Skip to content

GHA: Simplify Container Image Action #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
oxzi wants to merge 1 commit into
base: main
Choose a base branch
from
Open

GHA: Simplify Container Image Action #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/container-image.Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@
# SPDX-License-Identifier: GPL-2.0-or-later

ARG DEBIAN_VERSION="trixie"
ARG PLUGINS=ghcr.io/icinga/icinga2-plugins-container:${DEBIAN_VERSION}

FROM ${PLUGINS} AS plugins

FROM debian:${DEBIAN_VERSION}-slim

Expand All @@ -16,7 +19,7 @@
rm -rf /var/lib/apt/lists/*

WORKDIR /usr/lib/nagios/plugins
CMD set -e; \

Check warning on line 22 in .github/workflows/container-image.Containerfile

View workflow job for this annotation

GitHub Actions / forky

JSON arguments recommended for ENTRYPOINT/CMD to prevent unintended behavior related to OS signals 

JSONArgsRecommended: JSON arguments recommended for CMD to prevent unintended behavior related to OS signals
More info: https://docs.docker.com/go/dockerfile/rule/json-args-recommended/

Check warning on line 22 in .github/workflows/container-image.Containerfile

View workflow job for this annotation

GitHub Actions / trixie

JSON arguments recommended for ENTRYPOINT/CMD to prevent unintended behavior related to OS signals 

JSONArgsRecommended: JSON arguments recommended for CMD to prevent unintended behavior related to OS signals
More info: https://docs.docker.com/go/dockerfile/rule/json-args-recommended/

Check warning on line 22 in .github/workflows/container-image.Containerfile

View workflow job for this annotation

GitHub Actions / bookworm

JSON arguments recommended for ENTRYPOINT/CMD to prevent unintended behavior related to OS signals 

JSONArgsRecommended: JSON arguments recommended for CMD to prevent unintended behavior related to OS signals
More info: https://docs.docker.com/go/dockerfile/rule/json-args-recommended/
for c in mssql_health nwc_health postgres.pl ssl_cert; do \
test -x "check_$c"; \
"./check_$c" --version || true; \
Expand Down
55 changes: 5 additions & 50 deletions .github/workflows/container-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,6 @@ on:
env:
IMAGE_NAME: "icinga/icinga2-plugins-container"

# Set to true in the "Prepare metadata (release tags)" step.
LATEST: false
LATEST_MAJOR: false

jobs:
container-image:
name: ${{ matrix.debian_version }}
Expand All @@ -41,62 +37,21 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v7
with:
fetch-depth: 0

# Copied from the generic container-image workflow
# https://github.com/Icinga/github-actions/blob/44428f25732785d7c26d03932494040e3aaf680f/.github/workflows/container-image.yml#L89
- name: Prepare metadata (release tags)
if: github.event_name == 'release' && github.event.action == 'published'
run: |
# Retrieve the greatest existing tag in the repository by sorting tags in descending order.
# Options used:
# * --sort=-v:refname sorts tags as versions, placing the highest version at the top.
# * -c 'versionsort.suffix=-' ensures that pre-release tags (e.g., 1.0.0-rc1) are sorted correctly,
# so they are not considered greater than their corresponding final release (e.g., 1.0.0).
# Intentionally not using head -1 to prevent potential broken pipe errors.
greatest_tag=$(git -c 'versionsort.suffix=-' tag --list --sort=-v:refname | awk 'NR==1')

if [ "${{ github.ref_name }}" = "$greatest_tag" ]; then
echo "The current tag ${{ github.ref_name }} is the greatest overall. Tagging as 'latest'."

# Update environment variable to enable tagging as 'latest'.
echo "LATEST=true" >> "$GITHUB_ENV"
else
echo "The current tag ${{ github.ref_name }} is not the greatest overall compared to $greatest_tag. Not tagging as 'latest'."
fi

major_version=$(echo ${{ github.ref_name }} | cut -d. -f1)
greatest_major=$(git -c 'versionsort.suffix=-' tag --list "${major_version}.*" --sort=-v:refname | awk 'NR==1')
if [ "${{ github.ref_name }}" = "$greatest_major" ]; then
echo "The current tag ${{ github.ref_name }} is the greatest within its major version. Tagging with major version ${major_version#v}."

# Update environment variable to enable tagging with major version.
echo "LATEST_MAJOR=true" >> "$GITHUB_ENV"
else
echo "The current tag ${{ github.ref_name }} is not the greatest within its major version compared to $greatest_major. Not tagging with major version ${major_version#v}."
fi

- name: Extract metadata (tags, labels)
id: meta
uses: docker/metadata-action@v6
with:
images: |
# GitHub Container Registry
ghcr.io/${{ env.IMAGE_NAME }}
images: ghcr.io/${{ env.IMAGE_NAME }}
labels: |
org.opencontainers.image.documentation=https://github.com/Icinga/icinga2-plugins-container
org.opencontainers.image.vendor=Icinga GmbH
flavor: |
# Disable automatic 'latest' tagging as our custom logic is used to
# determine when to apply the 'latest' tag.
latest=false
Comment on lines 49 to 50

@julianbrost julianbrost Nov 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now the removal of this comment slightly confuses me. The reason why this was set is gone, but you keep the setting as-is. Not sure if that was intentional or an oversight.

tags: |
type=edge,prefix=${{ matrix.debian_version }}-
type=semver,pattern={{version}},prefix=${{ matrix.debian_version }}-
type=semver,pattern={{major}}.{{minor}},prefix=${{ matrix.debian_version }}-
type=semver,pattern={{major}},prefix=${{ matrix.debian_version }}-,enable=${{ env.LATEST_MAJOR }}
type=raw,value=${{ matrix.debian_version }},enable=${{ env.LATEST }}
type=raw,value=${{ matrix.debian_version }},enable=${{ github.event_name == 'release' && !github.event.release.prerelease }}
type=semver,pattern={{version}},suffix=-${{ matrix.debian_version }}
type=edge,suffix=-${{ matrix.debian_version }}
Comment on lines 51 to +54

@julianbrost julianbrost Nov 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So compared to the different version labels I can currently see on https://github.com/Icinga/icinga2-plugins-container/pkgs/container/icinga2-plugins-container (0, 0.2, 0.2.0), those would be reduced back to only the full version (0.2.0)?

If so, that sounds reasonable. In the end, practically only the tags like trixie will be used, so if we can cut down additional complexity, great.


- name: Set up QEMU
uses: docker/setup-qemu-action@v4
Expand Down Expand Up @@ -124,7 +79,7 @@ jobs:
build-args: |
DEBIAN_VERSION=${{ matrix.debian_version }}
build-contexts: |
plugins=oci-layout://${{ runner.temp }}/plugins-oci@${{ steps.build-test.outputs.digest }}
ghcr.io/${{ env.IMAGE_NAME }}:${{ matrix.debian_version }}=oci-layout://${{ runner.temp }}/plugins-oci@${{ steps.build-test.outputs.digest }}
context: .
file: ./.github/workflows/container-image.Containerfile
platforms: linux/amd64
Expand Down
5 changes: 4 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,12 @@ Types of changes:
- Security in case of vulnerabilities
-->

### Changed
- Image tags now suffix the Debian version, e.g., `1.2.3-trixie`.

## 0.2.0 - 2026-11-11
### Changed
- Restructured container image, output under /usr/lib/nagios/plugins/
- Restructured container image, output under `/usr/lib/nagios/plugins/`.

## 0.1.0 - 2026-11-09
First tagged version, mostly to get the Icinga 2 PR going forward.
Expand Down
4 changes: 4 additions & 0 deletions Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,13 @@ ARG DEBIAN_VERSION="trixie"

FROM debian:${DEBIAN_VERSION}-slim AS build-plugins

# check_mssql_health: 2.9
ENV CHECK_MSSQL_HEALTH_REF=937f4f0aa7af90506924cb2b772e092e6538b348
# check_nwc_health: 12.17.2
ENV CHECK_NWC_HEALTH_REF=22fcf6b5877e2e503316fed500581d538ae8cfea
# check_postgres: 2.26.0
ENV CHECK_POSTGRES_REF=d0bba94836b2029109c487ed0f800fecd61ab2e9
# check_ssl_cert: 2.103.4
ENV CHECK_SSL_CERT_REF=86cbfac35ac339e52baea69a94029ab5b9134f10

RUN apt-get update && \
Expand Down
7 changes: 6 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,10 @@
# Icinga 2 Plugins Container

> [!CAUTION]
> This is an internal container image, not designed for end users!
>
> The Icinga 2 container image is built in the [icinga/icinga2](https://github.com/icinga/icinga2) repository.

This repository contains an intermediate container image to be referenced in Icinga 2's main Containerfile.
It ships external check plugins which are not available in any package manager.

Expand Down Expand Up @@ -33,7 +38,7 @@ $ # Build the main container image
$ podman build -t plugins .

$ # Build the testing container image
$ podman build -t plugins-test -f .github/workflows/container-image.Containerfile .
$ podman build -t plugins-test --build-arg PLUGINS=plugins -f .github/workflows/container-image.Containerfile .

$ # Test the testing container
$ podman run -t --rm plugins-test
Expand Down
Loading