👷 (ci): Build and push the native image to GHCR on main
Changes
3 files changed, +53 -1
MODIFY
.github/workflows/native.yml
+38 -0
@@ -8,6 +8,9 @@
8
8
jobs:
9
9
native-build:
10
10
runs-on: ubuntu-latest
11
+ permissions:
12
+ contents: read
13
+ packages: write
11
14
steps:
12
15
- uses: actions/checkout@v7
13
16
- uses: actions/setup-java@v5
@@ -17,3 +20,38 @@
17
20
cache: maven
18
21
- name: Native build & integration tests
19
22
run: ./mvnw -B verify -Dnative -Dquarkus.native.container-build=true
23
+ # Publish the native image to GHCR after the build and integration tests pass.
24
+ # The native executable is architecture-specific and was compiled on this amd64
25
+ # runner, so the image is published for linux/amd64 only (the multi-arch manifest
26
+ # is the JVM image's job).
27
+ - name: Log in to GHCR
28
+ if: github.ref == 'refs/heads/main' && github.event_name == 'push'
29
+ uses: docker/login-action@v4
30
+ with:
31
+ registry: ghcr.io
32
+ username: ${{ github.actor }}
33
+ password: ${{ secrets.GITHUB_TOKEN }}
34
+ - name: Set up Docker Buildx
35
+ if: github.ref == 'refs/heads/main' && github.event_name == 'push'
36
+ uses: docker/setup-buildx-action@v3
37
+ - name: Extract image metadata
38
+ if: github.ref == 'refs/heads/main' && github.event_name == 'push'
39
+ id: meta
40
+ uses: docker/metadata-action@v6
41
+ with:
42
+ images: ghcr.io/${{ github.repository }}
43
+ flavor: |
44
+ suffix=-native,onlatest=true
45
+ tags: |
46
+ type=sha
47
+ type=raw,value=latest
48
+ - name: Build and push native image
49
+ if: github.ref == 'refs/heads/main' && github.event_name == 'push'
50
+ uses: docker/build-push-action@v7
51
+ with:
52
+ context: .
53
+ file: src/main/docker/Dockerfile.native-micro
54
+ platforms: linux/amd64
55
+ push: true
56
+ tags: ${{ steps.meta.outputs.tags }}
57
+ labels: ${{ steps.meta.outputs.labels }}
MODIFY
README.md
+3 -1
@@ -216,4 +216,6 @@
216
216
- `.github/workflows/jvm.yml` — JVM tests on every push/PR; on main, builds and pushes the
217
217
JVM container image to GHCR as a multi-arch manifest (linux/amd64 + linux/arm64, via
218
218
Buildx/QEMU).
219
-- `.github/workflows/native.yml` — native build + integration tests on every push/PR.
219
+- `.github/workflows/native.yml` — native build + integration tests on every push/PR; on
220
+ main, builds and pushes the native container image to GHCR with a `-native` tag suffix
221
+ (linux/amd64 only).
MODIFY
docs/admins/getting-started.md
+12 -0
@@ -44,6 +44,18 @@
44
44
natively on x86 servers and ARM hosts (Raspberry Pi 4/5, AWS Graviton, Apple
45
45
Silicon) alike.
46
46
47
+A **native image** (GraalVM native executable, no JVM) is also published with a
48
+`-native` tag suffix:
49
+
50
+```bash
51
+docker pull ghcr.io/workaround-org/git-shark:latest-native
52
+```
53
+
54
+It starts faster and uses less memory than the JVM image, but is currently built
55
+for **linux/amd64 only** and runs as UID `1001` (the JVM image uses `185` —
56
+adjust `securityContext`/volume ownership accordingly if you switch). Ports and
57
+environment variables are identical to the JVM image.
58
+
47
59
The image listens on **8080** (HTTP) and, once configured, **2222** (SSH). It runs as
48
60
UID `185` and reads all production settings from environment variables.
49
61