Improve CI builds - #700
Merged
jaydrogers merged 23 commits intoSep 10, 2026
Merged
Conversation
- Update Docker workflows to improve build and publish processes for production, beta, and PR images. - Introduce a new setup matrix workflow for better PHP version management. - Implement auto-retry for failed image builds to handle transient errors. - Add support for additional environment variables in the Docker build process. - Refactor PHP version validation to ensure all necessary base images are available on DockerHub. - Update documentation to reflect changes in CI/CD processes and workflows.
jaydrogers
changed the base branch from
main
to
release/webserver-improvements-and-fixes
September 9, 2026 19:05
jaydrogers
marked this pull request as ready for review
September 9, 2026 19:06
jaydrogers
marked this pull request as draft
September 9, 2026 19:06
Deploying serversideup-php with
|
| Latest commit: |
a826b0d
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://35c67a80.serversideup-php.pages.dev |
| Branch Preview URL: | https://ci-improvements.serversideup-php.pages.dev |
Images for PR #700
Try it: docker run --rm -v "$PWD:/var/www/html" -p 8080:8080 serversideup/php-dev:700-8.5-fpm-nginxEvery image is on Docker Hub as All images with sizesSizes are compressed, per architecture.
Updated on every push to this PR. |
…n on transient failures
…update documentation for improved clarity
s6-overlay 3.2.3 moved its user bundle to /etc/s6-overlay/user-bundles.d and no longer ships s6-rc.d/user/type. With our services still registered under the old s6-rc.d/user/contents.d path, rc.init tried to create that type file at startup, failed as the unprivileged www-data user, and nginx or apache never started, leaving the container unhealthy forever. Register php-fpm, nginx, and apache2 in user-bundles.d/user/contents.d instead. Verified with local fpm-nginx and fpm-apache builds on bookworm: both services start and the HEALTHCHECK reports healthy.
Add a hadolint job to the lint group so Dockerfile mistakes are caught before any image builds. Rules that conflict with deliberate project decisions (unpinned apt/apk packages for weekly security rebuilds, shell-form CMD, named USER, and so on) are ignored in .hadolint.yaml with the reason recorded next to each one. Fix the two findings it raised in the fpm-nginx Dockerfile: the Alpine repository printf had five placeholders but four arguments, and egrep is replaced with grep -E.
Replace the per-job summary cards (68 lists of pull commands) with a single table for the whole run. Each build job now records its canonical tag and compressed size per architecture, read from the registry manifest, and uploads it as a small artifact. A new service_summary.yml merges those files with scripts/build-summary.sh into one table grouped by variation, listing images that failed to build as well. Before building, each job looks up the same tag on serversideup/php so the table shows how much every image grew compared to what users pull today. Growth over 10% is flagged. The setup card shrinks to the PHP patch versions resolved from php.net, which is the one thing only that job knows.
Nothing ran the images after they were built, so a broken entrypoint would only be noticed by users. scripts/smoke-test.sh runs an image and checks what a user would hit first: PHP reports the expected version, the container runs as an unprivileged user, and images with a HEALTHCHECK become healthy. On failure it prints the container logs. service_smoke-test.yml selects the newest PHP version of every variation on one Debian and one Alpine base from the run's image details and tests each on native amd64 and arm64 GitHub runners. Images that were not pushed (pull requests from forks) are skipped. The script works against any image reference, so it doubles as a local check before opening a PR that touches startup behavior. It caught the s6-overlay user bundle regression fixed earlier in this branch.
Add smoke and summary jobs to the PR, production, and beta workflows. Both run whenever the matrix was generated, even if some builds failed, so a red run still shows which images are missing and whether the rest work. The PR comment now reports the smoke test result and carries the full image table, collapsed, next to the pull commands.
…sting for Docker images
- Split the image build and publish processes into separate reusable workflows: `service_build-images.yml` and `service_publish-images.yml`. - Enhance the smoke test workflow to pull images from the Depot Registry and validate them against expected behaviors. - Introduce a new script `select-smoke-images.sh` to select representative images for smoke testing based on the latest PHP versions and variations. - Update the summary generation script to reflect changes in image publishing and size reporting. - Add tests for CI helper scripts to ensure consistent behavior across environments. - Improve documentation to clarify the CI/CD process and the role of each workflow in the image publishing pipeline.
…ng, and refined smoke test processes
…mage selection and publishing
…ing reliability and clarity in the publishing process
…cy across image publishing and testing processes
- Updated service_build-images.yml to handle image loading and testing for pull requests from forks, ensuring that amd64 images are tested directly on the runner. - Modified service_publish-images.yml to improve image promotion logic, including digest verification and enhanced error handling for failed image promotions. - Improved service_test-images.yml to group saved images by PHP version and base OS, allowing for more efficient testing and clearer reporting of results. - Enhanced trigger_auto-retry-failed-builds.yml to better manage transient failures, including automatic issue creation for persistent failures. - Updated AGENTS.md and contributing documentation to reflect changes in the CI/CD process and image testing. - Refined scripts/build-summary.sh to prioritize published image records and improve error visibility for failed builds. - Enhanced scripts/test-image.sh to check for loaded PHP extensions and validate web server responses for images that include a web server. - Adjusted scripts/tests/run.sh to reflect changes in image publishing status and ensure accurate testing of image details.
…edundant result reporting
jaydrogers
marked this pull request as ready for review
September 10, 2026 15:07
jaydrogers
merged commit Sep 10, 2026
33352f9
into
release/webserver-improvements-and-fixes
114 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why we created this PR
Build and publish used to be one step. An image went public the moment it built, even on the weekly rebuilds. Nothing ever ran it.
While working on 4.6, s6-overlay 3.2.3 broke startup for every
fpm-nginxandfpm-apacheimage. They all built fine. The old pipeline would have published all of them.How to test
View the testing images →
How publishing works now
amd64andarm64and saves it to a private registry.amd64andarm64runners. It must start, run unprivileged, report the right PHP version, load the default extensions, pass its health check, and serve a PHP file through its web server.If one image fails, nothing from that run is published. What you pull is what passed.
What this PR does
Testing
scripts/test-image.sh. Works on any image:bash scripts/test-image.sh serversideup/php-dev:700-8.4-fpm-nginxamd64image on the runnerPublishing
depot push. No image bytes touch a runnerSpeed
When something fails
Linting
Build hardening
docker-php-serversideup-download, acurlwrapper with retries, and used it for every download during a buildapt-getretries on Debianget-php-versions.shchecks that every base image we need exists on Docker Hub before adding a version to the matrixSecurity
Docs