Consolidate ED dockerbuild into CD nx workflow (#32923)

* Consolidate ED dockerbuild into CD nx workflow

* Touch Dockerfile to convince CI to be happy

.github/workflows/build_desktop_linux.yaml

@@ -73,7 +73,7 @@ jobs:
         # https://github.com/matrix-org/seshat/issues/135
         runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
         env:
-            HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-desktop-dockerbuild
+            HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-web/desktop-build-env
         steps:
             - name: Resolve docker image tag for push
               if: github.event_name == 'push'

.github/workflows/cd.yaml

@@ -1,7 +1,7 @@
 name: CD # Continuous Delivery
 on:
     push:
-        branches: [develop]
+        branches: [master, staging, develop]
 concurrency: ${{ github.workflow }}-${{ github.ref_name }}
 
 permissions: {}
@@ -28,11 +28,6 @@ jobs:
                   filter: tree:0
                   persist-credentials: false
 
-            - name: Prepare nx
-              uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
-              with:
-                  main-branch-name: develop
-
             - name: Install Cosign
               uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
 
@@ -59,7 +54,7 @@ jobs:
                   username: ${{ github.repository_owner }}
                   password: ${{ secrets.GITHUB_TOKEN }}
 
-            - run: pnpm nx affected -t docker:build
+            - run: pnpm nx run-many -t docker:build
               env:
                   INPUT_PUSH: true
                   INPUT_LOAD: false

.github/workflows/dockerbuild.yaml

@@ -1,74 +0,0 @@
-name: Dockerbuild
-on:
-    workflow_dispatch: {}
-    push:
-        branches: [master, staging, develop]
-        paths:
-            - "dockerbuild/**"
-    pull_request:
-concurrency: ${{ github.workflow }}-${{ github.ref_name }}
-env:
-    REGISTRY: ghcr.io
-    IMAGE_NAME: ${{ github.repository }}-dockerbuild
-permissions: {}
-jobs:
-    build:
-        name: Docker Build
-        runs-on: ubuntu-24.04
-        permissions:
-            contents: read
-            packages: write
-        steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-              with:
-                  persist-credentials: false
-
-            - name: Set up QEMU
-              uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
-
-            - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
-              with:
-                  install: true
-
-            - name: Build test image
-              uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
-              with:
-                  file: apps/desktop/dockerbuild/Dockerfile
-                  context: apps/desktop
-                  push: false
-                  load: true
-                  tags: element-desktop-dockerbuild
-                  platforms: linux/amd64
-
-            - name: Test image
-              run: docker run -v $PWD:/project element-desktop-dockerbuild pnpm install
-
-            - name: Log in to the Container registry
-              uses: docker/login-action@c144859092e8e353f3e118b0b329679a62351c3e
-              if: github.event_name != 'pull_request'
-              with:
-                  registry: ${{ env.REGISTRY }}
-                  username: ${{ github.actor }}
-                  password: ${{ secrets.GITHUB_TOKEN }}
-
-            - name: Extract metadata for Docker
-              id: meta
-              if: github.event_name != 'pull_request'
-              uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
-              with:
-                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-                  tags: |
-                      type=ref,event=branch
-                      type=ref,event=pr
-
-            - name: Build and push Docker image
-              if: github.event_name != 'pull_request'
-              uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
-              with:
-                  file: apps/desktop/dockerbuild/Dockerfile
-                  context: apps/desktop
-                  push: true
-                  tags: ${{ steps.meta.outputs.tags }}
-                  labels: ${{ steps.meta.outputs.labels }}
-                  platforms: linux/amd64,linux/arm64

apps/desktop/dockerbuild/Dockerfile

@@ -1,5 +1,6 @@
 # Docker image to facilitate building Element Desktop's native bits using a glibc version (2.31)
 # with broader compatibility, down to Debian bullseye & Ubuntu focal.
+
 FROM rust:bullseye@sha256:16950191527a4cb9e0762d9d48b705a6315158e4035e64f7a93ce8656a1b053c
 
 ENV DEBIAN_FRONTEND=noninteractive

apps/desktop/project.json

@@ -0,0 +1,24 @@
+{
+    "$schema": "../../node_modules/nx/schemas/project-schema.json",
+    "projectType": "app",
+    "root": "apps/desktop",
+    "targets": {
+        "docker:build": {
+            "executor": "@nx-tools/nx-container:build",
+            "dependsOn": ["docker:prebuild"],
+            "options": {
+                "load": true,
+                "engine": "docker",
+                "platforms": ["linux/amd64", "linux/arm64"],
+                "provenance": "true",
+                "sbom": true,
+                "context": "apps/desktop",
+                "file": "apps/desktop/dockerbuild/Dockerfile",
+                "metadata": {
+                    "images": ["ghcr.io/element-hq/element-web/desktop-build-env"],
+                    "tags": ["type=ref,event=branch", "type=raw,enable={{is_default_branch}},value=$PLAYWRIGHT_VERSION"]
+                }
+            }
+        }
+    }
+}

packages/playwright-common/project.json

@@ -23,7 +23,7 @@
                 "context": "packages/playwright-common",
                 "metadata": {
                     "images": ["ghcr.io/element-hq/element-web/playwright-server"],
-                    "tags": ["type=raw,enable=true,value=$PLAYWRIGHT_VERSION"]
+                    "tags": ["type=raw,enable={{is_default_branch}},value=$PLAYWRIGHT_VERSION"]
                 }
             }
         }