From a9c53eebe20467ff55506e29f24ec12af353cf9a Mon Sep 17 00:00:00 2001 From: Xavier Fournet <461943+xfournet@users.noreply.github.com> Date: Tue, 25 Aug 2026 16:09:52 +0200 Subject: [PATCH 1/2] ci: migrate Docker build from CircleCI to GitHub Actions (#14) Replace the CircleCI pipeline with a GitHub Actions workflow that keeps the same behaviour: build and publish filigran/python-fips and filigran/python-nodejs-fips on every push to main and on a daily schedule, plus a manual workflow_dispatch trigger. The two images are now built in parallel through a matrix instead of sequentially in a single job, and the ms-teams/report orb is replaced by an Adaptive Card posted to the MS Teams workflow webhook, which no-ops when the secret is not configured. Note that the Docker Hub credential secret is now DOCKERHUB_TOKEN, whereas CircleCI used DOCKERHUB_PASS. Co-Authored-By: Claude Opus 5 --- .circleci/config.yml | 77 -------------- .github/workflows/docker-build-push.yml | 128 ++++++++++++++++++++++++ README.md | 2 +- 3 files changed, 129 insertions(+), 78 deletions(-) delete mode 100644 .circleci/config.yml create mode 100644 .github/workflows/docker-build-push.yml diff --git a/.circleci/config.yml b/.circleci/config.yml deleted file mode 100644 index a9666bd..0000000 --- a/.circleci/config.yml +++ /dev/null @@ -1,77 +0,0 @@ -version: 2.1 -orbs: - ms-teams: cloudradar-monitoring/ms-teams@0.0.1 -jobs: - - build_docker: - working_directory: ~/docker - machine: - image: ubuntu-2004:202111-02 - resource_class: large - environment: - DOCKER_BUILDKIT: 1 - BUILDX_PLATFORMS: linux/amd64 - steps: - - run: sudo apt-get update -qq && sudo apt install curl - - checkout - - run: - name: Install buildx - command: | - BUILDX_BINARY_URL="https://github.com/docker/buildx/releases/download/v0.8.2/buildx-v0.8.2.linux-amd64" - curl --output docker-buildx \ - --silent --show-error --location --fail --retry 3 \ - "$BUILDX_BINARY_URL" - mkdir -p ~/.docker/cli-plugins - mv docker-buildx ~/.docker/cli-plugins/ - chmod a+x ~/.docker/cli-plugins/docker-buildx - docker buildx install - # Run binfmt - docker run --rm --privileged tonistiigi/binfmt:latest --install "$BUILDX_PLATFORMS" - docker buildx create --name mybuilder --use - - run: - name: Login - command: echo "$DOCKERHUB_PASS" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin - - run: - name: Build Docker image filigran/python-nodejs-fips - command: docker buildx build --pull --platform $BUILDX_PLATFORMS -f Dockerfile_python_nodejs -t filigran/python-nodejs-fips:python3.12-nodejs22 -t filigran/python-nodejs-fips:latest --push . - no_output_timeout: 30m - - run: - name: Build Docker image filigran/python-fips - command: docker buildx build --pull --platform $BUILDX_PLATFORMS -f Dockerfile_python -t filigran/python-fips:python3.12 -t filigran/python-fips:latest --push . - no_output_timeout: 30m - - ms-teams/report: - only_on_fail: false - webhook_url: $MS_TEAMS_WORKFLOW_WEBHOOK_URL - - - notify: - docker: - - image: "cimg/base:stable" - steps: - - run: sudo apt-get update -qq && sudo apt install curl - - ms-teams/report: - only_on_fail: false - webhook_url: $MS_TEAMS_WORKFLOW_WEBHOOK_URL - -workflows: - docker_on_push: - jobs: - - build_docker: - filters: - branches: - only: - - main - docker_scheduled: - triggers: - - schedule: - cron: "0 0 * * *" - filters: - branches: - only: - - main - jobs: - - build_docker: - filters: - branches: - only: - - main diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml new file mode 100644 index 0000000..e2b38af --- /dev/null +++ b/.github/workflows/docker-build-push.yml @@ -0,0 +1,128 @@ +name: Build and publish Docker images + +on: + push: + branches: + - main + schedule: + # Daily rebuild, to pick up upstream Alpine security updates. + - cron: "0 0 * * *" + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: docker-build-push-${{ github.ref }} + cancel-in-progress: false + +jobs: + build: + name: Build ${{ matrix.image }} + runs-on: ubuntu-latest + timeout-minutes: 120 + strategy: + fail-fast: false + matrix: + include: + - image: filigran/python-fips + dockerfile: Dockerfile_python + tags: | + filigran/python-fips:python3.12 + filigran/python-fips:latest + - image: filigran/python-nodejs-fips + dockerfile: Dockerfile_python_nodejs + tags: | + filigran/python-nodejs-fips:python3.12-nodejs22 + filigran/python-nodejs-fips:latest + steps: + - name: Checkout repository + uses: actions/checkout@v7 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v4 + + - name: Log in to Docker Hub + uses: docker/login-action@v4 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Build and push ${{ matrix.image }} + uses: docker/build-push-action@v7 + with: + context: . + file: ${{ matrix.dockerfile }} + platforms: linux/amd64 + pull: true + push: true + no-cache: true + tags: ${{ matrix.tags }} + + notify: + name: Notify MS Teams + needs: build + if: always() + runs-on: ubuntu-latest + steps: + - name: Send report to MS Teams + env: + WEBHOOK_URL: ${{ secrets.MS_TEAMS_WORKFLOW_WEBHOOK_URL }} + BUILD_RESULT: ${{ needs.build.result }} + RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + run: | + set -euo pipefail + + if [ -z "${WEBHOOK_URL}" ]; then + echo "MS_TEAMS_WORKFLOW_WEBHOOK_URL is not configured, skipping notification." + exit 0 + fi + + case "${BUILD_RESULT}" in + success) title="✅ Docker images published" ;; + cancelled) title="⚠️ Docker build cancelled" ;; + *) title="❌ Docker build failed" ;; + esac + + jq -n \ + --arg title "${title}" \ + --arg repository "${GITHUB_REPOSITORY}" \ + --arg result "${BUILD_RESULT}" \ + --arg ref "${GITHUB_REF_NAME}" \ + --arg sha "${GITHUB_SHA}" \ + --arg event "${GITHUB_EVENT_NAME}" \ + --arg run_url "${RUN_URL}" \ + '{ + type: "message", + attachments: [ + { + contentType: "application/vnd.microsoft.card.adaptive", + content: { + "$schema": "http://adaptivecards.io/schemas/adaptive-card.json", + type: "AdaptiveCard", + version: "1.4", + body: [ + { type: "TextBlock", size: "Medium", weight: "Bolder", wrap: true, text: $title }, + { + type: "FactSet", + facts: [ + { title: "Repository", value: $repository }, + { title: "Result", value: $result }, + { title: "Ref", value: $ref }, + { title: "Commit", value: $sha[0:7] }, + { title: "Trigger", value: $event } + ] + } + ], + actions: [ + { type: "Action.OpenUrl", title: "View workflow run", url: $run_url } + ] + } + } + ] + }' > payload.json + + curl --silent --show-error --fail --retry 3 \ + --header "Content-Type: application/json" \ + --data @payload.json \ + "${WEBHOOK_URL}" diff --git a/README.md b/README.md index a8f305d..4578110 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ [![Pulls](https://img.shields.io/docker/pulls/filigran/python-nodejs-fips.svg)](https://hub.docker.com/r/filigran/python-nodejs-fips/) [![Pulls](https://img.shields.io/docker/pulls/filigran/python-fips.svg)](https://hub.docker.com/r/filigran/python-fips/) -[![CircleCI](https://img.shields.io/circleci/project/github/FiligranHQ/docker-python-nodejs-fips.svg)](https://circleci.com/gh/FiligranHQ/docker-python-nodejs-fips) +[![Build](https://github.com/FiligranHQ/docker-python-nodejs-fips/actions/workflows/docker-build-push.yml/badge.svg)](https://github.com/FiligranHQ/docker-python-nodejs-fips/actions/workflows/docker-build-push.yml) ## Docker Python NodeJS FIPS From 762ab11f0aa86131455dab09f2982f8f81d7b784 Mon Sep 17 00:00:00 2001 From: Xavier Fournet <461943+xfournet@users.noreply.github.com> Date: Tue, 25 Aug 2026 16:18:08 +0200 Subject: [PATCH 2/2] ci: drop MS Teams notification from the Docker workflow (#14) The build result is already visible in the Actions tab and through the README badge, so the notification job and its MS_TEAMS_WORKFLOW_WEBHOOK_URL secret are not carried over from CircleCI. Co-Authored-By: Claude Opus 5 --- .github/workflows/docker-build-push.yml | 68 ------------------------- 1 file changed, 68 deletions(-) diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml index e2b38af..dbc5032 100644 --- a/.github/workflows/docker-build-push.yml +++ b/.github/workflows/docker-build-push.yml @@ -58,71 +58,3 @@ jobs: push: true no-cache: true tags: ${{ matrix.tags }} - - notify: - name: Notify MS Teams - needs: build - if: always() - runs-on: ubuntu-latest - steps: - - name: Send report to MS Teams - env: - WEBHOOK_URL: ${{ secrets.MS_TEAMS_WORKFLOW_WEBHOOK_URL }} - BUILD_RESULT: ${{ needs.build.result }} - RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} - run: | - set -euo pipefail - - if [ -z "${WEBHOOK_URL}" ]; then - echo "MS_TEAMS_WORKFLOW_WEBHOOK_URL is not configured, skipping notification." - exit 0 - fi - - case "${BUILD_RESULT}" in - success) title="✅ Docker images published" ;; - cancelled) title="⚠️ Docker build cancelled" ;; - *) title="❌ Docker build failed" ;; - esac - - jq -n \ - --arg title "${title}" \ - --arg repository "${GITHUB_REPOSITORY}" \ - --arg result "${BUILD_RESULT}" \ - --arg ref "${GITHUB_REF_NAME}" \ - --arg sha "${GITHUB_SHA}" \ - --arg event "${GITHUB_EVENT_NAME}" \ - --arg run_url "${RUN_URL}" \ - '{ - type: "message", - attachments: [ - { - contentType: "application/vnd.microsoft.card.adaptive", - content: { - "$schema": "http://adaptivecards.io/schemas/adaptive-card.json", - type: "AdaptiveCard", - version: "1.4", - body: [ - { type: "TextBlock", size: "Medium", weight: "Bolder", wrap: true, text: $title }, - { - type: "FactSet", - facts: [ - { title: "Repository", value: $repository }, - { title: "Result", value: $result }, - { title: "Ref", value: $ref }, - { title: "Commit", value: $sha[0:7] }, - { title: "Trigger", value: $event } - ] - } - ], - actions: [ - { type: "Action.OpenUrl", title: "View workflow run", url: $run_url } - ] - } - } - ] - }' > payload.json - - curl --silent --show-error --fail --retry 3 \ - --header "Content-Type: application/json" \ - --data @payload.json \ - "${WEBHOOK_URL}"