airflow/.github/workflows/mirror-hardened-base-images.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: Mirror hardened base images
# Copies the Docker Hardened Image (https://dhi.io) tags that Airflow images are built on into a
# public ghcr.io repository owned by the project.
#
# Pulling from dhi.io requires a Docker Hub login. Requiring one to build an Airflow image would
# mean every contributor and every CI job needs Docker Hub credentials, so the tags are mirrored
# instead and `BASE_IMAGE` defaults to the mirror. The images are Apache-2.0 licensed, so
# redistributing them is allowed.
#
# `docker buildx imagetools create` copies the multi-platform manifest between registries without
# pulling the layers into the runner, so a refresh of all Python versions is cheap.
#
# The builds do not use these moving tags: they are pinned to digests that only "breeze ci upgrade"
# moves, in a PR that has to pass the full CI. Docker rebuilds the images in place and moves the
# dhi.io apt repository on together with them, so a pin left behind soon stops matching what apt
# installs. A run that moves a tag past its pin therefore triggers that upgrade check, and the pins
# follow Docker's rebuilds within hours.
on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
    inputs:
      trigger-upgrade-check:
        description: >-
          Run the main upgrade check when a tag moves past its pin. "breeze ci upgrade" for main turns
          it off, as it is the upgrade that pins the images.
        type: boolean
        default: true
  schedule:
    - cron: '27 */6 * * *'
permissions:
  contents: read
concurrency:
  group: mirror-hardened-base-images
  cancel-in-progress: false
jobs:
  # Picks the runner the way CI does: RunsOn in apache/airflow, public runners when the repository
  # variable USE_PUBLIC_RUNNERS is "true".
  build-info:
    name: "Build info"
    runs-on: ["ubuntu-slim"]
    timeout-minutes: 10
    if: github.repository == 'apache/airflow' && github.ref == 'refs/heads/main'
    permissions:
      contents: read
    outputs:
      runner-type: ${{ steps.selective-checks.outputs.runner-type }}
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 2
          persist-credentials: false
      - name: "Install Breeze"
        uses: ./.github/actions/breeze
        with:
          free-space: "false"
      - name: "Save github context to file"
        # Same as in ci-amd.yml: a scheduled or dispatched run has no attacker-controlled context, and
        # the single-quoted heredoc disables every shell expansion of the JSON anyway.
        shell: bash
        run: |  # zizmor: ignore[template-injection]
          cat > "${RUNNER_TEMP}/github_context.json" << '__GITHUB_CONTEXT_END__'
          ${{ toJson(github) }}
          __GITHUB_CONTEXT_END__
      - name: "Selective checks"
        id: selective-checks
        env:
          COMMIT_REF: "${{ github.sha }}"
          VERBOSE: "false"
          GITHUB_CONTEXT_INPUT: "${{ runner.temp }}/github_context.json"
          PLATFORM: "linux/amd64"
          USE_PUBLIC_RUNNERS: "${{ vars.USE_PUBLIC_RUNNERS }}"
        run: breeze ci selective-check 2>> ${GITHUB_OUTPUT}
  mirror:
    name: "Mirror hardened base images"
    needs: [build-info]
    # Copies manifests registry-to-registry without pulling layers, so the smallest class is enough.
    runs-on: ${{ format(fromJSON(needs.build-info.outputs.runner-type)[0], '2+4', '8+16') }}
    timeout-minutes: 30
    # Never runs on forks - they have neither the credentials nor the package to push to. Only main
    # pushes: the mirror is the default BASE_IMAGE of every build, so a manual dispatch from any other
    # branch must not be able to replace it. Main mirrors every Python version an active release
    # branch still builds on, so the release branches need no runs of their own.
    if: github.repository == 'apache/airflow' && github.ref == 'refs/heads/main'
    permissions:
      actions: write
      contents: read
      packages: write
    steps:
      - name: "Cleanup repo"
        shell: bash
        run: sudo rm -rf ${GITHUB_WORKSPACE}/*
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: "Install Breeze"
        uses: ./.github/actions/breeze
      # dhi.io accepts any Docker Hub account - the free tier covers the images we mirror - so this
      # reuses the credentials the DockerHub release workflows already use.
      - name: "Login to dhi.io"
        env:
          DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: echo "${DOCKERHUB_TOKEN}" | docker login dhi.io -u "${DOCKERHUB_USER}" --password-stdin
      - name: "Login to ghcr.io"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ACTOR: ${{ github.actor }}
        run: echo "${GITHUB_TOKEN}" | docker login ghcr.io -u "${ACTOR}" --password-stdin
      - name: "Mirror base images"
        id: mirror
        run: breeze release-management mirror-base-images
      # Only main's pins: release branches move theirs on their own upgrade schedule. Also after a
      # failed mirror step: a tag it moved before failing stays moved, so a re-run would not see it
      # move again.
      - name: "Trigger the upgrade check to move the pinned base images"
        if: >-
          !cancelled() && steps.mirror.outputs.moved-past-pins == 'true' &&
          (github.event_name == 'schedule' || inputs.trigger-upgrade-check)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh workflow run scheduled-upgrade-check-main.yml --repo "${GITHUB_REPOSITORY}" --ref main