feat: worker-side per-tenant rate limiting (#551) #62
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release images | |
| # Build and publish the Talon container images to GHCR. | |
| # | |
| # Merges to main publish ghcr.io/<owner>/talon-<binary> with `latest` and | |
| # `sha-<short>` tags, so the images the compose files, Helm chart, and docs | |
| # reference always track the default branch. `latest` always converges on the | |
| # newest merged commit; rapid merges may coalesce queued runs (the per-ref | |
| # concurrency group keeps one pending slot), so an intermediate commit is not | |
| # guaranteed its own sha-* image. A version tag (vX.Y.Z) additionally | |
| # publishes semver and major.minor tags; `latest` tracks main only, so a tag | |
| # publish racing a main publish can never leave `latest` mixed across the | |
| # images. Pull requests do NOT run this workflow — the docker-build job | |
| # in ci.yml already smoke-builds every image (no push). | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v*" | |
| # Allow a manual publish from the default branch. | |
| workflow_dispatch: | |
| # Least-privilege: only the GHCR push needs package write; the built-in | |
| # GITHUB_TOKEN authenticates to the registry. | |
| permissions: | |
| contents: read | |
| packages: write | |
| concurrency: | |
| group: release-images-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| name: publish ${{ matrix.image }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - image: coordinator | |
| dockerfile: deploy/docker/coordinator.Dockerfile | |
| - image: worker | |
| dockerfile: deploy/docker/worker.Dockerfile | |
| - image: fuse | |
| dockerfile: deploy/docker/fuse.Dockerfile | |
| - image: gateway | |
| dockerfile: deploy/docker/gateway.Dockerfile | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Derive image tags | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/${{ github.repository_owner }}/talon-${{ matrix.image }} | |
| # latest=false disables the implicit `latest` that semver tags would | |
| # otherwise add (it would also fire on prereleases like v1.2.3-rc.1); | |
| # `latest` comes only from the default-branch line below. | |
| flavor: | | |
| latest=false | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=sha | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: ${{ matrix.dockerfile }} | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=${{ matrix.image }} | |
| # Only main seeds the shared layer cache: entries written from tag | |
| # refs are unreadable by other refs, so writing them would only churn | |
| # the repository's 10GB Actions cache quota. | |
| cache-to: ${{ github.ref == 'refs/heads/main' && format('type=gha,scope={0},mode=max', matrix.image) || '' }} |