Automatically create binaries when creating releases

.github/workflows/build-and-cache-deps.yml

@@ -0,0 +1,40 @@
+# The actions/cache github action allows builds of tags to use artifacts cached
+# by builds of the default branch, but doesn't allow builds of tags to use
+# artifacts cached by other tags. Thus to make the dependencies of the project
+# available to the "release" workflow, they are built and cached by this
+# workflow.
+
+name: Build and Cache Dependencies
+
+on:
+  push:
+    branches:
+    - 'main'
+
+jobs:
+  release-unix:
+    name: Build and cache deps for ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+          - os: macos-15-intel
+          - os: macos-15
+          - os: ubuntu-latest
+    steps:
+
+      - uses: actions/checkout@v6
+
+      - uses: ocaml-dune/setup-dune@v2
+
+      - name: Cache build artifacts
+        id: artifact-cache
+        uses: actions/cache@v5
+        with:
+          path: |
+            _build
+            ~/.cache/dune
+          key: ${{ matrix.os }}-artifacts-${{ hashFiles('dune.lock') }}
+
+      - name: Build the project
+        run: dune build @install --release --only-packages container-image

.github/workflows/release.yml

@@ -0,0 +1,94 @@
+name: Build and upload binary releases
+
+on:
+  release:
+    types: [released]
+
+jobs:
+  release-unix:
+    name: Release for ${{ matrix.name }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+          - os: macos-15-intel
+            name: x86_64-macos
+          - os: macos-15
+            name: aarch64-macos
+          - os: ubuntu-latest
+            name: x86_64-linux
+    steps:
+
+      - uses: actions/checkout@v6
+
+      - uses: ocaml-dune/setup-dune@v2
+
+      - name: Load dependencies from the cache
+        id: artifact-cache
+        uses: actions/cache/restore@v5
+        with:
+          path: |
+            _build
+            ~/.cache/dune
+          key: ${{ matrix.os }}-artifacts-${{ hashFiles('dune.lock') }}
+
+      - name: Build the project
+        run: dune build @install --only-packages container-image --release
+
+      - name: Release a tarball of build outputs
+        run: |
+          OUT_NAME="container-image-${{ github.ref_name }}-${{ matrix.name }}"
+          mkdir -p "${OUT_NAME}"
+          cp -rlf _build/install/default/* "${OUT_NAME}"
+          tar --format=posix -cf "${OUT_NAME}.tar" "${OUT_NAME}"
+          gzip -9 "${OUT_NAME}.tar"
+
+      - name: Upload assets
+        uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          artifacts: "*.tar.gz"
+
+
+  release-x86_64-linux-musl-static:
+    name: Release for x86_64-linux-musl-static
+    runs-on: ubuntu-latest
+    steps:
+
+      - uses: actions/checkout@v6
+
+      - run: echo OUT_NAME=container-image-${{ github.ref_name }}-x86_64-linux-statically-linked >> $GITHUB_ENV
+
+      - run: mkdir -p $OUT_NAME
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+      - run: docker buildx build --output type=local,dest=$OUT_NAME -f scripts/build-static.Dockerfile .
+
+      - uses: actions/upload-artifact@v7
+        with:
+          path: ${{ env.OUT_NAME }}
+          name: release-x86_64-linux-musl-static
+
+      - name: Basic sanity checks on the built executable
+        run: |
+          # make sure the executable is static
+          file $OUT_NAME/bin/image
+          # make sure it doesn't link with anything
+          if ldd $OUT_NAME/bin/image; then
+            # if ldd exists with 0 it means it links to dynamic libraries
+            exit 1
+          fi
+          # call the executable
+          $OUT_NAME/bin/image
+
+      - name: Make a tarball of build outputs
+        run: |
+          tar --format=posix -cf "$OUT_NAME.tar" "$OUT_NAME"
+          gzip -9 "${OUT_NAME}.tar"
+
+      - name: Upload assets
+        uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          artifacts: "*.tar.gz"

README.md

@@ -16,13 +16,28 @@ fetch image layers or inspect image contents on your filesystem.
 
 ### From Source
 
+#### Using OPAM
+
 ```bash
 git clone https://github.com/your-repo/container-image.git
 cd container-image
 opam install . --deps-only
 dune build @install
 ```
 
+#### Using Dune package management
+
+```bash
+git clone https://github.com/your-repo/container-image.git
+cd container-image
+dune build @install --pkg enabled
+```
+
+For information on how to develop with Dune package management alongside Opam,
+please refer to the [How to Use Opam Alongside Dune Package
+Management](https://dune.readthedocs.io/en/stable/howto/use-opam-alongside-dune-package-management.html)
+documentation in Dune.
+
 ### Using OPAM (When available)
 
 ```bash
@@ -65,6 +80,50 @@ documentation](link-to-docs).
 
 Contributions to the `container-image` project are welcome!
 
+### Creating prebuilt binaries for releases
+
+This project comes with GitHub Actions which will automatically build binaries
+upon release. Currently supported platforms are:
+
+  * macOS on AMD64
+  * macOS on ARM64
+  * Linux on AMD64
+
+To create the binaries create a GitHub release (either manually or via helper
+tools like `dune-release`). This will trigger a GitHub Action which will check
+out the revision linked with the release, build it on the specified platform
+and upload the binaries to the GitHub release automatically. This process takes
+a few minutes, depending on how fast the GitHub runners are and can be tracked
+in the "Actions" tab of the project.
+
+### Updating the dependency versions
+
+The project contains a lock directory for Dune package management in the
+`dune.lock` folder. This means that whenever you use Dune with the package
+management feature enabled it will use the exact versions of the compiler as
+well as the projects dependencies as specified in `dune.lock`.
+
+However dependencies might need to change in some cases:
+
+  * Updating the dependencies to new versions
+  * Adding or removing dependencies
+  * Changing the version constraints of existing packages
+
+In such case `dune` will detect that the dependencies declared in the opam file
+and `dune.lock` are out of sync. To update the dependencies use `dune pkg lock`
+which will re-create a new `dune.lock` directory with the newest dependency
+solution.
+
+```bash
+$ dune pkg lock
+$ git add -A dune.lock
+$ git commit
+```
+
+The dependency solver in Dune might add or remove files in `dune.lock` thus it
+is advisable to use `git add -A` to add all the changes to the index to commit
+the change. This avoids missing or duplicate files.
+
 ## License
 
 This project is licensed under the MIT License. See

bin/dune

@@ -15,3 +15,8 @@
   fmt.cli
   logs.fmt
   fmt.tty))
+
+(env
+ (static
+  (link_flags
+   (:standard -cclib -static))))

dune.lock/alcotest.1.9.1.pkg

@@ -0,0 +1,19 @@
+(version 1.9.1)
+
+(build
+ (all_platforms
+  ((action
+    (progn
+     (when %{pkg-self:dev} (run dune subst))
+     (run dune build -p %{pkg-self:name} -j %{jobs} @install))))))
+
+(depends
+ (all_platforms
+  (dune ocaml fmt astring cmdliner re stdlib-shims uutf ocaml-syntax-shims)))
+
+(source
+ (fetch
+  (url
+   https://github.com/mirage/alcotest/releases/download/1.9.1/alcotest-1.9.1.tbz)
+  (checksum
+   sha256=1e29c3b41d4329062105b723dfda3aff86b8cef5e7c7500d0e491fc5fd78e482)))

dune.lock/angstrom.0.16.1.pkg

@@ -0,0 +1,17 @@
+(version 0.16.1)
+
+(build
+ (all_platforms
+  ((action
+    (progn
+     (when %{pkg-self:dev} (run dune subst))
+     (run dune build -p %{pkg-self:name} -j %{jobs}))))))
+
+(depends
+ (all_platforms
+  (ocaml dune bigstringaf ocaml-syntax-shims)))
+
+(source
+ (fetch
+  (url https://github.com/inhabitedtype/angstrom/archive/0.16.1.tar.gz)
+  (checksum md5=a9e096b4b2b8e4e3bb17d472bbccaad0)))

dune.lock/asn1-combinators.0.3.2.pkg

@@ -0,0 +1,19 @@
+(version 0.3.2)
+
+(build
+ (all_platforms
+  ((action
+    (progn
+     (when %{pkg-self:dev} (run dune subst))
+     (run dune build -p %{pkg-self:name} -j %{jobs}))))))
+
+(depends
+ (all_platforms
+  (ocaml dune ptime)))
+
+(source
+ (fetch
+  (url
+   https://github.com/mirleft/ocaml-asn1-combinators/releases/download/v0.3.2/asn1-combinators-0.3.2.tbz)
+  (checksum
+   sha256=2b26985f6e2722073dcd9f84355bd6757e12643b5a48e30b3c07ff7cfb0d8a7f)))

dune.lock/astring.0.8.5.pkg

@@ -0,0 +1,15 @@
+(version 0.8.5)
+
+(build
+ (all_platforms
+  ((action (run ocaml pkg/pkg.ml build --pinned %{pkg-self:pinned})))))
+
+(depends
+ (all_platforms
+  (ocaml ocamlfind ocamlbuild topkg)))
+
+(source
+ (fetch
+  (url https://erratique.ch/software/astring/releases/astring-0.8.5.tbz)
+  (checksum
+   sha256=865692630c07c3ab87c66cdfc2734c0fdfc9c34a57f8e89ffec7c7d15e7a70fa)))

dune.lock/base-domains.base.pkg

@@ -0,0 +1,4 @@
+(version base)
+
+(depends
+ (all_platforms (ocaml)))

dune.lock/base-threads.base.pkg

@@ -0,0 +1 @@
+(version base)

dune.lock/base-unix.base.pkg

@@ -0,0 +1 @@
+(version base)

dune.lock/base.v0.17.3.pkg

@@ -0,0 +1,13 @@
+(version v0.17.3)
+
+(build
+ (all_platforms ((action (run dune build -p %{pkg-self:name} -j %{jobs})))))
+
+(depends
+ (all_platforms
+  (ocaml ocaml_intrinsics_kernel sexplib0 dune dune-configurator)))
+
+(source
+ (fetch
+  (url https://github.com/janestreet/base/archive/refs/tags/v0.17.3.tar.gz)
+  (checksum md5=2100b0ed13fecf43be86ed45c5b2cc4d)))

dune.lock/base64.3.5.2.pkg

@@ -0,0 +1,19 @@
+(version 3.5.2)
+
+(build
+ (all_platforms
+  ((action
+    (progn
+     (when %{pkg-self:dev} (run dune subst))
+     (run dune build -p %{pkg-self:name} -j %{jobs}))))))
+
+(depends
+ (all_platforms
+  (ocaml dune)))
+
+(source
+ (fetch
+  (url
+   https://github.com/mirage/ocaml-base64/releases/download/v3.5.2/base64-3.5.2.tbz)
+  (checksum
+   sha256=b3f5ce301aa72c7032ef90be2332d72ff3962922c00ee2aec6bcade187a2f59b)))

dune.lock/bigstringaf.0.10.0.pkg

@@ -0,0 +1,17 @@
+(version 0.10.0)
+
+(build
+ (all_platforms
+  ((action
+    (progn
+     (when %{pkg-self:dev} (run dune subst))
+     (run dune build -p %{pkg-self:name} -j %{jobs} @install))))))
+
+(depends
+ (all_platforms
+  (dune dune-configurator ocaml)))
+
+(source
+ (fetch
+  (url https://github.com/inhabitedtype/bigstringaf/archive/0.10.0.tar.gz)
+  (checksum md5=be0a44416840852777651150757a0a3b)))

dune.lock/bos.0.2.1.pkg

@@ -0,0 +1,15 @@
+(version 0.2.1)
+
+(build
+ (all_platforms
+  ((action (run ocaml pkg/pkg.ml build --dev-pkg %{pkg-self:dev})))))
+
+(depends
+ (all_platforms
+  (ocaml ocamlfind ocamlbuild topkg base-unix rresult astring fpath fmt logs)))
+
+(source
+ (fetch
+  (url https://erratique.ch/software/bos/releases/bos-0.2.1.tbz)
+  (checksum
+   sha512=8daeb8a4c2dd1f2460f6274ada19f4f1b6ebe875ff83a938c93418ce0e6bdb74b8afc5c9a7d410c1c9df2dad030e4fa276b6ed2da580639484e8b5bc92610b1d)))

dune.lock/checkseum.0.5.2.pkg

@@ -0,0 +1,15 @@
+(version 0.5.2)
+
+(build
+ (all_platforms ((action (run dune build -p %{pkg-self:name} -j %{jobs})))))
+
+(depends
+ (all_platforms
+  (ocaml dune dune-configurator optint)))
+
+(source
+ (fetch
+  (url
+   https://github.com/mirage/checkseum/releases/download/v0.5.2/checkseum-0.5.2.tbz)
+  (checksum
+   sha256=9e5e4fd4405cb4a8b4df00877543251833e08a6499ef42ccb8dba582df0dafc8)))