Modernize Docker build infrastructure: multi-arch GitHub Actions + buildkit strategy by Copilot · Pull Request #222 · b23prodtm/acake2php

Copilot · 2026-07-11T14:39:24Z

Replaces the outdated single-arch CircleCI + GitHub Actions setup with the proven multi-platform buildkit strategy from balena-photo-cropper. Adds full armhf/aarch64/x86_64 matrix builds, GHA layer caching, buildkit secret mounts, and manifest merging.

CI/CD

New .github/workflows/docker-build.yml — replaces build.yml; uses docker/bake-action@v5, full 3-arch matrix, separated "Write buildkit secrets" step, GHA cache injection, manifest merge in deploy job
Removed .circleci/config.yml and .github/workflows/build.yml
Explicit permissions: contents: read / actions: write on both jobs (least-privilege)

docker-bake.hcl

Added REGISTRY, REGISTRY_IMAGE, GITHUB_SHA variables
New common target inheriting GHA cache (type=gha) — all service targets inherit it
Per-arch groups armhf / aarch64 / x86_64, each building all 4 services with platform-suffixed tags (arm32v7, arm64v8, amd64) plus branch-safe and SHA tags

target "common" {
  cache-from = ["type=gha"]
  cache-to   = ["type=gha,mode=max"]
}

target "php-fpm-x86_64" {
  inherits   = ["php-fpm"]
  platforms  = ["linux/amd64"]
  dockerfile = "Dockerfile.x86_64"
  tags = [
    "${REGISTRY}/${REGISTRY_IMAGE}/php-fpm:amd64",
    BAKE_TAG != "" ? "…:${BAKE_TAG}-amd64" : "",
    GITHUB_SHA != "" ? "…:${GITHUB_SHA}-amd64" : ""
  ]
}

manifest-push.sh (new)

Sources common.env for BALENA_PROJECTS, parses REGISTRY/DOCKER_ORG from docker-bake.hcl
Merges per-arch images into a single multi-platform manifest; pushes latest on main/development

common.env

BALENA_PROJECTS updated from path-based entries to service names: ( php-fpm httpd mysqldb balena-storage )

Dockerfiles

PHP base image bumped 7.4.33-fpm-alpine3.16 → 8.3-fpm-alpine across all arch variants and template (PHP 8.1+ required for CakePHP 5)
Node build stage pinned to node:20-alpine (drops end-of-life alpine 3.16)

…ush, PHP 8.3

Copilot

Pull request overview

Modernizes the container build/release pipeline by moving to a multi-architecture Docker Buildx Bake approach on GitHub Actions (with GHA caching and a manifest-merge deploy step), while updating the application’s container base images to support newer CakePHP/PHP requirements.

Changes:

Added a new multi-arch GitHub Actions workflow that builds/pushes per-arch images and then merges them into multi-platform manifests.
Refactored docker-bake.hcl to introduce a shared GHA cache target, registry variables, and per-arch groups/targets with arch-suffixed tags.
Updated Dockerfiles to use newer Node/PHP base images; removed the legacy CircleCI and older GitHub Actions workflow.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
`.github/workflows/docker-build.yml`	New multi-arch Buildx Bake workflow + deploy manifest-merge job.
`docker-bake.hcl`	Adds registry/SHA vars, shared cache target, and per-arch build groups/targets.
`manifest-push.sh`	New script to merge per-arch tags into multi-platform manifests.
`common.env`	Updates `BALENA_PROJECTS` to service-name list used by manifest merge loop.
`Dockerfile.x86_64`	Updates Node/PHP base images for amd64 build.
`Dockerfile.aarch64`	Updates Node/PHP base images for arm64 build.
`Dockerfile.armhf`	Updates Node/PHP base images for arm/v7 build.
`Dockerfile.template`	Updates Node/PHP base images in the template.
`.github/workflows/build.yml`	Removed legacy workflow replaced by `docker-build.yml`.
`.circleci/config.yml`	Removed legacy CircleCI pipeline replaced by GitHub Actions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+      - name: Write buildkit secrets
+        run: |
+          mkdir -p .balena/secrets
+          echo "${{ secrets.MYSQL_ROOT_PASSWORD }}" > .balena/secrets/secret_mysql_root_password
+          echo "${{ secrets.MYSQL_USER }}" > .balena/secrets/secret_mysql_user
+          echo "${{ secrets.MYSQL_PASSWORD }}" > .balena/secrets/secret_mysql_password
+          echo "${{ secrets.MYSQL_DATABASE }}" > .balena/secrets/secret_mysql_database
+          echo "${{ secrets.MASTER_PASSWORD }}" > .balena/secrets/secret_master_password
+


@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+set -eu


 # BEGIN - Multi-stage Build
 # Stage 1: Install NodeJS dependencies
-FROM node:20-alpine3.16 AS node-build
+FROM node:20-alpine AS node-build


 # BEGIN - Multi-stage Build
 # Stage 1: Install NodeJS dependencies
-FROM node:20-alpine3.16 AS node-build
+FROM node:20-alpine AS node-build


 # BEGIN - Multi-stage Build
 # Stage 1: Install NodeJS dependencies
-FROM node:20-alpine3.16 AS node-build
+FROM node:20-alpine AS node-build


 # BEGIN - Multi-stage Build
 # Stage 1: Install NodeJS dependencies
-FROM node:20-alpine3.16 AS node-build
+FROM node:20-alpine AS node-build


+    permissions:
+      contents: read


b23prodtm

docker-bake.hcl needs renaming secret files to id=some_var, target=./balena/secrets/some_var_file

b23prodtm · 2026-11-02T23:55:17Z

@copilot use project example b23prodtm/abudgetmanager contents Dockerfile a docker/compose to fix code in the current project runtime so that it build up correctly up to the deployment, abudgetmanager a many similarities and is more recently treated with balena cloud services working cakephp setup. There are rules I've been working on as using the one click deploy button method. Just follow the file structure in the example project I mentioned above.

Initial plan

696cfdc

Copilot AI assigned Copilot and b23prodtm Jul 11, 2026

Copilot started work on behalf of b23prodtm July 11, 2026 14:39

View session

Copilot AI added 2 commits July 11, 2026 14:46

Modernize Docker build infrastructure: GHA workflow, bake, manifest-p…

e029f30

…ush, PHP 8.3

Add explicit GITHUB_TOKEN permissions to workflow jobs (CodeQL fix)

5454eb2

Copilot AI changed the title ~~[WIP] Update Docker build infrastructure for multi-platform support~~ Modernize Docker build infrastructure: multi-arch GitHub Actions + buildkit strategy Jul 11, 2026

Copilot finished work on behalf of b23prodtm July 11, 2026 14:47

Copilot AI requested a review from b23prodtm July 11, 2026 14:47

b23prodtm marked this pull request as ready for review July 19, 2026 15:55

b23prodtm requested a review from Copilot July 19, 2026 16:06

Copilot started reviewing on behalf of b23prodtm July 19, 2026 16:07

View session

Update docker-bake.hcl

346619a

Copilot AI reviewed Jul 19, 2026

View reviewed changes

b23prodtm requested changes Jul 26, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

Navigation Menu

Repository navigation

Modernize Docker build infrastructure: multi-arch GitHub Actions + buildkit strategy - #222

Modernize Docker build infrastructure: multi-arch GitHub Actions + buildkit strategy#222
b23prodtm with Copilot wants to merge 4 commits into
fix/composefrom
copilot/update-docker-build-infrastructure

Copilot AI commented Jul 11, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

b23prodtm left a comment

Uh oh!

This comment has been minimized.

b23prodtm commented Nov 2, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI/CD

docker-bake.hcl

manifest-push.sh (new)

common.env

Dockerfiles

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

b23prodtm left a comment

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

b23prodtm commented Nov 2, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jul 11, 2026 •

edited

Loading