.kraken.py

from __future__ import annotations
from kraken.common import buildscript

buildscript(requirements=["kraken-build"])

import os
import re
from functools import lru_cache
from kraken.core import Project, Task
from kraken.std.docker import build_docker_image, manifest_tool
from kraken.std.git.version import git_describe, GitVersion

project = Project.current()
version = GitVersion.parse(git_describe(project.directory)).format(dirty=False)
image_prefix = "ghcr.io/kraken-build/kraken-base-image"

base_image = "ubuntu"
image_versions = ["22.04", "24.04"]
latest_version = image_versions[-1]

default_base_image = f"{base_image}:{latest_version}"
base_images = set([f"{base_image}:{version}" for version in image_versions])
platforms = ["linux/arm64", "linux/amd64"]


@lru_cache()
def get_docker_auth() -> dict[str, tuple[str, str]]:
    username, password = os.getenv("GITHUB_USER"), os.getenv("GITHUB_PASSWORD")
    if username and password:
        return {"ghcr.io": (username, password)}
    if "CI" in os.environ:
        raise Exception("GITHUB_USER/GITHUB_PASSWORD are required in CI")
    return {}


def build_kraken_image(base_image: str, platform: str) -> tuple[Task, list[str]]:
    if os.getenv("GITHUB_REF") == "refs/heads/develop":
        versions = [version, "develop"]
    else:
        versions = [version]

    m = re.match(r"^(\d+\.\d+)\.\d+(.*)$", version)
    assert m is not None, version
    versions.append(f"{m.group(1)}{m.group(2)}")

    prefix = f"{image_prefix}/{platform}"
    tag_prefixes = [f"{prefix}:{tag}" for tag in versions]
    tags = [f"{p}-{base_image.replace(':', '_')}" for p in tag_prefixes]
    if base_image == default_base_image:
        tags += tag_prefixes

    task = build_docker_image(
        name=f"docker-kraken-image/{base_image.replace(':', '_')}/{platform}",
        backend="buildx",
        dockerfile=project.directory / "Dockerfile",
        auth=get_docker_auth(),
        tags=tags,
        platform=platform,
        build_args={"BASE_IMAGE": base_image, "ACTIONS_CACHE_URL": os.environ["ACTIONS_CACHE_URL"]},
        secrets={"ACTIONS_RUNTIME_TOKEN": os.environ["ACTIONS_RUNTIME_TOKEN"]},
        cache_repo=f"{prefix}:{base_image.replace(':', '_')}-cache",
        push=True,
        load=False,
    )

    return task, tags


for base_image in base_images:
    build_tasks = [build_kraken_image(base_image, platform) for platform in platforms]

    for idx, tag in enumerate(build_tasks[0][1]):
        tag_version = tag.rpartition(":")[-1]
        manifest_tool(
            name=f"docker-kraken-image-multiarch-{tag_version}/{base_image.replace(':', '_')}",
            group="docker-kraken-image-multiarch",
            template=f"{image_prefix}/OS/ARCH:{version}-{base_image.replace(':', '_')}",
            platforms=platforms,
            target=f"{image_prefix}:{tag_version}",
            inputs=[task for task, _tags in build_tasks],
        )