Build and publish multi-arch docker images on tag (#323)

* remove now-unused docker orb

* update Go to 1.16
    + go.mod to 1.16
    + Circle cimg/go to 1.16

* new docker image build script
    + set BuildID ldflags
    + use ko to perform the multi-arch image build *and* publish

* new docker_publish job
    + runs the new image build script
    + setup_remote_docker so a docker service is available during the job
    + caches the ko installation
    + runs on all build workflow executions
        - if running on a tag, publishes to Docker Hub
        - all other builds, publishes to local docker registry

Co-authored-by: Robb Kidd <robbkidd@honeycomb.io>

.circleci/config.yml

@@ -2,13 +2,12 @@ version: 2.1
 
 orbs:
   aws-cli: circleci/aws-cli@1.3.0
-  docker: circleci/docker@1.3.0
 
 executors:
   linuxgo:
     parameters:
     docker:
-      - image: cimg/go:1.15
+      - image: cimg/go:1.16
       - image: redis:6
 
 commands:
@@ -124,6 +123,25 @@ jobs:
             if [[ -z "$version" ]] ; then version=${CIRCLE_SHA1:0:7}; fi
             aws s3 sync ~/artifacts s3://honeycomb-builds/honeycombio/refinery/$version/
 
+  publish_docker:
+    executor: linuxgo
+    steps:
+      - restore_cache:
+          keys:
+            googleko
+      - run: go install github.com/google/ko@latest
+      - save_cache:
+          key: googleko
+          paths:
+            - $GOPATH/bin/ko
+      - checkout
+      - setup_remote_docker
+      - run:
+          name: "Publish multi-arch docker image"
+          command: |
+            echo "${DOCKER_PASSWORD}" | docker login -u "${DOCKER_USERNAME}" --password-stdin;
+            build/build_docker.sh
+
 workflows:
   build:
     jobs:
@@ -155,23 +173,11 @@ workflows:
               only: /^v.*/
             branches:
               ignore: /.*/
-      - docker/publish:
-          tag: latest
-          extra_build_args: --build-arg BUILD_ID=${CIRCLE_SHA1:0:7}
-          image: $CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME
-          requires:
-            - build
-          filters:
-            branches:
-              only: main
-      - docker/publish:
-          tag: latest,${CIRCLE_TAG:1}
-          extra_build_args: --build-arg BUILD_ID=${CIRCLE_TAG:1}
-          image: $CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME
+      - publish_docker:
+          context: Honeycomb Secrets for Public Repos
           requires:
             - build
           filters:
             tags:
-              only: /^v.*/
-            branches:
-              ignore: /.*/
+              only: /.*/
+

build/build_docker.sh

@@ -0,0 +1,24 @@
+set -o nounset
+set -o pipefail
+set -o xtrace
+
+TAGS="latest"
+VERSION=${CIRCLE_TAG:-dev}
+REPO=${KO_DOCKER_REPO:-ko.local}
+if [[ $VERSION != "dev" ]]; then
+    # set docker username and add version tag
+    REPO="honeycombio"
+    TAGS+=",$VERSION"
+fi
+
+unset GOOS
+unset GOARCH
+export KO_DOCKER_REPO=$REPO
+export GOFLAGS="-ldflags=-X=main.BuildID=$VERSION"
+export SOURCE_DATE_EPOCH=$(date +%s)
+# shellcheck disable=SC2086
+ko publish \
+  --tags "${TAGS}" \
+  --base-import-paths \
+  --platform "linux/amd64,linux/arm64" \
+  ./cmd/refinery

go.mod

@@ -1,6 +1,6 @@
 module github.com/honeycombio/refinery
 
-go 1.14
+go 1.16
 
 require (
 	github.com/davecgh/go-spew v1.1.1