ci: add Astra Linux and RedOS parallel builds

Add Dockerfile.astra (astralinux/alse) and Dockerfile.redos (redos/redos) for FSTEC-certified Russian OS targets. Update release.yml with a matrix strategy that produces three image variants per release: - ghcr.io/.../nora:0.x.x (Alpine, default) - ghcr.io/.../nora:0.x.x-astra (Astra Linux SE) - ghcr.io/.../nora:0.x.x-redos (RED OS) Build stage is shared (musl static binary) across all variants.
2026-04-12 09:10:32 +00:00 · 2026-02-23 08:24:48 +00:00
parent ab5ed3f488
commit 1e01d4df56
3 changed files with 161 additions and 5 deletions
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,12 +10,26 @@ env:

 jobs:
  build:
-    name: Build & Push
+    name: Build & Push (${{ matrix.name }})
    runs-on: self-hosted
    permissions:
      contents: read
      packages: write

+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: alpine
+            dockerfile: Dockerfile
+            suffix: ""
+          - name: astra
+            dockerfile: Dockerfile.astra
+            suffix: "-astra"
+          - name: redos
+            dockerfile: Dockerfile.redos
+            suffix: "-redos"
+
    steps:
      - uses: actions/checkout@v4

@@ -34,22 +48,25 @@ jobs:
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          flavor: |
+            suffix=${{ matrix.suffix }},onlatest=true
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=raw,value=latest
+            type=raw,value=latest,enable=${{ matrix.suffix == '' }}
+            type=raw,value=${{ matrix.name }},enable=${{ matrix.suffix != '' }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
+          file: ${{ matrix.dockerfile }}
          platforms: linux/amd64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ matrix.name }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.name }}

  release:
    name: GitHub Release
@@ -68,10 +85,21 @@ jobs:
          body: |
            ## Docker

+            **Alpine (standard):**
            ```bash
            docker pull ghcr.io/${{ github.repository }}:${{ github.ref_name }}
            ```

+            **Astra Linux SE:**
+            ```bash
+            docker pull ghcr.io/${{ github.repository }}:${{ github.ref_name }}-astra
+            ```
+
+            **RED OS:**
+            ```bash
+            docker pull ghcr.io/${{ github.repository }}:${{ github.ref_name }}-redos
+            ```
+
            ## Changelog

            See [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md)
--- a/Dockerfile.astra
+++ b/Dockerfile.astra
@@ -0,0 +1,65 @@
+# syntax=docker/dockerfile:1.4
+
+# Build stage — static binary via musl (runs on any Linux)
+FROM rust:1.83-alpine AS builder
+
+RUN apk add --no-cache musl-dev curl
+
+WORKDIR /app
+
+# Copy manifests
+COPY Cargo.toml Cargo.lock ./
+COPY nora-registry/Cargo.toml nora-registry/
+COPY nora-storage/Cargo.toml nora-storage/
+COPY nora-cli/Cargo.toml nora-cli/
+
+# Create dummy sources for dependency caching
+RUN mkdir -p nora-registry/src nora-storage/src nora-cli/src && \
+    echo "fn main() {}" > nora-registry/src/main.rs && \
+    echo "fn main() {}" > nora-storage/src/main.rs && \
+    echo "fn main() {}" > nora-cli/src/main.rs
+
+# Build dependencies only (with cache)
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/app/target \
+    cargo build --release --package nora-registry && \
+    rm -rf nora-registry/src nora-storage/src nora-cli/src
+
+# Copy real sources
+COPY nora-registry/src nora-registry/src
+COPY nora-storage/src nora-storage/src
+COPY nora-cli/src nora-cli/src
+
+# Build release binary (with cache)
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/app/target \
+    touch nora-registry/src/main.rs && \
+    cargo build --release --package nora-registry && \
+    cp /app/target/release/nora /usr/local/bin/nora
+
+# Runtime stage — Astra Linux Special Edition (certified FSTEC OS)
+FROM astralinux/alse:latest
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /data
+
+COPY --from=builder /usr/local/bin/nora /usr/local/bin/nora
+
+ENV RUST_LOG=info
+ENV NORA_HOST=0.0.0.0
+ENV NORA_PORT=4000
+ENV NORA_STORAGE_MODE=local
+ENV NORA_STORAGE_PATH=/data/storage
+ENV NORA_AUTH_TOKEN_STORAGE=/data/tokens
+
+EXPOSE 4000
+
+VOLUME ["/data"]
+
+ENTRYPOINT ["/usr/local/bin/nora"]
+CMD ["serve"]
--- a/Dockerfile.redos
+++ b/Dockerfile.redos
@@ -0,0 +1,63 @@
+# syntax=docker/dockerfile:1.4
+
+# Build stage — static binary via musl (runs on any Linux)
+FROM rust:1.83-alpine AS builder
+
+RUN apk add --no-cache musl-dev curl
+
+WORKDIR /app
+
+# Copy manifests
+COPY Cargo.toml Cargo.lock ./
+COPY nora-registry/Cargo.toml nora-registry/
+COPY nora-storage/Cargo.toml nora-storage/
+COPY nora-cli/Cargo.toml nora-cli/
+
+# Create dummy sources for dependency caching
+RUN mkdir -p nora-registry/src nora-storage/src nora-cli/src && \
+    echo "fn main() {}" > nora-registry/src/main.rs && \
+    echo "fn main() {}" > nora-storage/src/main.rs && \
+    echo "fn main() {}" > nora-cli/src/main.rs
+
+# Build dependencies only (with cache)
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/app/target \
+    cargo build --release --package nora-registry && \
+    rm -rf nora-registry/src nora-storage/src nora-cli/src
+
+# Copy real sources
+COPY nora-registry/src nora-registry/src
+COPY nora-storage/src nora-storage/src
+COPY nora-cli/src nora-cli/src
+
+# Build release binary (with cache)
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/app/target \
+    touch nora-registry/src/main.rs && \
+    cargo build --release --package nora-registry && \
+    cp /app/target/release/nora /usr/local/bin/nora
+
+# Runtime stage — RED OS (certified FSTEC OS)
+FROM redos/redos:8
+
+RUN dnf install -y ca-certificates && \
+    dnf clean all && \
+    mkdir -p /data
+
+COPY --from=builder /usr/local/bin/nora /usr/local/bin/nora
+
+ENV RUST_LOG=info
+ENV NORA_HOST=0.0.0.0
+ENV NORA_PORT=4000
+ENV NORA_STORAGE_MODE=local
+ENV NORA_STORAGE_PATH=/data/storage
+ENV NORA_AUTH_TOKEN_STORAGE=/data/tokens
+
+EXPOSE 4000
+
+VOLUME ["/data"]
+
+ENTRYPOINT ["/usr/local/bin/nora"]
+CMD ["serve"]