refactor: Dockerfile and CI

.github/workflows/publishDockerImage.yml

@@ -13,25 +13,41 @@ jobs:
     steps:
       - name: Check out the repo
         uses: actions/checkout@v2
-      
+
       - name: Log in to Docker Hub
+        if: ${{ github.event_name != 'pull_request' }}
         uses: docker/login-action@v1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v3
-        with:
-          images: im2nguyen/rover
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Set outputs
+        id: tag
+        run: |
+          set -x
+          echo ::set-output name=version::$(cat ${GITHUB_EVENT_PATH} | jq -r '.release.tag_name')
+          echo ::set-output name=sha_short::${GITHUB_SHA::7}
+
+      - name: Build and push
+        uses: docker/bake-action@master
+        env:
+          TF_VERSION: "1.1.2"
+          NODE_VERSION: "16"
+          GO_VERSION: "1.17"
+          VERSION: ${{ steps.tag.outputs.version }}
+          GIT_SHA: ${{ steps.tag.outputs.sha_short }}
         with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: 
-            TF_VERSION=1.1.2
+          targets: |
+            image-all
+            image-slim-all
+          push: ${{ github.event_name != 'pull_request' }}
+          files: docker-bake.hcl
+          set: |
+            *.cache-from=type=gha
+            *.cache-to=type=gha,mode=max

.github/workflows/release.yml

@@ -14,24 +14,28 @@ on:
   push:
     tags:
       - "v*"
+
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v2
-      - name: Unshallow
-        run: git fetch --prune --unshallow
+        with:
+          fetch-depth: 0
+
       - name: Set up Go
         uses: actions/setup-go@v2
         with:
           go-version: 1.17
+
       - name: Import GPG key
         id: import_gpg
         uses: hashicorp/[email protected]
         env:
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           PASSPHRASE: ${{ secrets.PASSPHRASE }}
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v2
         with:

.github/workflows/test.yml

@@ -0,0 +1,30 @@
+name: UI - Build Test
+
+on:
+  push:
+    paths:
+      - "ui/**"
+
+jobs:
+  ui-build-test:
+    name: Test npm build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v2
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Build and push
+        uses: docker/bake-action@master
+        env:
+          NODE_VERSION: "16"
+        with:
+          set: |
+            *.target=ui
+            *.cache-from=type=gha
+            *.cache-to=type=gha,mode=max

.gitignore

@@ -2,10 +2,11 @@ build/rover
 .DS_Store
 rover.zip
 plan.out
+Dockerfile.test
+.dist
 
 # Ignore generated terraform files
 .terraform**
-
 .idea/
-
+.dist/
 build/

.goreleaser.yml

@@ -4,6 +4,8 @@ before:
   hooks:
     # this is just an example and not a requirement for provider building/publishing
     - go mod tidy
+    - go mod download
+
 builds:
   - env:
       # goreleaser does not work with CGO, it could also complicate
@@ -14,7 +16,7 @@ builds:
     flags:
       - -trimpath
     ldflags:
-      - "-s -w -X main.version={{.Version}} -X main.commit={{.Commit}}"
+      - "-s -w"
     goos:
       - freebsd
       - windows
@@ -29,6 +31,7 @@ builds:
       - goos: darwin
         goarch: "386"
     binary: "{{ .ProjectName }}_v{{ .Version }}"
+
 archives:
   - format: zip
     name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"

Dockerfile

@@ -1,44 +1,106 @@
-# Prep base stage
-ARG TF_VERSION=light
+# syntax = docker/dockerfile:1.3
 
-# Build ui
-FROM node:16-alpine as ui
+ARG NODE_VERSION=16
+ARG GO_VERSION=1.17
+
+FROM --platform=$BUILDPLATFORM node:${NODE_VERSION}-alpine as ui
 WORKDIR /src
-# Copy specific package files
-COPY ./ui/package-lock.json ./
-COPY ./ui/package.json ./
-COPY ./ui/babel.config.js ./
-# Set Progress, Config and install
+COPY ./ui/package*.json ./
 RUN npm set progress=false && npm config set depth 0 && npm install
-# Copy source
-# Copy Specific Directories
 COPY ./ui/public ./public
 COPY ./ui/src ./src
-# build (to dist folder)
 RUN npm run build
 
-# Build rover
-FROM golang:1.17 AS rover
+FROM --platform=$BUILDPLATFORM alpine:3.15 as terraform
+SHELL ["/bin/sh", "-cex"]
+ARG TF_VERSION="1.1.2"
+ARG TARGETOS TARGETARCH
+RUN wget -O tf.zip 'https://releases.hashicorp.com/terraform/'${TF_VERSION}'/terraform_'${TF_VERSION}'_'${TARGETOS}'_'${TARGETARCH}'.zip'; \
+  unzip tf.zip
+
+FROM --platform=$BUILDPLATFORM crazymax/goreleaser-xx:latest AS goreleaser-xx
+FROM --platform=$BUILDPLATFORM pratikimprowise/upx:3.96 AS upx
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS base
+COPY --from=goreleaser-xx / /
+COPY --from=upx / /
+ENV CGO_ENABLED=0
+RUN apk --update add --no-cache git ca-certificates && \
+  update-ca-certificates
 WORKDIR /src
-# Copy full source
+
+FROM base AS vendored
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/go/pkg/mod \
+  go mod tidy && go mod download
+
+FROM vendored AS binary
+ARG TARGETPLATFORM
+COPY --from=ui /src/dist /src/ui/dist
 COPY . .
-# Copy ui/dist from ui stage as it needs to embedded
-COPY --from=ui ./src/dist ./ui/dist
-# Build rover
-RUN go get -d -v golang.org/x/net/html  
-RUN CGO_ENABLED=0 GOOS=linux go build -o rover .
-
-# Release stage
-FROM hashicorp/terraform:$TF_VERSION AS release
-# Copy terraform binary to the rover's default terraform path
-RUN cp /bin/terraform /usr/local/bin/terraform
-# Copy rover binary
-COPY --from=rover /src/rover /bin/rover
-RUN chmod +x /bin/rover
-
-# Install Google Chrome
-RUN apk add chromium
+RUN --mount=type=cache,target=/root/.cache \
+  --mount=type=cache,target=/go/pkg/mod \
+  goreleaser-xx --debug \
+    --name="rover" \
+    --main="." \
+    --dist="/out" \
+    --artifacts="bin" \
+    --artifacts="archive" \
+    --snapshot="no"
 
+FROM scratch as standard
+WORKDIR /tmp
 WORKDIR /src
+COPY --from=base      /etc/ssl/certs/ /etc/ssl/certs/
+COPY --from=terraform /terraform           /usr/local/bin/terraform
+COPY --from=binary    /usr/local/bin/rover /usr/local/bin/rover
+ENTRYPOINT ["/usr/local/bin/rover"]
+##
+
+## Slim image
+FROM vendored AS binary-slim
+COPY --from=ui /src/dist /src/ui/dist
+COPY . .
+ARG TARGETPLATFORM
+RUN --mount=type=cache,target=/root/.cache \
+  --mount=type=cache,target=/go/pkg/mod \
+  goreleaser-xx --debug \
+    --name="rover-slim" \
+    --flags="-trimpath" \
+    --ldflags="-s -w" \
+    --main="." \
+    --dist="/out" \
+    --artifacts="bin" \
+    --artifacts="archive" \
+    --snapshot="no" \
+    --post-hooks="upx -v --ultra-brute /usr/local/bin/{{ .ProjectName }}{{ .Ext }}"
+
+FROM terraform as slim-tf
+COPY --from=upx / /
+RUN upx -v --ultra-brute /terraform
+
+FROM scratch as slim
+WORKDIR /tmp
+WORKDIR /src
+COPY --from=base    /etc/ssl/certs/ /etc/ssl/certs/
+COPY --from=slim-tf /terraform /usr/local/bin/terraform
+COPY --from=binary-slim /usr/local/bin/rover-slim /usr/local/bin/rover
+ENTRYPOINT ["/usr/local/bin/rover"]
+##
+
+## get binary out
+### non slim binary
+FROM scratch AS artifact
+COPY --from=binary      /out /
+###
+
+### slim binary
+FROM scratch AS artifact-slim
+COPY --from=binary-slim /out /
+###
 
-ENTRYPOINT [ "/bin/rover" ]
+### All binaries
+FROM scratch AS artifact-all
+COPY --from=binary      /out /
+COPY --from=binary-slim /out /
+###
+##