feat: native trusted roots, replace ring with aws-lc-rs, remove webpki-roots #50

.github/workflows/ci-build-image-docker-build.yml

@@ -2,11 +2,9 @@ name: Build and Push CI Docker Build Image
 
 on:
   workflow_dispatch:
-  workflow_call:
-    outputs:
-      image-tag:
-        description: 'The Docker image tag to use'
-        value: ${{ jobs.build-and-push.outputs.image-tag }}
+  push:
+    paths:
+      - 'ci/Dockerfile'
 
 env:
   REGISTRY: ghcr.io
@@ -35,9 +33,12 @@ jobs:
       - name: Determine image tag
         id: determine-tag
         run: |
-          IMAGE_TAG="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.dockerfile-sha.outputs.sha }}"
+          BRANCH_NAME="${{ github.ref_name }}"
+          SAFE_BRANCH=$(echo "$BRANCH_NAME" | sed 's/\//-/g')
+          IMAGE_NAME_WITH_BRANCH="${{ env.IMAGE_NAME }}-${SAFE_BRANCH}"
+          IMAGE_TAG="${{ env.REGISTRY }}/${IMAGE_NAME_WITH_BRANCH}:${{ steps.dockerfile-sha.outputs.sha }}"
           echo "image-tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
-          echo "Image tag: ${IMAGE_TAG}"
+          echo "image-name-with-branch=${IMAGE_NAME_WITH_BRANCH}" >> $GITHUB_OUTPUT
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
@@ -60,10 +61,9 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          images: ${{ env.REGISTRY }}/${{ steps.determine-tag.outputs.image-name-with-branch }}
           tags: |
             type=raw,value=${{ steps.dockerfile-sha.outputs.sha }}
-            type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push Docker image
         if: steps.check-image.outputs.exists == 'false'

.github/workflows/rust-tests.yml

@@ -3,26 +3,65 @@ name: Rust Format, Clippy and Tests
 on:
   pull_request:
     branches: [ main ]
+    paths-ignore:
+      - 'ci/Dockerfile'
   push:
+    paths-ignore:
+      - 'ci/Dockerfile'
   workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
 
 jobs:
-  build-image:
-    uses: ./.github/workflows/ci-build-image-docker-build.yml
+  verify-image:
+    runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
-    secrets: inherit
+      packages: read
+    outputs:
+      image-tag: ${{ steps.determine-tag.outputs.image-tag }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Calculate Dockerfile SHA256
+        id: dockerfile-sha
+        run: |
+          DOCKERFILE_SHA=$(git hash-object ci/Dockerfile)
+          echo "sha=${DOCKERFILE_SHA}" >> $GITHUB_OUTPUT
+          echo "Dockerfile SHA: ${DOCKERFILE_SHA}"
+
+      - name: Determine image tag
+        id: determine-tag
+        run: |
+          # Sanitize branch name for use in Docker image name (replace / with -)
+          BRANCH_NAME="${{ github.ref_name }}"
+          SAFE_BRANCH=$(echo "$BRANCH_NAME" | sed 's/\//-/g')
+          IMAGE_TAG="ghcr.io/${{ github.repository }}/ci-rust-${SAFE_BRANCH}:${{ steps.dockerfile-sha.outputs.sha }}"
+          echo "image-tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check if image exists
+        run: |
+          if ! docker manifest inspect ${{ steps.determine-tag.outputs.image-tag }} > /dev/null 2>&1; then
+            echo "Error: Required CI Docker image not found: ${{ steps.determine-tag.outputs.image-tag }}"
+            exit 1
+          fi
 
   check:
-    needs: build-image
+    needs: verify-image
     runs-on: ubuntu-latest
     container:
-      image: ${{ needs.build-image.outputs.image-tag }}
+      image: ${{ needs.verify-image.outputs.image-tag }}
       options: -v /var/run/docker.sock:/var/run/docker.sock
       volumes:
         - /var/run/docker.sock:/var/run/docker.sock