capistrano-dockerbuild 0.2.2 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1478c1f08638b7fbd90429775a474e501920403a455dc222b43bb7c031d2c873
-  data.tar.gz: 6d77122f43ed9fe79f9c672f4b2d209056c44396a4767efa24f0bd7886a94b45
+  metadata.gz: d7346efa239fc872e0194afb86f2e155aec196f8ef16490af28dfb16a8e1b726
+  data.tar.gz: 647ae21571209763324edb86400d78498bdbd5b5423784530cac71e01544e783
 SHA512:
-  metadata.gz: db2802cde724287f42aadc207c9f195d6a14b9475196c49d3f8a476a6ef61babdf23b3013a1a5d18dfee0c3703beb7b8ace4d989c1af8bf977f4f178b4ed0fe4
-  data.tar.gz: 759048b911f58047325cd50aae2f84937cee18834b78cb8596a4e185d88e0e8a241eb3c82019cec2e18b64bbc6942d179564bd8514af987bf59d5e7425476560
+  metadata.gz: 9e3b6d93525ef5baf7d376f9d893f5f0db6227bb4c8fbb04c11f7c92a126e6ec2481c1dfb7c61562004aa58f4391bca3b31f73217df843b0af062032e32514b4
+  data.tar.gz: 949edfc5295850a32f6dbef737127ba2d1e700214fb560666936b4a6e6c8f4be3f60846f7c635b394914088afb97ee93270c4bbb382287c4ac285936d2e007e5

data/README.md

@@ -30,6 +30,48 @@ require 'capistrano/dockerbuild'
 install_plugin Capistrano::Dockerbuild
 ```
 
+```ruby
+# deploy.rb
+
+set :application, :sample_project
+
+set :repo_url, 'git@github.com:example/example.git'
+
+set :git_sha1, `git rev-parse HEAD`.chomp
+
+set :branch, fetch(:git_sha1)
+
+set :ssh_user, ENV["SSH_USER"] || ENV["USER"] || Etc.getlogin
+
+set :ssh_options, {
+  user: fetch(:ssh_user),
+  port: 22,
+  use_agent: true,
+}
+
+# add :docker_build role to server definition
+# add :arch property to server definition
+server "docker-build-amd64.example.com", roles: [:docker_build], ssh_options: fetch(:ssh_options), arch: "amd64"
+server "docker-build-arm64.example.com", roles: [:docker_build], ssh_options: fetch(:ssh_options), arch: "arm64"
+
+set :docker_registry, "ghcr.io"
+set :docker_build_base_dir, "/home/#{fetch(:ssh_user)}/#{fetch(:application)}"
+
+# if docker_build_cmd is proc and has more than 1 arity, pass host object.
+set :docker_build_cmd, ->(host) {
+  [:docker, "build", "-f", "Dockerfile", "-t", fetch(:docker_tag_with_arch).call(host), "--build-arg", "host=#{host}", "."]
+}
+set :docker_tag, "ghcr.io/NAMESPACE/IMAGE_NAME:#{fetch(:git_sha1)}"
+```
+
+If any servers have `arch` property, this plugin enables multi architecture mode.
+
+The behavior of multi architecture mode is following.
+
+1. build image with a arch suffix like `-amd64`
+1. push the image
+1. create a manifest list of pushed images and push it on first server
+
 ## Variables
 
 #### Common Variables
@@ -39,19 +81,15 @@ Use common variables
 
 | name                          | required | default                                                                                                            | desc                                                                                     |
 | ----                          | ----     | ----                                                                                                               | ----                                                                                     |
-| docker_build_server_host      | yes      | nil                                                                                                                | Build server hostname or SSH::Host object                                                |
 | docker_build_base_dir         | yes      | nil                                                                                                                | Repository clone to here, and execute build command here                                 |
-| docker_registry               | no       | nil                                                                                                                | Docker registry hostname. if use DockerHub, keep nil                                     |
-| docker_build_cmd              | no       | `-> { [:docker, "build", "-t", fetch(:docker_tag_full), "."] }`                                                    | Execute command for image building                                                       |
-| docker_repository_name        | no       | `-> { fetch(:application) }`                                                                                       | Use by `docker tag {{docker_repository_name}}:tag`                                       |
-| docker_tag                    | no       | `-> { fetch(:branch) }`                                                                                            | Use by `docker tag repository:{{docker_tag}}`                                            |
-| docker_tag_full               | no       | `-> { #{fetch(:docker_repository_name)}:#{fetch(:docker_tag)}" }`                                                  | Use by `docker tag {{docker_tag_full}}`                                                  |
-| docker_remote_repository_name | no       | `-> { fetch(:docker_repository_name) }`                                                                            | Use by `docker push docker_registry/{{docker_remote_repository_name}}:docker_remote_tag` |
-| docker_remote_tag             | no       | `-> { fetch(:docker_tag) }`                                                                                        | Use by `docker push docker_registry/docker_remote_repository_name:{{docker_remote_tag}}` |
-| docker_remote_tag_full        | no       | `-> { "#{fetch(:docker_registry) &.+ "/"}#{fetch(:docker_remote_repository_name)}:#{fetch(:docker_remote_tag)}" }` | Use by `docker push {{docker_remote_tag_full}}`                                          |
+| docker_build_cmd              | no       | `->(host) { [:docker, :build, "-t", fetch(:docker_tag_with_arch).call(host), "."] }`                                                    | Execute command for image building                                                       |
+| docker_tag                    | no       | `-> { fetch(:application) + ":" + fetch(:branch) }`                                                                                            | Use by `docker tag repository:{{docker_tag}}`                                            |
+| docker_latest_tag       | no       | false                                                                                                                 | Add latest tag to building image                                                         |
 | keep_docker_image_count       | no       | 10                                                                                                                 |                                                                                          |
 | git_http_username             | no       | nil                                                                                                                | See below                                                                                |
 | git_http_password             | no       | nil                                                                                                                | See below                                                                                |
+| git_auth_token                | no       | nil                                                                                                                | See below                                                                                |
+| update_git_submodule          | no       | false                                                                                                              | Run `git submodule update --init --recursive` after checkout                             |
 
 If you want to use GitHub Apps installation access token or something to authorize repository access using HTTPS protocol. You can set variables in your config/deploy.rb:
 
@@ -69,8 +107,32 @@ end
 
 Update remote URL always if you set proper value to all of `repo_url`, `git_http_username`, and `git_http_password`.
 
+Alternatively, you can authenticate via an HTTP `Authorization` header using `:git_auth_token`. This is useful when the build server has no SSH key access to the repository (e.g. using a GitHub Apps installation access token or a personal access token).
+
+```ruby
+set :git_auth_token, -> { ENV["GIT_AUTH_TOKEN"] }
+set :repo_url, "git@github.com:owner/repo.git"  # SSH or HTTPS both work
+```
+
+When `:git_auth_token` is set, `docker:setup` creates a temporary `.gitconfig` on each remote build host containing:
+
+- `http.extraheader = Authorization: Basic <token>` — injects the token into every HTTPS git request
+- `url."https://<host>/".insteadOf` rules — rewrites SSH-style URLs (`git@host:` and `ssh://git@host/`) to HTTPS so the token is used regardless of how `repo_url` is written
+
+The host is derived automatically from `:repo_url`, so this works with GitHub, GitLab, Bitbucket, or any self-hosted git server.
+
+The temporary directory is removed automatically by `docker:clean` after `docker:build`.
+
 ## Tasks
 
+#### docker:setup
+- Create a temporary `.gitconfig` on each remote build host when `:git_auth_token` is set
+- Automatically invoked before `docker:check`
+
+#### docker:clean
+- Remove the temporary directory created by `docker:setup`
+- Automatically invoked after `docker:build`
+
 #### docker:check
 - Ensure `#{docker_build_base_dir}`
 - Ensure git reachable
@@ -87,8 +149,7 @@ Update remote URL always if you set proper value to all of `repo_url`, `git_http
 - Clear worktree
 
 #### docker:push
-- docker tag `#{docker_tag_full}` `#{docker_remote_tag_full}`
-- docker push `#{docker_remote_tag_full}`
+- docker push `#{docker_tag}`
 
 #### docker:cleanup_local_images
 - Remove docker images
@@ -97,7 +158,9 @@ Update remote URL always if you set proper value to all of `repo_url`, `git_http
 
 ## Task Dependency
 
-docker:push => docker:build => docker:update_mirror => docker:clone => docker:check
+docker:push => docker:build => docker:update_mirror => docker:clone => docker:check => docker:setup
+
+docker:clean is triggered automatically after docker:build
 
 ## Development
 

data/capistrano-dockerbuild.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "capistrano-dockerbuild"
-  spec.version       = "0.2.2"
+  spec.version       = "1.1.0"
   spec.authors       = ["joker1007"]
   spec.email         = ["kakyoin.hierophant@gmail.com"]
 

data/lib/capistrano/dockerbuild.rb

@@ -1,19 +1,22 @@
 require "cgi"
 require "uri"
+require "securerandom"
 
 class Capistrano::Dockerbuild < Capistrano::Plugin
   def set_defaults
-    set_if_empty :docker_build_cmd, -> { [:docker, "build", "-t", fetch(:docker_tag_full), "."] }
-    set_if_empty :docker_repository_name, -> { fetch(:application) }
-    set_if_empty :docker_tag, -> { fetch(:branch) }
-    set_if_empty :docker_tag_full, -> { "#{fetch(:docker_repository_name)}:#{fetch(:docker_tag)}" }
-    set_if_empty :docker_remote_repository_name, -> { fetch(:docker_repository_name) }
-    set_if_empty :docker_remote_tag, -> { fetch(:docker_tag) }
-    set_if_empty :docker_remote_tag_full, -> { "#{fetch(:docker_registry) &.+ "/"}#{fetch(:docker_remote_repository_name)}:#{fetch(:docker_remote_tag)}" }
+    set_if_empty :docker_tag, -> { fetch(:application) + ":" + fetch(:branch) }
+    set :docker_tag_with_arch, ->(host) do
+      arch_suffix = host.properties.arch ? "-#{host.properties.arch}" : ""
+      fetch(:docker_tag) + arch_suffix
+    end
+    set_if_empty :docker_build_cmd, ->(host) do
+      [:docker, :build, "-t", fetch(:docker_tag_with_arch).call(host), "."]
+    end
     set_if_empty :docker_latest_tag, false
     set_if_empty :keep_docker_image_count, 10
     set_if_empty :git_gc_prune_date, "3.days.ago"
     set_if_empty :docker_build_no_worktree, false
+    set_if_empty :update_git_submodule, false
   end
 
   def define_tasks
@@ -39,4 +42,20 @@ class Capistrano::Dockerbuild < Capistrano::Plugin
       repo_url
     end
   end
+
+  def git_repo_host
+    URI.parse(repo_url.sub(/^git@.*/) {|m| "https://#{m}" }).host
+  end
+
+  def tmp_home(host)
+    @tmp_host ||= {}
+    @tmp_host[host.properties.arch] ||= "/tmp/capistrano-dockerbuild-#{SecureRandom.hex(8)}"
+  end
+
+  def git_env(host)
+    return {} if fetch(:git_auth_token).to_s.empty?
+
+    @git_env ||= {}
+    @git_env[host.properties.arch] ||= { HOME: tmp_home(host), GIT_CONFIG_NOSYSTEM: "1" }
+  end
 end

data/lib/capistrano/tasks/docker.rake

@@ -1,23 +1,51 @@
 dockerbuild_plugin = self
 
 namespace :docker do
+  desc "setup temporary gitconfig for HTTP authentication"
+  task :setup do
+    on roles(:docker_build) do |host|
+      unless fetch(:git_auth_token).to_s.empty?
+        tmp_home = dockerbuild_plugin.tmp_home(host)
+        git_host = dockerbuild_plugin.git_repo_host
+        execute :mkdir, "-p", tmp_home
+        execute :git, :config, "--file", "#{tmp_home}/.gitconfig", "http.extraheader", "'Authorization: Basic #{fetch(:git_auth_token)}'"
+        execute :git, :config, "--file", "#{tmp_home}/.gitconfig", %Q(url."https://#{git_host}/".insteadOf), "git@#{git_host}:"
+        execute :git, :config, "--file", "#{tmp_home}/.gitconfig", "--add", %Q(url."https://#{git_host}/".insteadOf), "ssh://git@#{git_host}/"
+      end
+    end
+  end
+
+  desc "clean up temporary gitconfig"
+  task :clean do
+    on roles(:docker_build) do |host|
+      unless fetch(:git_auth_token).to_s.empty?
+        tmp_home = dockerbuild_plugin.tmp_home(host)
+        execute :rm, "-rf", tmp_home
+      end
+    end
+  end
+
   desc "check directory exist"
-  task :check do
-    on fetch(:docker_build_server_host) do
-      execute :mkdir, "-p", dockerbuild_plugin.docker_build_base_path.dirname.to_s
-      execute :git, :'ls-remote', dockerbuild_plugin.git_repo_url, "HEAD"
+  task check: [:"docker:setup"] do
+    on roles(:docker_build) do |host|
+      with dockerbuild_plugin.git_env(host) do
+        execute :mkdir, "-p", dockerbuild_plugin.docker_build_base_path.dirname.to_s
+        execute :git, :'ls-remote', dockerbuild_plugin.git_repo_url, "HEAD"
+      end
     end
   end
 
   desc "Clone the repo to docker build base directory"
   task :clone => [:'docker:check'] do
-    on fetch(:docker_build_server_host) do
+    on roles(:docker_build) do |host|
       if fetch(:docker_build_no_worktree)
         if test " [ -f #{dockerbuild_plugin.docker_build_base_path}/.git/HEAD ] "
           info "The repository is at #{dockerbuild_plugin.docker_build_base_path}"
         else
           within dockerbuild_plugin.docker_build_base_path.dirname do
-            execute :git, :clone, dockerbuild_plugin.git_repo_url, dockerbuild_plugin.docker_build_base_path.to_s
+            with dockerbuild_plugin.git_env(host) do
+              execute :git, :clone, dockerbuild_plugin.git_repo_url, dockerbuild_plugin.docker_build_base_path.to_s
+            end
           end
         end
       else
@@ -25,7 +53,9 @@ namespace :docker do
           info t(:mirror_exists, at: dockerbuild_plugin.docker_build_base_path.to_s)
         else
           within dockerbuild_plugin.docker_build_base_path.dirname do
-            execute :git, :clone, "--mirror", dockerbuild_plugin.git_repo_url, dockerbuild_plugin.docker_build_base_path.to_s
+            with dockerbuild_plugin.git_env(host) do
+              execute :git, :clone, "--mirror", dockerbuild_plugin.git_repo_url, dockerbuild_plugin.docker_build_base_path.to_s
+            end
           end
         end
       end
@@ -34,21 +64,34 @@ namespace :docker do
 
   desc "Update the repo mirror to reflect the origin state"
   task update_mirror: :'docker:clone' do
-    on fetch(:docker_build_server_host) do
+    on roles(:docker_build) do |host|
       within dockerbuild_plugin.docker_build_base_path do
-        execute :git, :remote, "set-url", :origin, dockerbuild_plugin.git_repo_url
-        execute :git, :remote, :update, "--prune"
+        with dockerbuild_plugin.git_env(host) do
+          execute :git, :remote, "set-url", :origin, dockerbuild_plugin.git_repo_url
+          execute :git, :remote, :update, "--prune"
+        end
       end
     end
   end
 
-  desc "build and push docker image on remote host"
+  desc "build docker image on remote host"
   task :build => [:'docker:update_mirror'] do
-    on fetch(:docker_build_server_host) do
+    on roles(:docker_build) do |host|
+      build_cmd = fetch(:docker_build_cmd)
+      if build_cmd.is_a?(Proc)
+        if build_cmd.arity != 0
+          build_cmd = build_cmd.call(host)
+        else
+          build_cmd = build_cmd.call
+        end
+      end
       within dockerbuild_plugin.docker_build_base_path do
         if fetch(:docker_build_no_worktree)
-          commands = "sha1=$(git rev-parse #{fetch(:branch)}); git reset --hard ${sha1}; #{fetch(:docker_build_cmd).map {|c| c.to_s.shellescape }.join(" ")}"
-          execute(:flock, "capistrano_dockerbuild.lock", "-c", "'#{commands}'")
+          submodule_cmd = fetch(:update_git_submodule) ? "; git submodule update --init --recursive" : ""
+          commands = "sha1=$(git rev-parse #{fetch(:branch)}); git reset --hard ${sha1}#{submodule_cmd}; #{build_cmd.map {|c| c.to_s.shellescape }.join(" ")}"
+          with dockerbuild_plugin.git_env(host) do
+            execute(:flock, "capistrano_dockerbuild.lock", "-c", "'#{commands}'")
+          end
         else
           timestamp = Time.now.to_i
           git_sha1 = `git rev-parse #{fetch(:branch)}`.chomp
@@ -58,7 +101,12 @@ namespace :docker do
 
           begin
             within worktree_dir_name do
-              execute(*fetch(:docker_build_cmd))
+              if fetch(:update_git_submodule)
+                with dockerbuild_plugin.git_env(host) do
+                  execute :git, :submodule, :update, "--init", "--recursive"
+                end
+              end
+              execute(*build_cmd)
             end
           ensure
             execute(:rm, "-rf", worktree_dir_name)
@@ -71,32 +119,52 @@ namespace :docker do
     end
   end
 
+  desc "push docker image on remote host"
   task :push => [:'docker:build'] do
-    on fetch(:docker_build_server_host) do
-      execute(:docker, :tag, fetch(:docker_tag_full), fetch(:docker_remote_tag_full))
-      execute(:docker, :push, fetch(:docker_remote_tag_full))
+    on roles(:docker_build) do |host|
+      docker_tag_with_arch = fetch(:docker_tag_with_arch).call(host)
+      execute(:docker, :push, docker_tag_with_arch)
       if fetch(:docker_latest_tag)
-        latest_tag = "#{fetch(:docker_registry) &.+ "/"}#{fetch(:docker_remote_repository_name)}:latest"
-        execute(:docker, :tag, fetch(:docker_tag_full), latest_tag)
+        arch_suffix = host.properties.arch ? "-#{host.properties.arch}" : ""
+        latest_tag = docker_tag_with_arch.split(":").first + ":latest" + arch_suffix
+        execute(:docker, :tag, docker_tag_with_arch, latest_tag)
         execute(:docker, :push, latest_tag)
       end
     end
+
+    archs = roles(:docker_build).map { |host| host.properties.arch }.compact.uniq
+    unless archs.empty?
+      on roles(:docker_build).take(1) do |host|
+        manifest_tags = archs.map do |arch|
+          arch_suffix = "-#{arch}"
+          fetch(:docker_tag) + arch_suffix
+        end
+        execute(:docker, :manifest, :create, "--amend", fetch(:docker_tag), *manifest_tags)
+        execute(:docker, :manifest, :push, "--purge", fetch(:docker_tag))
+
+        if fetch(:docker_latest_tag)
+          latest_tag = fetch(:docker_tag).split(":").first + ":latest"
+          execute(:docker, :manifest, :create, "--amend", latest_tag, *manifest_tags)
+          execute(:docker, :manifest, :push, "--purge", latest_tag)
+        end
+      end
+    end
   end
 
   task :push_unless_exists => [:'docker:build'] do
-    on fetch(:docker_build_server_host) do
-      unless test "docker manifest inspect #{fetch(:docker_remote_tag_full)}"
+    on roles(:docker_build).take(1) do
+      unless test "docker manifest inspect #{fetch(:docker_tag)}"
         invoke "docker:push"
       end
     end
   end
 
   task :cleanup_local_images do
-    on fetch(:docker_build_server_host) do
+    on roles(:docker_build) do |host|
       local_images = []
       capture(:docker, "images --format='{{.ID}}\t{{.Repository}}\t{{.CreatedAt}}'").split("\n").map do |line|
         id, repository, created_at = line.split("\t")
-        if repository == fetch(:docker_repository_name)
+        if repository == fetch(:docker_tag).split(":").first
           local_images << { id: id, created_at: created_at }
         end
       end
@@ -108,3 +176,5 @@ namespace :docker do
     end
   end
 end
+
+after "docker:build", "docker:clean"

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: capistrano-dockerbuild
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 1.1.0
 platform: ruby
 authors:
 - joker1007
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-09-13 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: capistrano
@@ -73,7 +72,6 @@ homepage: https://github.com/reproio/capistrano-dockerbuild
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -88,8 +86,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
-signing_key:
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Capistrano task definition for `docker build`
 test_files: []