This is an automated email from the ASF dual-hosted git repository. sciabarracom pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/openserverless.git
commit d079243ca014805048e0a59cfcdc20dad61c0362 Author: Michele Sciabarra <[email protected]> AuthorDate: Sat Sep 5 17:08:43 2026 +0200 first testable rework --- BUILD.md | 93 ++++++++++++++++++++++++++++++++++--------- admin-api | 2 +- build | 2 +- cli | 2 +- devcontainer | 2 +- openserverless.code-workspace | 43 ++++++++++++++++++++ oplugins-op | 2 +- runtimes | 2 +- streamer | 2 +- 9 files changed, 125 insertions(+), 25 deletions(-) diff --git a/BUILD.md b/BUILD.md index 2c227ab..4af1473 100644 --- a/BUILD.md +++ b/BUILD.md @@ -148,26 +148,81 @@ with the secrets `DOCKERHUB_USER` and `DOCKERHUB_TOKEN`. The documentation must present this as an override for people who want their images somewhere other than their own GHCR namespace — **not** as a required setup step. -### 2.5 The one exception: runtimes +### 2.5 Local builds — defaults and `MY_*_IMAGE` overrides -Case B is the single place where the automatic path is not sufficient, and the -documentation must call this out explicitly rather than leaving it to be -discovered from a failed build. +Everything above describes CI. When building **locally**, no registry is +involved by default: each component builds its image under the same default name +it would use in CI (section 2.3), and the result exists only in the local Docker +daemon. -The runtimes build publishes images that do **not** belong to the current -repository. The built-in `GITHUB_TOKEN` is scoped to packages owned by the -repository running the workflow, so it does not carry enough permission for -those pushes. +That default can be overridden per component by exporting a `MY_<COMPONENT>_IMAGE` +environment variable, normally set in a local `.env` file. The variable holds the +**full image name without the tag** — registry, namespace and repository — and +the tag continues to be computed as described in section 2.2. -Therefore, for runtimes only: +The variables, one per single-image component: -- `DOCKERHUB_TOKEN` **must** be provided explicitly, and -- it must be a token with **write permission on the target images**, not merely +| Component | Variable | Example value | +|---|---|---| +| operator | `MY_OPERATOR_IMAGE` | `ghcr.io/<your-user>/openserverless-operator` | +| devcontainer | `MY_DEVCONTAINER_IMAGE` | `ghcr.io/<your-user>/openserverless-devcontainer` | +| admin-api | `MY_ADMINAPI_IMAGE` | `ghcr.io/<your-user>/openserverless-admin-api` | +| streamer | `MY_STREAMER_IMAGE` | `ghcr.io/<your-user>/openserverless-streamer` | + +Each component repository must ship a `.env.dist` listing these variables with +their intended default form, so that copying it to `.env` and filling in the +GitHub user is the whole of the setup. `.env` itself is local and must stay +untracked. + +The documentation must present this as the **local** counterpart of section 2.3: +the automatic rule still decides the default, and `MY_*_IMAGE` only replaces it +when someone wants their local build named for their own registry. + +### 2.6 The exception: repositories publishing multiple images + +Two repositories publish images that do **not** correspond to the repository +itself: + +| repository | images published | +|---|---| +| `openserverless-build` | `openwhisk2/controller`, `openwhisk2/invoker`, `openwhisk2/scheduler`, `openwhisk2/standalone`, `openwhisk2/scala` | +| `openserverless-runtimes` | `openserverless-runtime-<rt>` — one per language version | + +This is the single place where the automatic path of section 2.3 is not +sufficient, and the documentation must call it out explicitly rather than +leaving it to be discovered from a failed build. + +The built-in `GITHUB_TOKEN` is scoped to packages **owned by the repository +running the workflow**. GHCR links a package to its creating repository on first +push and grants write access only to that repository. Because these two builds +publish under image names that do not match the repository, `GITHUB_TOKEN` +carries no permission for them and the push is refused. + +Therefore, for `openserverless-build` and `openserverless-runtimes` only, when +pushing to **ghcr.io**: + +- a **`GHCR_TOKEN`** secret **must** be set on the fork, and +- it must be a GitHub Personal Access Token (classic) with the + **`write:packages`** scope — write permission on the target images, not merely on the packages of the current repository. +To create it: + +1. Go to <https://github.com/settings/tokens> → *Generate new token (classic)*. +2. Select the **`write:packages`** scope (this implies `read:packages` and + `repo`). +3. Copy the generated token. +4. In your fork: *Settings → Secrets and variables → Actions → New repository + secret*, name it exactly **`GHCR_TOKEN`**, and paste the value. + +When pushing to Docker Hub instead, the equivalent requirement is a +`DOCKERHUB_TOKEN` with write permission on the target images. + The documentation must state the symptom this produces when skipped — a -permission/denied error at push time, after a long and otherwise successful -build — so the cause is recognisable from the error alone. +`denied: permission_denied: write_package` error at push time, after a long and +otherwise successful build — so the cause is recognisable from the error alone. +The workflows fail fast with these instructions when the secret is missing, +rather than building first and failing at the push. --- @@ -219,12 +274,14 @@ documentation must call out as the *entire* reason this case is separate: 3. **A token must be supplied.** This is the one case where the automatic credentials of section 2.3 are not enough: the images published are not the current repository's own packages, so the built-in `GITHUB_TOKEN` lacks the - permission. A `DOCKERHUB_TOKEN` with write access to the target images must - be set in the fork (Settings → Secrets and variables → Actions), optionally + permission. Per section 2.6 a **`GHCR_TOKEN`** secret with the + `write:packages` scope must be set in the fork (Settings → Secrets and + variables → Actions) when pushing to ghcr.io, or a `DOCKERHUB_TOKEN` with + write access to the target images when pushing to Docker Hub — optionally alongside `DOCKERHUB_REGISTRY` and `DOCKERHUB_USER` to change the destination. The documentation must present this as *the* prerequisite for - Case B, and as the only place in the whole build system where a secret is - mandatory. + Case B, and note that `openserverless-build` carries the same requirement for + the same reason. The documentation must also explain the relationship between the **common base image** and the language runtimes: the base is built and tagged separately, and @@ -347,7 +404,7 @@ the documentation cannot be written without them: require `REGISTRY` and `NAMESPACE` in a local `.env` and fail without them; they must be changed to fall back to the automatic behaviour and treat `DOCKERHUB_REGISTRY` / `DOCKERHUB_USER` / `DOCKERHUB_TOKEN` as an override. - The runtimes exception (2.5) stays. + The runtimes exception (2.6) stays. Until these are settled, the documentation must not describe the current behaviour as stable. diff --git a/admin-api b/admin-api index 767401e..32ec1b6 160000 --- a/admin-api +++ b/admin-api @@ -1 +1 @@ -Subproject commit 767401e7d82868fac92954fe274f578bc5925f29 +Subproject commit 32ec1b6ebf1def2c6310a86d064ff0ee5eb43ce6 diff --git a/build b/build index b2c9638..94a4dfc 160000 --- a/build +++ b/build @@ -1 +1 @@ -Subproject commit b2c96380e1126dd0d372077b97c23b9e93ac9fea +Subproject commit 94a4dfcd17d6f205f53130791fc2bea5dfa977bf diff --git a/cli b/cli index 684de4a..33cfc86 160000 --- a/cli +++ b/cli @@ -1 +1 @@ -Subproject commit 684de4ad6dc933881c14956ee3b97ab53dd1a384 +Subproject commit 33cfc8612f30a5d552c833d6043af96b8d088a2d diff --git a/devcontainer b/devcontainer index 3f53c86..b2e0f11 160000 --- a/devcontainer +++ b/devcontainer @@ -1 +1 @@ -Subproject commit 3f53c8613775cf23eb5575e5a73611fe2ffdd36b +Subproject commit b2e0f1163ade3f4a82345b206dcc1d29e617e6af diff --git a/openserverless.code-workspace b/openserverless.code-workspace new file mode 100644 index 0000000..3f769d6 --- /dev/null +++ b/openserverless.code-workspace @@ -0,0 +1,43 @@ +{ + "folders": [ + { + "path": "." + }, + { + "path": "cli" + }, + { + "path": "oplugins-op" + }, + { + "path": "streamer" + }, + { + "path": "admin-api" + }, + { + "path": "devcontainer" + }, + { + "path": "runtimes" + }, + { + "path": "build" + } + ], + "settings": { + "workbench.colorCustomizations": { + "activityBar.background": "#410A56", + "titleBar.activeBackground": "#5A0E78", + "titleBar.activeForeground": "#FEFBFF", + "titleBar.inactiveBackground": "#410A56", + "titleBar.inactiveForeground": "#FEFBFF", + "statusBar.background": "#410A56", + "statusBar.foreground": "#FEFBFF", + "statusBar.debuggingBackground": "#410A56", + "statusBar.debuggingForeground": "#FEFBFF", + "statusBar.noFolderBackground": "#410A56", + "statusBar.noFolderForeground": "#FEFBFF" + } + } +} \ No newline at end of file diff --git a/oplugins-op b/oplugins-op index 3c41379..3d94f05 160000 --- a/oplugins-op +++ b/oplugins-op @@ -1 +1 @@ -Subproject commit 3c41379082143dfef1f6fbbac5ff31cbacf857f8 +Subproject commit 3d94f05f8adee48db26f091870814fb65c0332d8 diff --git a/runtimes b/runtimes index 4095752..5e1caa6 160000 --- a/runtimes +++ b/runtimes @@ -1 +1 @@ -Subproject commit 40957528ee8cfc7855b6e4ca1ef43b4243c32073 +Subproject commit 5e1caa69027fc200935e0bad1cc4f0895960e5df diff --git a/streamer b/streamer index 5308f20..4846239 160000 --- a/streamer +++ b/streamer @@ -1 +1 @@ -Subproject commit 5308f2021ddc2ec7cef3e9e2c8070b17b775b237 +Subproject commit 4846239d6ab8f690f73138ab3a32a54652d476c9
