124 lines
3.0 KiB
HCL
124 lines
3.0 KiB
HCL
# Единая сборка образа Auth Portal (buildx bake: -f deploy/docker/docker-bake.hcl).
|
|
# context = "../.." — корень репо. Bake резолвит context от cwd (не от HCL),
|
|
# поэтому вызов из deploy/docker/ либо BUILDX_BAKE_FILE_RELATIVE_PATHS=1.
|
|
|
|
variable "REGISTRY" {
|
|
default = "git.shx.one/denozord"
|
|
}
|
|
|
|
variable "IMAGE_TAG" {
|
|
default = "latest"
|
|
}
|
|
|
|
variable "SHORT_SHA" {
|
|
default = "dev"
|
|
}
|
|
|
|
variable "SHA_FULL" {
|
|
default = ""
|
|
}
|
|
|
|
variable "VERSION" {
|
|
default = "dev"
|
|
}
|
|
|
|
variable "BUILD_TIME" {
|
|
default = ""
|
|
}
|
|
|
|
variable "CACHE_REF_NODE" {
|
|
default = ""
|
|
}
|
|
|
|
# provenance + SBOM; включается только при --push (docker exporter attestations не поддерживает).
|
|
variable "ATTEST" {
|
|
default = "false"
|
|
}
|
|
|
|
variable "BASE_NODE" {
|
|
default = "docker.io/library/node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914"
|
|
}
|
|
|
|
function "node-cache-from" {
|
|
params = []
|
|
result = notequal("", CACHE_REF_NODE) ? ["type=registry,ref=${CACHE_REF_NODE}"] : []
|
|
}
|
|
|
|
# Экспорт кэша — один writer на ref (параллельный cache-to в один ref ломает manifest).
|
|
function "node-cache-to-export" {
|
|
params = []
|
|
result = notequal("", CACHE_REF_NODE) ? ["type=registry,ref=${CACHE_REF_NODE},mode=max"] : []
|
|
}
|
|
|
|
function "image-tags" {
|
|
params = [name]
|
|
result = concat(
|
|
notequal("", SHA_FULL) ? [
|
|
"${REGISTRY}/${name}:${IMAGE_TAG}",
|
|
"${REGISTRY}/${name}:${SHORT_SHA}",
|
|
"${REGISTRY}/${name}:sha-${SHA_FULL}",
|
|
] : [
|
|
"${REGISTRY}/${name}:${IMAGE_TAG}",
|
|
"${REGISTRY}/${name}:${SHORT_SHA}",
|
|
],
|
|
notequal(VERSION, "dev") && notequal(VERSION, "") ? [
|
|
"${REGISTRY}/${name}:v${VERSION}",
|
|
"${REGISTRY}/${name}:${VERSION}",
|
|
] : []
|
|
)
|
|
}
|
|
|
|
group "default" {
|
|
targets = ["authportal"]
|
|
}
|
|
|
|
target "_common" {
|
|
platforms = ["linux/amd64"]
|
|
pull = false
|
|
}
|
|
|
|
target "node-deps" {
|
|
inherits = ["_common"]
|
|
context = "../.."
|
|
dockerfile = "deploy/docker/authportal/Dockerfile"
|
|
target = "deps"
|
|
args = {
|
|
BASE_NODE = BASE_NODE
|
|
}
|
|
cache-from = node-cache-from()
|
|
}
|
|
|
|
target "node-build" {
|
|
inherits = ["_common"]
|
|
context = "../.."
|
|
dockerfile = "deploy/docker/authportal/Dockerfile"
|
|
target = "build"
|
|
args = {
|
|
BASE_NODE = BASE_NODE
|
|
}
|
|
contexts = {
|
|
deps = "target:node-deps"
|
|
}
|
|
cache-from = node-cache-from()
|
|
cache-to = node-cache-to-export()
|
|
}
|
|
|
|
target "authportal" {
|
|
inherits = ["_common"]
|
|
context = "../.."
|
|
dockerfile = "deploy/docker/authportal/Dockerfile"
|
|
target = "runtime"
|
|
args = {
|
|
BASE_NODE = BASE_NODE
|
|
VERSION = VERSION
|
|
GIT_SHA = notequal("", SHA_FULL) ? SHA_FULL : SHORT_SHA
|
|
BUILD_TIME = BUILD_TIME
|
|
}
|
|
contexts = {
|
|
build = "target:node-build"
|
|
}
|
|
cache-from = node-cache-from()
|
|
attest = equal(ATTEST, "true") ? ["type=provenance,mode=min", "type=sbom"] : []
|
|
tags = concat(image-tags("authportal"), image-tags("auth-portal"))
|
|
}
|