKER_SLUG }}
+          ghcr.io/${{ github.repository }}
+        labels: |
+          maintainer="https://github.com/oracle/opengrok"
+          org.opencontainers.image.description="OpenGrok Code Search"
+        tags: |
+          type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+          type=raw,value=master,enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+          type=pep440,pattern={{version}},enable=${{ github.event_name == 'release' }}
+          type=pep440,pattern={{major}}.{{minor}},enable=${{ github.event_name == 'release' }}
+          type=ref,event=branch
+          type=ref,event=pr
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Build and push Docker image
+      id: push
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile
+        platforms: linux/amd64,linux/arm64
+        push: ${{ github.event_name == 'release' || (github.event_name == 'push' && github.ref == 'refs/heads/master') }}
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}

.github/workflows/dockerhub-description.yml

@@ -0,0 +1,22 @@
+name: Update Docker Hub Description
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - docker/README.md
+      - .github/workflows/dockerhub-description.yml
+jobs:
+  dockerHubDescription:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Docker Hub Description
+      if: ${{ vars.DOCKER_SLUG != '' }}
+      uses: peter-evans/dockerhub-description@v4
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+        repository: ${{ vars.DOCKER_SLUG }}
+        readme-filepath: ./docker/README.md

.github/workflows/release.yml

@@ -1,27 +1,12 @@
 name: Release
 
-# TODO: run this only for the oracle/opengrok repository
 on:
   release:
     types: [created]
 
 jobs:
-  get_tag:
-    name: Get tag name
-    outputs:
-      tag: ${{ steps.get_tag.outputs.tag }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout master branch
-        uses: actions/checkout@v4
-      - name: Get the tag name
-        id: get_tag
-        env:
-          OPENGROK_REF: ${{ github.ref }}
-        run: ./dev/ref2tag.sh
   build:
     runs-on: ubuntu-latest
-    needs: get_tag
     steps:
     - name: Checkout master branch
       uses: actions/checkout@v4
@@ -47,18 +32,13 @@ jobs:
       run: ./dev/before
     - name: Build
       run: ./mvnw -DskipTests=true -Dmaven.javadoc.skip=false -B -V package
-    - name: Get upload URL
-      id: get_upload_url
-      env:
-        OPENGROK_TAG: ${{ needs.get_tag.outputs.tag }}
-      run: dev/get_upload_url.sh
     - name: Upload release tarball
       id: upload-release-asset
       uses: actions/upload-release-asset@v1
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
-        upload_url: ${{ steps.get_upload_url.outputs.upload_url }}
-        asset_path: ./distribution/target/opengrok-${{ needs.get_tag.outputs.tag }}.tar.gz
-        asset_name: opengrok-${{ needs.get_tag.outputs.tag }}.tar.gz
-        asset_content_type: application/octet-stream
+        upload_url: ${{ github.event.release.upload_url }}
+        asset_path: ./distribution/target/opengrok-${{ github.event.release.tag_name }}.tar.gz
+        asset_name: opengrok-${{ github.event.release.tag_name }}.tar.gz
+        asset_content_type: application/gzip

Dockerfile

@@ -1,7 +1,7 @@
 # Copyright (c) 2018, 2025 Oracle and/or its affiliates. All rights reserved.
 # Portions Copyright (c) 2020, Chris Fraire <cfraire@me.com>.
 
-FROM ubuntu:jammy AS build
+FROM ubuntu:noble AS build
 
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install --no-install-recommends -y openjdk-21-jdk python3 python3-venv && \
@@ -41,7 +41,7 @@ RUN cp `ls -t distribution/target/*.tar.gz | head -1` /opengrok.tar.gz
 # Store the version in a file so that the tools can report it.
 RUN /mvn/mvnw help:evaluate -Dexpression=project.version -q -DforceStdout > /mvn/VERSION
 
-FROM tomcat:10.1.40-jdk21
+FROM tomcat:10.1.40-jdk21-temurin-noble
 LABEL maintainer="https://github.com/oracle/opengrok"
 LABEL org.opencontainers.image.source="https://github.com/oracle/opengrok"
 LABEL org.opencontainers.image.description="OpenGrok code search"
@@ -54,7 +54,7 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 # hadolint ignore=DL3059
 RUN curl -sS https://package.perforce.com/perforce.pubkey | gpg --dearmor > /etc/apt/trusted.gpg.d/perforce.gpg
 # hadolint ignore=DL3059
-RUN echo 'deb https://package.perforce.com/apt/ubuntu jammy release' > /etc/apt/sources.list.d/perforce.list
+RUN echo 'deb https://package.perforce.com/apt/ubuntu noble release' > /etc/apt/sources.list.d/perforce.list
 
 # install dependencies and Python tools
 # hadolint ignore=DL3008,DL3009
@@ -63,10 +63,13 @@ RUN apt-get update && \
     unzip python3 python3-pip \
     python3-venv python3-setuptools openssh-client libyaml-dev
 
+ARG TARGETARCH
 # hadolint ignore=DL3008,DL3059
-RUN architecture=$(uname -m) && if [[ "$architecture" == "aarch64" ]]; then \
-        echo "aarch64: do not install helix-p4d."; else \
-        apt-get install --no-install-recommends -y helix-p4d || echo "Failed to install Perforce"; fi
+RUN if [ "$TARGETARCH" = "amd64" ] || [ "$TARGETARCH" = "386" ]; then \
+        apt-get install --no-install-recommends -y helix-p4d || echo "Failed to install Perforce"; \
+    else \
+        echo "Architecture $TARGETARCH: skipping helix-p4d installation"; \
+    fi
 
 # compile and install universal-ctags
 # hadolint ignore=DL3003,DL3008