Fix inconsistent image digest

Author: st8ed

.github/workflows/build-publish.yml

@@ -70,14 +70,9 @@ jobs:
           VERSION=$(echo $VERSION | sed -e 's/^v//')
           # [ "$VERSION" == "master" ] && VERSION=latest
 
-          IMAGE_REPOSITORY=st8ed/aws-cost-exporter
-
           echo "VERSION=$VERSION" >>$GITHUB_ENV
           echo "VERSION=$VERSION"
 
-          echo "IMAGE_REPOSITORY=$IMAGE_REPOSITORY" >>$GITHUB_ENV
-          echo "IMAGE_REPOSITORY=$IMAGE_REPOSITORY"
-
       - name: Package release
         run: |
           tar cf ./dist/aws-cost-exporter-$VERSION.linux-amd64.tar.gz \
@@ -87,11 +82,6 @@ jobs:
           echo "chart=$chart"
           mv -v ./dist/chart/*.tgz ./dist/$chart
 
-      - name: Load image
-        run: |
-          docker load -i ./dist/image/*.tar.gz
-          docker tag $IMAGE_REPOSITORY:$VERSION $IMAGE_REPOSITORY:latest
-
       - name: Log in to Docker Hub
         uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
         with:
@@ -100,11 +90,15 @@ jobs:
 
       - name: Push image
         run: |
-          docker push $IMAGE_REPOSITORY:$VERSION
-          docker push $IMAGE_REPOSITORY:latest
+          # --preserve-digests \
+          skopeo copy \
+            --digestfile /dev/stdout \
+            dir:./dist/image \
+            docker://index.docker.io/st8ed/aws-cost-exporter:$VERSION
 
       - name: Create release
         uses: softprops/action-gh-release@1e07f4398721186383de40550babbdf2b84acfc5
+        if: ${{ !endsWith(github.ref, '-rc') }}
         with:
           name: Release ${{ env.VERSION }}
           files: |

flake.nix

@@ -56,49 +56,65 @@
         };
       };
 
-      dockerPackage = { aws-cost-exporter, dockerTools, cacert, runCommandNoCC }: dockerTools.buildLayeredImage {
-        name = "st8ed/aws-cost-exporter";
-        tag = "${version}";
-
-        contents = [
-          aws-cost-exporter
-        ];
-
-        fakeRootCommands = ''
-          install -dm750 -o 1000 -g 1000  \
-            ./etc/aws-cost-exporter       \
-            ./var/lib/aws-cost-exporter
-
-          cp -r \
-            ${aws-cost-exporter}/share/aws-cost-exporter/* \
-            ./etc/aws-cost-exporter
-        '';
-
-        config = {
-          Entrypoint = [ "/bin/aws-cost-exporter" ];
-          Cmd = [ ];
-          User = "1000:1000";
-          WorkingDir = "/var/lib/aws-cost-exporter";
-
-          Env = [
-            "SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt"
+      dockerPackage = { pkgs, aws-cost-exporter, dockerTools, cacert, skopeo, moreutils, runCommandNoCC }:
+        let
+          # We compress image layers so the digest
+          # will be reproducible when pushing to registry
+          buildCompressedImage = stream: runCommandNoCC "aws-cost-exporter-dockerImage"
+            {
+              buildInputs = [ skopeo moreutils ];
+            } ''
+            # Piping archive stream to skopeo isn't working correctly
+            ${stream} > archive.tar
+
+            skopeo --insecure-policy copy docker-archive:./archive.tar dir:$out \
+              --format v2s2 \
+              --dest-compress
+          '';
+
+        in
+        buildCompressedImage (dockerTools.streamLayeredImage {
+          name = "st8ed/aws-cost-exporter";
+          tag = "${version}";
+
+          contents = [
+            aws-cost-exporter
           ];
 
-          ExposedPorts = {
-            "9100/tcp" = { };
-          };
-
-          Volumes = {
-            "/var/lib/aws-cost-exporter" = { };
+          fakeRootCommands = ''
+            install -dm750 -o 1000 -g 1000  \
+              ./etc/aws-cost-exporter       \
+              ./var/lib/aws-cost-exporter
+
+            cp -r \
+              ${aws-cost-exporter}/share/aws-cost-exporter/* \
+              ./etc/aws-cost-exporter
+          '';
+
+          config = {
+            Entrypoint = [ "/bin/aws-cost-exporter" ];
+            Cmd = [ ];
+            User = "1000:1000";
+            WorkingDir = "/var/lib/aws-cost-exporter";
+
+            Env = [
+              "SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt"
+            ];
+
+            ExposedPorts = {
+              "9100/tcp" = { };
+            };
+
+            Volumes = {
+              "/var/lib/aws-cost-exporter" = { };
+            };
           };
-        };
-      };
-
+        });
 
-      helmChart = { pkgs, aws-cost-exporter-dockerImage, kubernetes-helm, skopeo, jq, gnused }: pkgs.runCommand "aws-cost-exporter-chart-${chartVersion}.tgz"
+      helmChart = { pkgs, aws-cost-exporter-dockerImage, kubernetes-helm, jq, gnused }: pkgs.runCommand "aws-cost-exporter-chart-${chartVersion}.tgz"
         {
           src = src-chart;
-          buildInputs = [ kubernetes-helm skopeo jq gnused ];
+          buildInputs = [ kubernetes-helm jq gnused ];
         } ''
         cp -r $src ./chart
         chmod -R a+w ./chart
@@ -108,7 +124,8 @@
           -e 's/^appVersion: "0\.0\.0"$/appVersion: "${version}"/' \
           ./chart/Chart.yaml
 
-        digest=$(skopeo --tmpdir=. inspect docker-archive:${aws-cost-exporter-dockerImage} | jq -r '.Digest')
+        digest="sha256:$(sha256sum "${aws-cost-exporter-dockerImage}/manifest.json" | cut -d' ' -f1)"
+        echo "Digest: $digest"
 
         sed -i \
           -e 's|^image:.*$|image: "${dockerPackageTag}@'$digest'"|' \