Publish per-binary galactic-cni and galactic-router images#224
Merged
Conversation
Add .github/workflows/publish.yaml (modeled on compute's) plus a production containers/galactic-router/Dockerfile, and repoint the DaemonSets at ghcr.io/datum-cloud/galactic-cni and ghcr.io/datum-cloud/galactic-router instead of a shared galactic:latest image, fixing the gap where that shared image advertised galactic-router without ever building it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
scotwells
reviewed
Jul 10, 2026
Comment on lines
+33
to
+42
| publish-kustomize-bundles: | ||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| packages: write | ||
| uses: datum-cloud/actions/.github/workflows/publish-kustomize-bundle.yaml@v1.20.0 | ||
| with: | ||
| bundle-name: ghcr.io/datum-cloud/galactic-kustomize | ||
| bundle-path: config | ||
| secrets: inherit |
Contributor
There was a problem hiding this comment.
You'll want to leverage this new feature I pushed to the shared action that lets you stamp the kustomize bundle with multiple image versions. This will embed the version tag in the kustomize bundle.
…publish
containers/galactic-cni/Dockerfile's host-device install set GOBIN while
cross-compiling, which Go's toolchain rejects outright ("cannot install
cross-compiled binaries when GOBIN is set") -- only surfaced once
publish.yaml started building linux/arm64 on an amd64 runner. Let
`go install` use its default (arch-suffixed when cross-compiling) output
path and copy the binary out instead.
Also add `attestations: write` to the two image-publish jobs: the
galactic-router push was denied with permission_denied/write_package on
its first-ever push to a brand new package, while the kustomize bundle
job (no attestation manifests) succeeded creating an equally-new package
in the same run -- pointing at the attestation manifest push needing its
own permission scope.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Use the new `images` input on publish-kustomize-bundle.yaml (datum-cloud/actions PR #89, released as v1.20.0, which we already pin) to stamp galactic-cni's and galactic-router's real published tags into config/cni and config/router/base respectively, instead of shipping the bundle with the manifests' hardcoded :latest refs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
scotwells
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/publish.yaml, modeled on thecomputerepo'spublish.yaml: publishesgalactic-cniandgalactic-routeras separate images via the reusabledatum-cloud/actionsdocker-publish workflow, plusconfig/as a Kustomize OCI bundle, on every push and published release.containers/galactic-router/Dockerfile(distroless-static, mirrorsdeploy/containerlab/containers/galactic-router/Dockerfile) sogalactic-routeractually gets built and published.config/cni/daemonset.yamlandconfig/router/base/daemonset.yamlfrom the old sharedghcr.io/datum-cloud/galactic:latesttoghcr.io/datum-cloud/galactic-cni:latest/ghcr.io/datum-cloud/galactic-router:latest.docs/agents/ARCHITECTURE.mdandREADME.mdto drop the now-stale "no production image build path" constraint.This fixes the gap recorded in
ARCHITECTURE.md's Known Constraints: the previous shared image only ever builtgalactic-cniwhile the router DaemonSet rancommand: [/galactic-router]against it — the image advertised a binary it never built. Splitting into two per-binary images (matching whatdeploy/containerlab/already does for local dev) fixes this directly instead of resurrecting the broken shared-image pattern.Test plan
task lintpassestask buildpassesdocker build -f containers/galactic-router/Dockerfile .succeeds; ran the resulting binary and confirmed--help/flag outputkubectl kustomize config/renders the four container specs with the correct new image referencesci.yaml)publish.yamlwill only actually push images once merged/run onpush/release— not exercised by this PR itself🤖 Generated with Claude Code