chore: Use GitHub Actions to build Docker Images to allow publishing Windows Images

[lippertmarkus]

As mentioned in #2747 Docker Hub Automated Build Hooks don't allow to build Windows images. As v2.9.0 comes with Windows support for argoexec and as you migrated CI to GitHub Actions also, it would make sense to use GitHub Actions also for building the Docker images.

I added a workflow file which builds and pushes the images for Linux (workflow-controller, argoexec, argocli) and Windows (argoexec only) whenever a new tag v* is pushed. I used the existing Docker Hub Hooks (https://github.com/argoproj/argo/blob/master/hooks/build) as a base for the scripts. The jobs building and pushing the images are appending -linux or -windows to the tag, a third job is creating a Manifest and pushes it to allow for multiarch. Example:

1. Tag v2.9.0 is pushed
2. Job build-linux is building and pushing argoproj/workflow-controller:v2.9.0-linux, argoproj/argoexec:v2.9.0-linux argoproj/argocli:v2.9.0-linux
3. Job build-windows is building and pushing argoproj/argoexec:v2.9.0-windows
4. Job push-images is creating and pushing the following image manifest:
   • argoproj/workflow-controller:v2.9.0 referencing argoproj/workflow-controller:v2.9.0-linux
   • argoproj/argoexec:v2.9.0 referencing argoproj/argoexec:v2.9.0-linux and argoproj/argoexec:v2.9.0-windows (multiarch)
   • argoproj/argocli:v2.9.0 referencing argoproj/argocli:v2.9.0-linux

You can find an example run for a tag vtest17 here: https://github.com/lippertmarkus/argo/runs/804344322
Resulting image, e.g. for argoexec: https://hub.docker.com/repository/docker/lippertmarkus/argoexec/tags

You only need to add the following two secrets like described in the GitHub Actions Help before merging:

• DOCKERIO_USERNAME = argoproj
• DOCKERIO_PASSWORD = <a-docker-hub-pat-token>

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this is a chore.
• The title of the PR is (a) conventional, (b) states what changed, and (c) suffixes the related issues number. E.g. "fix(controller): Updates such and such. Fixes #1234".
• I've signed the CLA.
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
  • not needed
• My builds are green. Try syncing with master if they are not.

[alexec]

Let me get this right, would this save us building this locally? Just tag and push tag?

[lippertmarkus]

Yes, correct.

[lippertmarkus]

What do you think? Would also help to make the builds more reproducable.

[alexec]

We still need to build binaries. Any thoughts on how that might be possible? Maybe another PR?

[lippertmarkus]

This would be possible with the following steps:

• Automatically create a release: https://github.com/marketplace/actions/create-a-release
• Upload assets to the newly created release: https://github.com/marketplace/actions/upload-a-release-asset (binaries can be build with another job)

Afterwards you could add your release description manually or you also automate that.

Could look into that in another PR, but this PR would already help a lot with getting "official" Windows Images for argoexec :)

[lippertmarkus]

any updates on this PR?

[alexec]

I'm cautious on this one for security reasons.

We currently use the hub.docker.io to build images. This would replace that, but I don't really want to enter my username and password. How can we avoid this please?

[lippertmarkus]

For pushing new images we would always need to store credentials. Those are stored securely by GitHub (symmetric encryption, see here). This is done this way by a lot of other projects on GitHub so there shouldn't be a problem.

And you don't use your normal Docker Hub password, you would instead create a new Access Token on Docker Hub and use this for authentication. This token can be revoked at anytime if needed.

[alexec]

I have now set-up the secrets for this.

[lippertmarkus]

Thanks! I added the master branch and tested again. You can view an example run here and resulting latest docker images e.g. for argoexec here.

[alexec]

Lets see if this works.

[alexec]

https://github.com/argoproj/argo/actions/runs/163542666

But where are the images?

[lippertmarkus]

hmm, push seems to be successful. What did you specify as Docker username?

[alexec]

my username: alexcollinsintuit

[alexec]

ah

https://hub.docker.com/repository/registry-1.docker.io/alexcollinsintuit/argocli/tags?page=1

[alexec]

can you try them out to see if they work?

[lippertmarkus]

I tested the images, they work fine. Sorry, I overlooked that organizations on Docker Hub work a bit different, and we need to use a different repository than the Docker Hub username you log-in with. I created another PR to fix this: #3442.