From c792cd73cbdbc8b378ec69a873088cdeed3585a1 Mon Sep 17 00:00:00 2001 From: AlinsRan Date: Wed, 5 Aug 2026 23:35:41 +0800 Subject: [PATCH 1/4] feat: build apisix-runtime against an arbitrary apisix-nginx-module ref `build-apisix-runtime.sh` already honours an `apisix_nginx_module_ver` override, but neither the Makefile nor the runtime Dockerfiles passed it through, so the only way to build against an unreleased module branch was to edit the pinned default. Thread the value through `build_runtime` and both runtime Dockerfiles (empty keeps the pinned default), and add a workflow_dispatch job that builds the deb for a given module ref and uploads it as an artifact. --- .../build-apisix-runtime-deb-dispatch.yml | 81 +++++++++++++++++++ Makefile | 5 ++ dockerfiles/Dockerfile.apisix-runtime.deb | 3 + dockerfiles/Dockerfile.apisix-runtime.rpm | 3 + 4 files changed, 92 insertions(+) create mode 100644 .github/workflows/build-apisix-runtime-deb-dispatch.yml diff --git a/.github/workflows/build-apisix-runtime-deb-dispatch.yml b/.github/workflows/build-apisix-runtime-deb-dispatch.yml new file mode 100644 index 000000000..761f334ef --- /dev/null +++ b/.github/workflows/build-apisix-runtime-deb-dispatch.yml @@ -0,0 +1,81 @@ +name: build apisix-runtime deb (dispatch) + +# Build an apisix-runtime deb from an arbitrary apisix-nginx-module ref and +# publish it as a workflow artifact. Meant for testing a module branch before +# it is tagged and released. + +on: + workflow_dispatch: + inputs: + runtime_version: + description: "apisix-runtime version to stamp into the package" + required: true + default: "1.3.8" + apisix_nginx_module_ver: + description: "apisix-nginx-module tag or branch (empty = the pinned default)" + required: false + default: "" + image_base: + description: "base image" + required: false + default: "debian" + image_tag: + description: "base image tag" + required: false + default: "bookworm-slim" + +jobs: + build: + runs-on: ubuntu-24.04 + timeout-minutes: 90 + env: + RUNTIME_VERSION: ${{ inputs.runtime_version }} + APISIX_NGINX_MODULE_VER: ${{ inputs.apisix_nginx_module_ver }} + IMAGE_BASE: ${{ inputs.image_base }} + IMAGE_TAG: ${{ inputs.image_tag }} + BUILDKIT_PROGRESS: plain + steps: + - name: Validate inputs + run: | + if [[ ! "$RUNTIME_VERSION" =~ ^[0-9A-Za-z._-]+$ ]]; then + echo "invalid runtime_version: $RUNTIME_VERSION" >&2 + exit 1 + fi + if [[ -n "$APISIX_NGINX_MODULE_VER" && ! "$APISIX_NGINX_MODULE_VER" =~ ^[A-Za-z0-9._/-]+$ ]]; then + echo "invalid apisix_nginx_module_ver: $APISIX_NGINX_MODULE_VER" >&2 + exit 1 + fi + + - name: Checkout code + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + + - name: Install dependencies + run: | + sudo apt-get update + sudo apt-get install -y make ruby ruby-dev rubygems build-essential + + - name: Build apisix-runtime deb + run: | + make package type=deb app=apisix-runtime \ + runtime_version="$RUNTIME_VERSION" \ + apisix_nginx_module_ver="$APISIX_NGINX_MODULE_VER" \ + image_base="$IMAGE_BASE" image_tag="$IMAGE_TAG" + + - name: Smoke check the deb + run: | + deb=$(basename "$(ls output/apisix-runtime_*.deb)") + echo "built $deb" + docker run --rm -v "$PWD/output:/output" "$IMAGE_BASE:$IMAGE_TAG" bash -c " + dpkg -i '/output/$deb' + /usr/local/openresty/bin/openresty -V + " + + - name: Publish artifact + uses: actions/upload-artifact@v4 + with: + name: apisix-runtime-deb-${{ inputs.runtime_version }} + path: output/apisix-runtime_*.deb + retention-days: 14 + if-no-files-found: error diff --git a/Makefile b/Makefile index dc67e5f8a..8a10206a2 100644 --- a/Makefile +++ b/Makefile @@ -27,6 +27,9 @@ openresty="apisix-runtime" artifact="0" runtime_version=0 build_latest= +### git ref (tag or branch) of apisix-nginx-module to build against; +### empty keeps the default pinned in build-apisix-runtime.sh +apisix_nginx_module_ver= apisix_repo="https://github.com/apache/apisix" apisix_runtime_repo="https://github.com/api7/apisix-build-tools.git" dashboard_repo="https://github.com/apache/apisix-dashboard" @@ -101,6 +104,7 @@ define build_runtime --build-arg IMAGE_BASE=$(image_base) \ --build-arg IMAGE_TAG=$(image_tag) \ --build-arg BUILD_LATEST=$(build_latest) \ + --build-arg APISIX_NGINX_MODULE_VER=$(apisix_nginx_module_ver) \ --build-arg CODE_PATH=$(4) \ --platform $(arch) \ -f ./dockerfiles/Dockerfile.$(2).$(3) . @@ -114,6 +118,7 @@ define build_runtime --build-arg IMAGE_BASE=$(image_base) \ --build-arg IMAGE_TAG=$(image_tag) \ --build-arg BUILD_LATEST=$(build_latest) \ + --build-arg APISIX_NGINX_MODULE_VER=$(apisix_nginx_module_ver) \ --build-arg CODE_PATH=$(4) \ --load \ --cache-from=$(cache_from) \ diff --git a/dockerfiles/Dockerfile.apisix-runtime.deb b/dockerfiles/Dockerfile.apisix-runtime.deb index cda3dfe89..fadb59c9d 100644 --- a/dockerfiles/Dockerfile.apisix-runtime.deb +++ b/dockerfiles/Dockerfile.apisix-runtime.deb @@ -10,6 +10,7 @@ ARG RUNTIME_VERSION ARG IMAGE_BASE ARG IMAGE_TAG ARG BUILD_LATEST +ARG APISIX_NGINX_MODULE_VER ARG CODE_PATH ENV IMAGE_BASE=${IMAGE_BASE} @@ -17,6 +18,8 @@ ENV IMAGE_TAG=${IMAGE_TAG} ENV version=${VERSION} ENV runtime_version=${RUNTIME_VERSION} ENV build_latest=${BUILD_LATEST:-} +# empty keeps the default pinned in build-apisix-runtime.sh +ENV apisix_nginx_module_ver=${APISIX_NGINX_MODULE_VER:-} COPY ${CODE_PATH} ./ diff --git a/dockerfiles/Dockerfile.apisix-runtime.rpm b/dockerfiles/Dockerfile.apisix-runtime.rpm index 82e3b07ca..bf1d03684 100644 --- a/dockerfiles/Dockerfile.apisix-runtime.rpm +++ b/dockerfiles/Dockerfile.apisix-runtime.rpm @@ -10,11 +10,14 @@ ARG RUNTIME_VERSION ARG IMAGE_BASE ARG IMAGE_TAG ARG CODE_PATH +ARG APISIX_NGINX_MODULE_VER ENV IMAGE_BASE=${IMAGE_BASE} ENV IMAGE_TAG=${IMAGE_TAG} ENV version=${VERSION} ENV runtime_version=${RUNTIME_VERSION} +# empty keeps the default pinned in build-apisix-runtime.sh +ENV apisix_nginx_module_ver=${APISIX_NGINX_MODULE_VER:-} COPY ${CODE_PATH} ./ From da7fce8d6508712de32b12c3eb5f2d585fe86c70 Mon Sep 17 00:00:00 2001 From: AlinsRan Date: Wed, 5 Aug 2026 23:38:59 +0800 Subject: [PATCH 2/4] feat: allow the runtime deb workflow to pick the module ref and base image Adds a workflow_dispatch trigger to the existing runtime deb job with inputs for the runtime version, the apisix-nginx-module ref and the base image, all defaulting to what the scheduled/PR runs already used. The deb filename is now discovered from the output directory instead of being spelled out, since it carries the base image codename. A separate dispatch-only workflow would not have been usable: GitHub only resolves workflow_dispatch for workflows that exist on the default branch. --- .../build-apisix-runtime-deb-dispatch.yml | 81 ------------------- ...package-apisix-runtime-deb-ubuntu20.04.yml | 71 ++++++++++++---- 2 files changed, 55 insertions(+), 97 deletions(-) delete mode 100644 .github/workflows/build-apisix-runtime-deb-dispatch.yml diff --git a/.github/workflows/build-apisix-runtime-deb-dispatch.yml b/.github/workflows/build-apisix-runtime-deb-dispatch.yml deleted file mode 100644 index 761f334ef..000000000 --- a/.github/workflows/build-apisix-runtime-deb-dispatch.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: build apisix-runtime deb (dispatch) - -# Build an apisix-runtime deb from an arbitrary apisix-nginx-module ref and -# publish it as a workflow artifact. Meant for testing a module branch before -# it is tagged and released. - -on: - workflow_dispatch: - inputs: - runtime_version: - description: "apisix-runtime version to stamp into the package" - required: true - default: "1.3.8" - apisix_nginx_module_ver: - description: "apisix-nginx-module tag or branch (empty = the pinned default)" - required: false - default: "" - image_base: - description: "base image" - required: false - default: "debian" - image_tag: - description: "base image tag" - required: false - default: "bookworm-slim" - -jobs: - build: - runs-on: ubuntu-24.04 - timeout-minutes: 90 - env: - RUNTIME_VERSION: ${{ inputs.runtime_version }} - APISIX_NGINX_MODULE_VER: ${{ inputs.apisix_nginx_module_ver }} - IMAGE_BASE: ${{ inputs.image_base }} - IMAGE_TAG: ${{ inputs.image_tag }} - BUILDKIT_PROGRESS: plain - steps: - - name: Validate inputs - run: | - if [[ ! "$RUNTIME_VERSION" =~ ^[0-9A-Za-z._-]+$ ]]; then - echo "invalid runtime_version: $RUNTIME_VERSION" >&2 - exit 1 - fi - if [[ -n "$APISIX_NGINX_MODULE_VER" && ! "$APISIX_NGINX_MODULE_VER" =~ ^[A-Za-z0-9._/-]+$ ]]; then - echo "invalid apisix_nginx_module_ver: $APISIX_NGINX_MODULE_VER" >&2 - exit 1 - fi - - - name: Checkout code - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - persist-credentials: false - - - name: Install dependencies - run: | - sudo apt-get update - sudo apt-get install -y make ruby ruby-dev rubygems build-essential - - - name: Build apisix-runtime deb - run: | - make package type=deb app=apisix-runtime \ - runtime_version="$RUNTIME_VERSION" \ - apisix_nginx_module_ver="$APISIX_NGINX_MODULE_VER" \ - image_base="$IMAGE_BASE" image_tag="$IMAGE_TAG" - - - name: Smoke check the deb - run: | - deb=$(basename "$(ls output/apisix-runtime_*.deb)") - echo "built $deb" - docker run --rm -v "$PWD/output:/output" "$IMAGE_BASE:$IMAGE_TAG" bash -c " - dpkg -i '/output/$deb' - /usr/local/openresty/bin/openresty -V - " - - - name: Publish artifact - uses: actions/upload-artifact@v4 - with: - name: apisix-runtime-deb-${{ inputs.runtime_version }} - path: output/apisix-runtime_*.deb - retention-days: 14 - if-no-files-found: error diff --git a/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml b/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml index f1153eaca..2475c9a0a 100644 --- a/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml +++ b/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml @@ -13,15 +13,48 @@ on: - '*.md' schedule: - cron: '0 0 * * *' + workflow_dispatch: + inputs: + runtime_version: + description: "apisix-runtime version to stamp into the package" + required: false + default: "1.0.1" + apisix_nginx_module_ver: + description: "apisix-nginx-module tag or branch (empty = the pinned default)" + required: false + default: "" + image_base: + description: "base image" + required: false + default: "ubuntu" + image_tag: + description: "base image tag" + required: false + default: "24.04" jobs: build: runs-on: ubuntu-latest - timeout-minutes: 60 + timeout-minutes: 90 env: - BUILD_APISIX_RUNTIME_VERSION: 1.0.1 + BUILD_APISIX_RUNTIME_VERSION: ${{ inputs.runtime_version || '1.0.1' }} + APISIX_NGINX_MODULE_VER: ${{ inputs.apisix_nginx_module_ver || '' }} + IMAGE_BASE: ${{ inputs.image_base || 'ubuntu' }} + IMAGE_TAG: ${{ inputs.image_tag || '24.04' }} + BUILDKIT_PROGRESS: plain steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 + + - name: validate inputs + run: | + if [[ ! "$BUILD_APISIX_RUNTIME_VERSION" =~ ^[0-9A-Za-z._-]+$ ]]; then + echo "invalid runtime_version: $BUILD_APISIX_RUNTIME_VERSION" >&2 + exit 1 + fi + if [[ -n "$APISIX_NGINX_MODULE_VER" && ! "$APISIX_NGINX_MODULE_VER" =~ ^[A-Za-z0-9._/-]+$ ]]; then + echo "invalid apisix_nginx_module_ver: $APISIX_NGINX_MODULE_VER" >&2 + exit 1 + fi - name: install dependencies run: | @@ -29,25 +62,31 @@ jobs: - name: build apisix-runtime deb run: | - make package type=deb app=apisix-runtime runtime_version=${BUILD_APISIX_RUNTIME_VERSION} image_base=ubuntu image_tag=24.04 - - - name: run ubuntu 24.04 docker and mapping apisix-runtime deb into container - run: | - docker run -itd -v /home/runner/work/apisix-build-tools/apisix-build-tools/output:/output --name ubuntu24.04Instance --net="host" docker.io/ubuntu:24.04 /bin/bash + make package type=deb app=apisix-runtime \ + runtime_version="$BUILD_APISIX_RUNTIME_VERSION" \ + apisix_nginx_module_ver="$APISIX_NGINX_MODULE_VER" \ + image_base="$IMAGE_BASE" image_tag="$IMAGE_TAG" - - name: install deb in container + - name: locate the built deb run: | - docker exec ubuntu24.04Instance bash -c "dpkg -i /output/apisix-runtime_${BUILD_APISIX_RUNTIME_VERSION}-0~ubuntu24.04_amd64.deb" + deb=$(ls output/apisix-runtime_*.deb) + echo "DEB_PATH=$deb" >> "$GITHUB_ENV" + echo "DEB_NAME=$(basename "$deb")" >> "$GITHUB_ENV" - - name: check and ensure apisix-runtime is installed + - name: install the deb in a clean container and check the runtime version run: | - export APISIX_RUNTIME_VER=$(docker exec ubuntu24.04Instance bash -c "openresty -V" 2>&1 | awk '/-O2 -DAPISIX_RUNTIME_VER=/{print $5}' | awk -v FS="=" '{print $2}') - if [ "$APISIX_RUNTIME_VER" != "${BUILD_APISIX_RUNTIME_VERSION}" ]; then exit 1; fi + docker run --rm -v "$PWD/output:/output" "$IMAGE_BASE:$IMAGE_TAG" bash -c ' + set -e + dpkg -i "/output/$1" + openresty -V 2>&1 | tr " " "\n" | grep -o "APISIX_RUNTIME_VER=.*" > /tmp/ver + cat /tmp/ver + test "$(cut -d= -f2 /tmp/ver)" = "$2" + ' _ "$DEB_NAME" "$BUILD_APISIX_RUNTIME_VERSION" - name: Publish Artifact uses: actions/upload-artifact@v4.0.0 with: - name: apisix-runtime_${{ env.BUILD_APISIX_RUNTIME_VERSION }}-0~ubuntu24.04_amd64.deb - path: output/apisix-runtime_${{ env.BUILD_APISIX_RUNTIME_VERSION }}-0~ubuntu24.04_amd64.deb - retention-days: 5 + name: ${{ env.DEB_NAME }} + path: ${{ env.DEB_PATH }} + retention-days: 14 if-no-files-found: error From 647cb1158e3df97e3a29a53805f0c82c7177cb3a Mon Sep 17 00:00:00 2001 From: AlinsRan Date: Wed, 5 Aug 2026 23:47:08 +0800 Subject: [PATCH 3/4] fix: derive the apisix-nginx-module checkout directory from the ref The validation already accepted a ref containing slashes, but the checkout directory was named after the ref verbatim, so a branch ref such as `feat/foo` produced a nested `apisix-nginx-module-feat/foo` and every path relative to it broke: cd apisix-nginx-module-feat/var-index-access/patch ./patch.sh: pushd: ../../openresty-1.29.2.4/bundle/nginx-1.29.2: No such file Replace the slashes when building the directory name and keep the ref itself for the clone. --- build-apisix-runtime.sh | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/build-apisix-runtime.sh b/build-apisix-runtime.sh index fa231d529..39ae11d0f 100755 --- a/build-apisix-runtime.sh +++ b/build-apisix-runtime.sh @@ -33,6 +33,9 @@ if [[ ! "$apisix_nginx_module_ver" =~ ^[A-Za-z0-9._/-]+$ ]]; then echo "ERROR: invalid apisix_nginx_module_ver: $apisix_nginx_module_ver" >&2 exit 1 fi +# a branch ref carries slashes, which would turn the checkout into a nested +# directory and break every path relative to it +apisix_nginx_module_dir="apisix-nginx-module-${apisix_nginx_module_ver//\//-}" wasm_nginx_module_ver="0.7.0" lua_var_nginx_module_ver="v0.5.3" lua_resty_events_ver="0.2.0" @@ -111,11 +114,11 @@ else fi if [ "$repo" == apisix-nginx-module ]; then - cp -r "$prev_workdir" "./apisix-nginx-module-${apisix_nginx_module_ver}" + cp -r "$prev_workdir" "./${apisix_nginx_module_dir}" else git clone --depth=1 -b "$apisix_nginx_module_ver" -- \ https://github.com/api7/apisix-nginx-module.git \ - "apisix-nginx-module-${apisix_nginx_module_ver}" + "${apisix_nginx_module_dir}" fi if [ "$repo" == wasm-nginx-module ]; then @@ -138,7 +141,7 @@ cd ngx_multi_upstream_module-${ngx_multi_upstream_module_ver} || exit 1 ./patch.sh ../openresty-${OPENRESTY_VERSION} cd .. -cd "apisix-nginx-module-${apisix_nginx_module_ver}/patch" || exit 1 +cd "${apisix_nginx_module_dir}/patch" || exit 1 ./patch.sh ../../openresty-${OPENRESTY_VERSION} cd ../.. @@ -171,9 +174,9 @@ fi $debug_args \ --add-module=../mod_dubbo-${mod_dubbo_ver} \ --add-module=../ngx_multi_upstream_module-${ngx_multi_upstream_module_ver} \ - --add-module="../apisix-nginx-module-${apisix_nginx_module_ver}" \ - --add-module="../apisix-nginx-module-${apisix_nginx_module_ver}/src/stream" \ - --add-module="../apisix-nginx-module-${apisix_nginx_module_ver}/src/meta" \ + --add-module="../${apisix_nginx_module_dir}" \ + --add-module="../${apisix_nginx_module_dir}/src/stream" \ + --add-module="../${apisix_nginx_module_dir}/src/meta" \ --add-module=../wasm-nginx-module-${wasm_nginx_module_ver} \ --add-module=../lua-var-nginx-module-${lua_var_nginx_module_ver} \ --add-module=../lua-resty-events-${lua_resty_events_ver} \ @@ -220,7 +223,7 @@ sudo install -d "$OR_PREFIX"/lualib/resty/events/compat/ sudo install -m 644 lualib/resty/events/compat/*.lua "$OR_PREFIX"/lualib/resty/events/compat/ cd .. -cd "apisix-nginx-module-${apisix_nginx_module_ver}" || exit 1 +cd "${apisix_nginx_module_dir}" || exit 1 sudo OPENRESTY_PREFIX="$OR_PREFIX" make install cd .. From f82b2120e649776b86500d9612d00f0da242fc90 Mon Sep 17 00:00:00 2001 From: AlinsRan Date: Thu, 6 Aug 2026 00:11:31 +0800 Subject: [PATCH 4/4] feat: expose the package revision as a workflow input Lets two builds that differ only by the module ref be told apart by the package name instead of by which run produced them. --- .../package-apisix-runtime-deb-ubuntu20.04.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml b/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml index 2475c9a0a..7a7dfee7d 100644 --- a/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml +++ b/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml @@ -23,6 +23,10 @@ on: description: "apisix-nginx-module tag or branch (empty = the pinned default)" required: false default: "" + iteration: + description: "package revision, e.g. 0 or 0mybranch" + required: false + default: "0" image_base: description: "base image" required: false @@ -39,6 +43,7 @@ jobs: env: BUILD_APISIX_RUNTIME_VERSION: ${{ inputs.runtime_version || '1.0.1' }} APISIX_NGINX_MODULE_VER: ${{ inputs.apisix_nginx_module_ver || '' }} + ITERATION: ${{ inputs.iteration || '0' }} IMAGE_BASE: ${{ inputs.image_base || 'ubuntu' }} IMAGE_TAG: ${{ inputs.image_tag || '24.04' }} BUILDKIT_PROGRESS: plain @@ -55,6 +60,10 @@ jobs: echo "invalid apisix_nginx_module_ver: $APISIX_NGINX_MODULE_VER" >&2 exit 1 fi + if [[ ! "$ITERATION" =~ ^[0-9A-Za-z._+-]+$ ]]; then + echo "invalid iteration: $ITERATION" >&2 + exit 1 + fi - name: install dependencies run: | @@ -65,6 +74,7 @@ jobs: make package type=deb app=apisix-runtime \ runtime_version="$BUILD_APISIX_RUNTIME_VERSION" \ apisix_nginx_module_ver="$APISIX_NGINX_MODULE_VER" \ + iteration="$ITERATION" \ image_base="$IMAGE_BASE" image_tag="$IMAGE_TAG" - name: locate the built deb