Skip to content

Commit 2081b52

Browse files
azmeukazmeuk
committed
feat: publish a container image on each release
1 parent 07d46b7 commit 2081b52

6 files changed

Lines changed: 141 additions & 1 deletion

File tree

‎.containerignore‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
*
2+
!pyproject.toml
3+
!uv.lock
4+
!README.md
5+
!LICENSE.md
6+
!scim2_cli
7+
**/__pycache__

‎.github/workflows/release.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,3 +82,45 @@ jobs:
8282

8383
- name: Push build artifacts to PyPI
8484
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
85+
86+
container:
87+
name: publish container image
88+
runs-on: ubuntu-24.04
89+
permissions:
90+
contents: read
91+
packages: write
92+
id-token: write
93+
attestations: write
94+
artifact-metadata: write
95+
steps:
96+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
97+
with:
98+
persist-credentials: false
99+
- uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
100+
- uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
101+
- uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
102+
with:
103+
registry: ghcr.io
104+
username: ${{ github.actor }}
105+
password: ${{ secrets.GITHUB_TOKEN }}
106+
- id: meta
107+
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
108+
with:
109+
images: ghcr.io/${{ github.repository }}
110+
tags: |
111+
type=semver,pattern={{version}}
112+
type=semver,pattern={{major}}.{{minor}}
113+
- id: push
114+
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
115+
with:
116+
context: .
117+
file: Containerfile
118+
platforms: linux/amd64,linux/arm64
119+
push: true
120+
tags: ${{ steps.meta.outputs.tags }}
121+
labels: ${{ steps.meta.outputs.labels }}
122+
- uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
123+
with:
124+
subject-name: ghcr.io/${{ github.repository }}
125+
subject-digest: ${{ steps.push.outputs.digest }}
126+
push-to-registry: true

‎.github/workflows/tests.yaml‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,9 +129,30 @@ jobs:
129129
- run: nix build
130130
- run: nix flake check
131131

132+
container:
133+
name: container image
134+
runs-on: ubuntu-24.04
135+
services:
136+
scim2-server:
137+
image: ghcr.io/python-scim/scim2-server:0.7.1
138+
ports:
139+
- 8080:8080
140+
options: >-
141+
--health-cmd "python -c 'import urllib.request; urllib.request.urlopen(\"http://127.0.0.1:8080/v2/ServiceProviderConfig\")'"
142+
--health-interval 1s
143+
--health-retries 30
144+
steps:
145+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
146+
with:
147+
persist-credentials: false
148+
- name: Build image
149+
run: docker build --file Containerfile --tag scim2-cli:ci .
150+
- name: Check the server compliance
151+
run: docker run --rm --network host --env SCIM_CLI_URL=http://127.0.0.1:8080/v2 scim2-cli:ci test
152+
132153
all-checks:
133154
if: always()
134-
needs: [tests, minversions, style, doc, bundle, nix]
155+
needs: [tests, minversions, style, doc, bundle, nix, container]
135156
runs-on: ubuntu-24.04
136157
steps:
137158
- name: Fail if a needed job did not succeed

‎Containerfile‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
FROM docker.io/astral/uv:0.12.13-python3.14-trixie-slim@sha256:d2525beeae88affd18389bf69292abf9b5cbbb3f5c5242b6da3d20e304959b37 AS builder
2+
3+
ENV UV_COMPILE_BYTECODE=1 \
4+
UV_LINK_MODE=copy \
5+
UV_PYTHON_DOWNLOADS=0
6+
7+
WORKDIR /app
8+
COPY pyproject.toml uv.lock README.md LICENSE.md ./
9+
RUN uv sync --locked --no-dev --no-install-project
10+
COPY scim2_cli ./scim2_cli
11+
RUN uv sync --locked --no-dev --no-editable
12+
13+
FROM python:3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d
14+
15+
COPY --from=builder /app/.venv /app/.venv
16+
ENV PATH="/app/.venv/bin:$PATH"
17+
18+
WORKDIR /work
19+
USER nobody
20+
ENTRYPOINT ["scim2"]

‎doc/changelog.rst‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ Changelog
44
[Unreleased]
55
------------
66

7+
Added
8+
^^^^^
9+
- A container image is published on the GitHub container registry for each release.
10+
711
Changed
812
^^^^^^^
913
- The code is checked with mypy in strict mode.

‎doc/installation.rst‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,45 @@ Installation
6767
$ chmod +x scim2
6868
$ ./scim2 --help
6969
70+
.. tab-item:: :iconify:`devicon:docker` Container
71+
:sync: container
72+
73+
Each release publishes an image on the `GitHub container registry <https://github.com/python-scim/scim2-cli/pkgs/container/scim2-cli>`_.
74+
The arguments are passed to ``scim2``:
75+
76+
.. code-block:: console
77+
78+
$ docker run --rm ghcr.io/python-scim/scim2-cli --help
79+
80+
Pass the server URL and the headers with environment variables.
81+
Pass ``--interactive`` to send JSON on stdin:
82+
83+
.. code-block:: console
84+
85+
$ echo '{"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"], "userName": "bjensen"}' | \
86+
docker run --rm --interactive \
87+
--env SCIM_CLI_URL=https://auth.example/scim/v2 \
88+
--env SCIM_CLI_HEADERS="Authorization: Bearer 12345" \
89+
ghcr.io/python-scim/scim2-cli create
90+
91+
The working directory in the container is ``/work``.
92+
Mount the current directory there to read files with relative paths:
93+
94+
.. code-block:: console
95+
96+
$ docker run --rm --user "$(id -u):$(id -g)" --volume "$PWD:/work" \
97+
--env SCIM_CLI_URL=https://auth.example/scim/v2 \
98+
ghcr.io/python-scim/scim2-cli --schemas schemas.json search user
99+
100+
To check the compliance of a server in a CI pipeline, run the :ref:`reference:test` command:
101+
102+
.. code-block:: console
103+
104+
$ docker run --rm --env SCIM_CLI_URL=https://auth.example/scim/v2 ghcr.io/python-scim/scim2-cli test
105+
106+
A server running on the host is not reachable at ``localhost`` from the container.
107+
Pass ``--network host``, or run both containers on the same network.
108+
70109
.. tab-item:: :iconify:`devicon:git` Sources
71110
:sync: sources
72111

@@ -93,3 +132,10 @@ Installation
93132
$ uv sync --group bundle
94133
$ uv run pyinstaller scim2.spec
95134
$ ./dist/scim2 --help
135+
136+
Or build the container image:
137+
138+
.. code-block:: console
139+
140+
$ docker build --file Containerfile --tag scim2-cli .
141+
$ docker run --rm scim2-cli --help

0 commit comments

Comments
 (0)