build: tweak dockerfile; build and push both base and dev images

dockerfile changes:
* rename stages ('app', 'devstack') to ('base', 'dev')
  to match edx-platform's Dockerfile.
* add comment to top of dockerfile warnings of its experimental
  dev-only state.
* remove newrelic build stage, which doesn't belong in the
  core openedx repository.
* in dev stage:
  * touch ../credentials_env for devstack compatibility.
  * set DJANGO_SETTINGS_MODULE=credentials.settings.devstack.
  * set command to a ./manage.py runserver.

.github/workflows/push-docker-image.yml

@@ -1,4 +1,4 @@
-name: Build and Push Docker Image
+name: Build and Push Docker Images
 
 on:
   push:
@@ -15,29 +15,37 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v2
 
-      - name: Build and push Docker images
+      # Use the release name as the image tag if we're building an open release tag.
+      # Examples: if we're building 'open-release/maple.1', tag the image as 'maple.1'.
+      # Otherwise, we must be building from a push to master, so use 'latest'.
+      - name: Get tag name
+        id: get-tag-name
+        uses: actions/github-script@v5
+        with:
+          script: |
+            const tagName = startsWith(github.ref, 'refs/tags/open-release/')
+                          ? context.ref.split('refs/tags/open-release/')[1]
+                          : 'latest';
+            console.log('Will use tag: ' + tagName);
+            return tagName;
+          result-encoding: string
+
+      - name: Build and push base Docker image
         uses: docker/build-push-action@v1
         with:
           push: ${{ github.event_name != 'pull_request' }}
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          target: base
           repository: openedx/credentials
-          tags: latest,${{ github.sha }}
+          tags: ${{ steps.get-tag-name.outputs.result }},${{ github.sha }}
 
-      - name: Get open release name
-        id: get-open-release
-        if: startsWith(github.ref, 'refs/tags/open-release/')
-        uses: actions/github-script@v5
-        with:
-          script: return context.ref.split('refs/tags/open-release/')[1]
-          result-encoding: string
-
-      - name: Build and push Docker images
+      - name: Build and push dev Docker image
         uses: docker/build-push-action@v1
-        if: startsWith(github.ref, 'refs/tags/open-release/')
         with:
           push: ${{ github.event_name != 'pull_request' }}
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
-          repository: openedx/credentials
-          tags: ${{steps.get-open-release.outputs.result}}
+          target: dev
+          repository: openedx/credentials-dev
+          tags: ${{ steps.get-tag-name.outputs.result }},${{ github.sha }}

Dockerfile

@@ -1,6 +1,15 @@
-FROM ubuntu:focal as app
+FROM ubuntu:focal as base
 MAINTAINER devops@edx.org
 
+# Warning: This file is experimental.
+#
+# Short-term goals:
+# * Be a suitable replacement for the `edxops/credentials` image in devstack (in progress).
+# * Take advantage of Docker caching layers: aim to put commands in order of
+#   increasing cache-busting frequency.
+# * Related to ^, use no Ansible or Paver.
+# Long-term goal:
+# * Be a suitable base for production Credentials images. This may not yet be the case.
 
 # Packages installed:
 # git; Used to pull in particular requirements from github rather than pypi,
@@ -85,14 +94,19 @@ CMD gunicorn --workers=2 --name credentials -c /edx/app/credentials/credentials/
 # bust the image cache
 COPY . /edx/app/credentials/credentials
 
-FROM app as newrelic
-RUN pip install newrelic
-CMD newrelic-admin run-program gunicorn --workers=2 --name credentials -c /edx/app/credentials/credentials/credentials/docker_gunicorn_configuration.py --log-file - --max-requests=1000 credentials.wsgi:application
-
-
 # We don't switch back to the app user for devstack because we need devstack users to be
 # able to update requirements and generally run things as root.
-FROM app as devstack
+FROM base as dev
 USER root
+ENV DJANGO_SETTINGS_MODULE credentials.settings.devstack
 RUN pip install -r /edx/app/credentials/credentials/requirements/dev.txt
-CMD gunicorn --reload --workers=2 --name credentials -c /edx/app/credentials/credentials/credentials/docker_gunicorn_configuration.py --log-file - --max-requests=1000 credentials.wsgi:application
+
+# Temporary compatibility hack while devstack is supporting
+# both the old `edxops/credentials` image and this image:
+# Add in a dummy ../credentials_env file.
+# The credentials_env file was originally needed for sourcing to get
+# environment variables like DJANGO_SETTINGS_MODULE, but now we just set
+# those variables right in the Dockerfile.
+RUN touch ../credentials_env
+
+CMD while true; do python ./manage.py runserver 0.0.0.0:18150; sleep 2; done