Use direct podman commands for image deployment

nikolaszimmermann · nikolaszimmermann · commit 413612981414 · 2025-11-17T11:00:07.000+01:00
Replace wkdev-sdk-bakery script with direct podman commands for
building and deploying container images, matching the pattern from
webkit-container-sdk-bots.

Main changes:
- Build jobs now use direct podman build/push instead of bakery script
- Remove artifact upload/download steps for faster workflow execution
- Push arch-specific images directly to registry after build
- Deploy job validates images exist before creating manifest
- Add rollback cleanup if validation fails
- Clean up intermediate arch-specific tags after successful deployment
- Fix WKDEV_SDK_TAG to use GITHUB_REF_NAME instead of GITHUB_BASE_REF
- Add debug output for troubleshooting tag variables

Should lead to much faster builds + deployments.
diff --git a/.github/workflows/wkdev-sdk.yml b/.github/workflows/wkdev-sdk.yml
@@ -12,18 +12,31 @@ defaults:
 jobs:
   build_amd64:
     runs-on: [self-hosted, x64]
+    permissions:
+      packages: write
     if: |
       github.event_name != 'create' ||
       startsWith(github.ref_name, 'tag/')
     steps:
       - name: Set tag name
         run: |
-          if [ "${GITHUB_BASE_REF}" = 'main' ]; then
+          if [ "${GITHUB_REF_NAME}" = 'main' ]; then
+            echo "WKDEV_SDK_TAG=latest" >> "${GITHUB_ENV}"
+          elif [[ "${GITHUB_REF_NAME}" =~ ^tag/(.+)$ ]]; then
+            echo "WKDEV_SDK_TAG=${BASH_REMATCH[1]}" >> "${GITHUB_ENV}"
+          else
             echo "WKDEV_SDK_TAG=latest" >> "${GITHUB_ENV}"
           fi
           echo "WKDEV_SDK_CONTAINER_REGISTRY_USER_NAME=$(echo ${GITHUB_REPOSITORY_OWNER} | tr '[:upper:]' '[:lower:]')" >> "${GITHUB_ENV}"
           echo "REPO=ghcr.io/$(echo ${GITHUB_REPOSITORY_OWNER} | tr '[:upper:]' '[:lower:]')/wkdev-sdk" >> "${GITHUB_ENV}"
 
+      - name: Debug tag information
+        run: |
+          echo "GITHUB_REF_NAME=${GITHUB_REF_NAME}"
+          echo "WKDEV_SDK_TAG=${WKDEV_SDK_TAG}"
+          echo "REPO=${REPO}"
+          echo "Full image tag: ${REPO}:${WKDEV_SDK_TAG}_amd64"
+
       - name: Install podman
         run: sudo apt-get update && sudo apt-get -y install podman fuse-overlayfs
 
@@ -41,16 +54,14 @@ jobs:
 
       - name: Clean unrelated images
         run: |
-          podman rmi --ignore --force ${REPO}:latest
-          podman manifest rm ${REPO}:latest || true
-          podman rmi --ignore --force ${REPO}:latest_amd64
+          podman rmi --ignore --force ${REPO}:${WKDEV_SDK_TAG}
+          podman manifest rm ${REPO}:${WKDEV_SDK_TAG} || true
+          podman rmi --ignore --force ${REPO}:${WKDEV_SDK_TAG}_amd64
 
       - name: Build image
         run: |
-          source ./register-sdk-on-host.sh
-          wkdev-sdk-bakery --mode=build --verbose --arch amd64
+          podman build -t ${REPO}:${WKDEV_SDK_TAG}_amd64 --arch=amd64 images/wkdev_sdk
           podman image list
-          wkdev-sdk-bakery --mode=export --verbose --arch amd64
 
       - name: Test image
         run: |
@@ -62,13 +73,11 @@ jobs:
           wkdev-enter -n ${CONTAINER} --exec -- ./WebKit/Tools/Scripts/build-webkit --wpe --release --generate-project-only
           wkdev-enter -n ${CONTAINER} --exec -- ./WebKit/Tools/Scripts/build-webkit --gtk --release --generate-project-only
 
-      - name: Archive image
+      - name: Push image
         if: github.ref_name == 'main' || startsWith(github.ref_name, 'tag/')
-        uses: actions/upload-artifact@v4
-        with:
-          name: wkdev-sdk-amd64.tar
-          path: wkdev-sdk-amd64.tar
-          retention-days: 7
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | podman login ghcr.io --username=${GITHUB_REPOSITORY_OWNER} --password-stdin
+          podman push ${REPO}:${WKDEV_SDK_TAG}_amd64
 
       - name: Cleanup test artifacts
         if: always()
@@ -84,18 +93,31 @@ jobs:
 
   build_arm64:
     runs-on: [self-hosted, arch-arm64]
+    permissions:
+      packages: write
     if: |
       github.event_name != 'create' ||
       startsWith(github.ref_name, 'tag/')
     steps:
       - name: Set tag name
         run: |
-          if [ "${GITHUB_BASE_REF}" = 'main' ]; then
+          if [ "${GITHUB_REF_NAME}" = 'main' ]; then
+            echo "WKDEV_SDK_TAG=latest" >> "${GITHUB_ENV}"
+          elif [[ "${GITHUB_REF_NAME}" =~ ^tag/(.+)$ ]]; then
+            echo "WKDEV_SDK_TAG=${BASH_REMATCH[1]}" >> "${GITHUB_ENV}"
+          else
             echo "WKDEV_SDK_TAG=latest" >> "${GITHUB_ENV}"
           fi
           echo "WKDEV_SDK_CONTAINER_REGISTRY_USER_NAME=$(echo ${GITHUB_REPOSITORY_OWNER} | tr '[:upper:]' '[:lower:]')" >> "${GITHUB_ENV}"
           echo "REPO=ghcr.io/$(echo ${GITHUB_REPOSITORY_OWNER} | tr '[:upper:]' '[:lower:]')/wkdev-sdk" >> "${GITHUB_ENV}"
 
+      - name: Debug tag information
+        run: |
+          echo "GITHUB_REF_NAME=${GITHUB_REF_NAME}"
+          echo "WKDEV_SDK_TAG=${WKDEV_SDK_TAG}"
+          echo "REPO=${REPO}"
+          echo "Full image tag: ${REPO}:${WKDEV_SDK_TAG}_arm64"
+
       - name: Install podman
         run: sudo apt-get update && sudo apt-get -y install podman fuse-overlayfs
 
@@ -113,16 +135,14 @@ jobs:
 
       - name: Clean unrelated images
         run: |
-          podman rmi --ignore --force ${REPO}:latest
-          podman manifest rm ${REPO}:latest || true
-          podman rmi --ignore --force ${REPO}:latest_amd64
+          podman rmi --ignore --force ${REPO}:${WKDEV_SDK_TAG}
+          podman manifest rm ${REPO}:${WKDEV_SDK_TAG} || true
+          podman rmi --ignore --force ${REPO}:${WKDEV_SDK_TAG}_arm64
 
       - name: Build image
         run: |
-          source ./register-sdk-on-host.sh
-          wkdev-sdk-bakery --mode=build --verbose --arch arm64
+          podman build -t ${REPO}:${WKDEV_SDK_TAG}_arm64 --arch=arm64 images/wkdev_sdk
           podman image list
-          wkdev-sdk-bakery --mode=export --verbose --arch arm64
 
       - name: Test image
         run: |
@@ -134,13 +154,11 @@ jobs:
           wkdev-enter -n ${CONTAINER} --exec -- ./WebKit/Tools/Scripts/build-webkit --wpe --release --generate-project-only
           wkdev-enter -n ${CONTAINER} --exec -- ./WebKit/Tools/Scripts/build-webkit --gtk --release --generate-project-only
 
-      - name: Archive image
+      - name: Push image
         if: github.ref_name == 'main' || startsWith(github.ref_name, 'tag/')
-        uses: actions/upload-artifact@v4
-        with:
-          name: wkdev-sdk-arm64.tar
-          path: wkdev-sdk-arm64.tar
-          retention-days: 7
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | podman login ghcr.io --username=${GITHUB_REPOSITORY_OWNER} --password-stdin
+          podman push ${REPO}:${WKDEV_SDK_TAG}_arm64
 
       - name: Cleanup test artifacts
         if: always()
@@ -156,18 +174,31 @@ jobs:
 
   build_armv7:
     runs-on: [self-hosted, arch-armv7]
+    permissions:
+      packages: write
     if: |
       github.event_name != 'create' ||
       startsWith(github.ref_name, 'tag/')
     steps:
       - name: Set tag name
         run: |
-          if [ "${GITHUB_BASE_REF}" = 'main' ]; then
+          if [ "${GITHUB_REF_NAME}" = 'main' ]; then
+            echo "WKDEV_SDK_TAG=latest" >> "${GITHUB_ENV}"
+          elif [[ "${GITHUB_REF_NAME}" =~ ^tag/(.+)$ ]]; then
+            echo "WKDEV_SDK_TAG=${BASH_REMATCH[1]}" >> "${GITHUB_ENV}"
+          else
             echo "WKDEV_SDK_TAG=latest" >> "${GITHUB_ENV}"
           fi
           echo "WKDEV_SDK_CONTAINER_REGISTRY_USER_NAME=$(echo ${GITHUB_REPOSITORY_OWNER} | tr '[:upper:]' '[:lower:]')" >> "${GITHUB_ENV}"
           echo "REPO=ghcr.io/$(echo ${GITHUB_REPOSITORY_OWNER} | tr '[:upper:]' '[:lower:]')/wkdev-sdk" >> "${GITHUB_ENV}"
 
+      - name: Debug tag information
+        run: |
+          echo "GITHUB_REF_NAME=${GITHUB_REF_NAME}"
+          echo "WKDEV_SDK_TAG=${WKDEV_SDK_TAG}"
+          echo "REPO=${REPO}"
+          echo "Full image tag: ${REPO}:${WKDEV_SDK_TAG}_arm"
+
       - name: Install podman
         run: sudo apt-get update && sudo apt-get -y install podman fuse-overlayfs
 
@@ -185,16 +216,14 @@ jobs:
 
       - name: Clean unrelated images
         run: |
-          podman rmi --ignore --force ${REPO}:latest
-          podman manifest rm ${REPO}:latest || true
-          podman rmi --ignore --force ${REPO}:latest_amd64
+          podman rmi --ignore --force ${REPO}:${WKDEV_SDK_TAG}
+          podman manifest rm ${REPO}:${WKDEV_SDK_TAG} || true
+          podman rmi --ignore --force ${REPO}:${WKDEV_SDK_TAG}_arm
 
       - name: Build image
         run: |
-          source ./register-sdk-on-host.sh
-          wkdev-sdk-bakery --mode=build --verbose --arch arm
+          podman build -t ${REPO}:${WKDEV_SDK_TAG}_arm --arch=arm images/wkdev_sdk
           podman image list
-          wkdev-sdk-bakery --mode=export --verbose --arch arm
 
       - name: Test image
         run: |
@@ -206,13 +235,11 @@ jobs:
           wkdev-enter -n ${CONTAINER} --exec -- ./WebKit/Tools/Scripts/build-webkit --wpe --release --generate-project-only
           wkdev-enter -n ${CONTAINER} --exec -- ./WebKit/Tools/Scripts/build-webkit --gtk --release --generate-project-only
 
-      - name: Archive image
+      - name: Push image
         if: github.ref_name == 'main' || startsWith(github.ref_name, 'tag/')
-        uses: actions/upload-artifact@v4
-        with:
-          name: wkdev-sdk-arm.tar
-          path: wkdev-sdk-arm.tar
-          retention-days: 7
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | podman login ghcr.io --username=${GITHUB_REPOSITORY_OWNER} --password-stdin
+          podman push ${REPO}:${WKDEV_SDK_TAG}_arm
 
       - name: Cleanup test artifacts
         if: always()
@@ -228,19 +255,32 @@ jobs:
 
   deploy:
     runs-on: [self-hosted, x64]
+    permissions:
+      packages: write
     needs: [build_amd64, build_armv7, build_arm64]
     if: |
       (github.event_name != 'create' || startsWith(github.ref_name, 'tag/')) &&
       (github.ref_name == 'main' || startsWith(github.ref_name, 'tag/'))
     steps:
       - name: Set tag name
         run: |
-          if [ "${GITHUB_BASE_REF}" = 'main' ]; then
+          if [ "${GITHUB_REF_NAME}" = 'main' ]; then
+            echo "WKDEV_SDK_TAG=latest" >> "${GITHUB_ENV}"
+          elif [[ "${GITHUB_REF_NAME}" =~ ^tag/(.+)$ ]]; then
+            echo "WKDEV_SDK_TAG=${BASH_REMATCH[1]}" >> "${GITHUB_ENV}"
+          else
             echo "WKDEV_SDK_TAG=latest" >> "${GITHUB_ENV}"
           fi
           echo "WKDEV_SDK_CONTAINER_REGISTRY_USER_NAME=$(echo ${GITHUB_REPOSITORY_OWNER} | tr '[:upper:]' '[:lower:]')" >> "${GITHUB_ENV}"
           echo "REPO=ghcr.io/$(echo ${GITHUB_REPOSITORY_OWNER} | tr '[:upper:]' '[:lower:]')/wkdev-sdk" >> "${GITHUB_ENV}"
 
+      - name: Debug tag information
+        run: |
+          echo "GITHUB_REF_NAME=${GITHUB_REF_NAME}"
+          echo "WKDEV_SDK_TAG=${WKDEV_SDK_TAG}"
+          echo "REPO=${REPO}"
+          echo "Multi-arch manifest tag: ${REPO}:${WKDEV_SDK_TAG}"
+
       - name: Install podman
         run: sudo apt-get update && sudo apt-get -y install podman fuse-overlayfs
 
@@ -256,28 +296,60 @@ jobs:
       - name: Checkout repo
         uses: actions/checkout@v4
 
-      - name: Download images
-        uses: actions/download-artifact@v4
-        with:
-          pattern: wkdev-sdk-*
-          merge-multiple: true
-      - run: ls -al
+      - name: Login to registry
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | podman login ghcr.io --username=${GITHUB_REPOSITORY_OWNER} --password-stdin
+
+      - name: Validate all architecture images exist in registry
+        id: validate
+        run: |
+          VALIDATION_FAILED=0
+          for arch in amd64 arm64 arm; do
+            if ! podman manifest inspect docker://${REPO}:${WKDEV_SDK_TAG}_${arch} > /dev/null 2>&1; then
+              echo "Error: Image ${REPO}:${WKDEV_SDK_TAG}_${arch} does not exist in registry"
+              VALIDATION_FAILED=1
+            else
+              echo "Validated: ${REPO}:${WKDEV_SDK_TAG}_${arch} exists in registry"
+            fi
+          done
+          if [ $VALIDATION_FAILED -eq 1 ]; then
+            echo "validation_failed=true" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+          echo "validation_failed=false" >> $GITHUB_OUTPUT
 
-      - name: Clean all previous images
+      - name: Clean up arch-specific images on validation failure
+        if: failure() && steps.validate.outputs.validation_failed == 'true'
         run: |
-          podman rmi --ignore --force ${REPO}:latest
-          podman manifest rm ${REPO}:latest || true
-          podman rmi --ignore --force ${REPO}:latest_arm64
-          podman rmi --ignore --force ${REPO}:latest_amd64
-          podman rmi --ignore --force ${REPO}:latest_arm
+          echo "Validation failed, cleaning up any pushed arch-specific images from registry..."
+          for arch in amd64 arm64 arm; do
+            if podman manifest inspect docker://${REPO}:${WKDEV_SDK_TAG}_${arch} > /dev/null 2>&1; then
+              echo "Deleting ${REPO}:${WKDEV_SDK_TAG}_${arch} from registry..."
+              podman rmi docker://${REPO}:${WKDEV_SDK_TAG}_${arch} || true
+            fi
+          done
+
+      - name: Clean all previous local images
+        run: |
+          podman rmi --ignore --force ${REPO}:${WKDEV_SDK_TAG}
+          podman manifest rm ${REPO}:${WKDEV_SDK_TAG} || true
+          podman rmi --ignore --force ${REPO}:${WKDEV_SDK_TAG}_arm64
+          podman rmi --ignore --force ${REPO}:${WKDEV_SDK_TAG}_amd64
+          podman rmi --ignore --force ${REPO}:${WKDEV_SDK_TAG}_arm
 
-      - name: Deploy image
+      - name: Create and push multi-arch manifest
         run: |
-          podman load < ./wkdev-sdk-amd64.tar
-          podman load < ./wkdev-sdk-arm64.tar
-          podman load < ./wkdev-sdk-arm.tar
-          podman image list
           echo "${{ secrets.GITHUB_TOKEN }}" | podman login ghcr.io --username=${GITHUB_REPOSITORY_OWNER} --password-stdin
-          source ./register-sdk-on-host.sh
-          wkdev-sdk-bakery --mode=deploy --verbose --multiarch
-          podman image list
+          podman manifest create ${REPO}:${WKDEV_SDK_TAG}
+          podman manifest add ${REPO}:${WKDEV_SDK_TAG} docker://${REPO}:${WKDEV_SDK_TAG}_amd64
+          podman manifest add ${REPO}:${WKDEV_SDK_TAG} docker://${REPO}:${WKDEV_SDK_TAG}_arm64
+          podman manifest add ${REPO}:${WKDEV_SDK_TAG} docker://${REPO}:${WKDEV_SDK_TAG}_arm
+          podman manifest push --all ${REPO}:${WKDEV_SDK_TAG} docker://${REPO}:${WKDEV_SDK_TAG}
+
+      - name: Clean up arch-specific tags from registry
+        if: success()
+        run: |
+          echo "Multi-arch manifest successfully pushed, cleaning up arch-specific tags from registry..."
+          for arch in amd64 arm64 arm; do
+            echo "Deleting ${REPO}:${WKDEV_SDK_TAG}_${arch} from registry..."
+            podman rmi docker://${REPO}:${WKDEV_SDK_TAG}_${arch} || true
+          done
