mirror of
https://github.com/gigirassy/plaster.git
synced 2024-12-23 10:29:07 +00:00
Update docker-publish.yml
This commit is contained in:
nune
GitHub
parent
4d5eea68e6
commit
49d018440a
170
.github/workflows/docker-publish.yml
vendored
170
.github/workflows/docker-publish.yml
vendored
@ -1,98 +1,112 @@
|
|||||||
name: Docker
|
name: Build & push Docker image
|
||||||
|
|
||||||
# This workflow uses actions that are not certified by GitHub.
|
|
||||||
# They are provided by a third-party and are governed by
|
|
||||||
# separate terms of service, privacy policy, and support
|
|
||||||
# documentation.
|
|
||||||
|
|
||||||
on:
|
on:
|
||||||
schedule:
|
workflow_dispatch:
|
||||||
- cron: '28 10 * * *'
|
workflow_call:
|
||||||
push:
|
outputs:
|
||||||
branches: [ "main" ]
|
image:
|
||||||
# Publish semver tags as releases.
|
value: ${{ jobs.publish-manifest-list.outputs.image }}
|
||||||
tags: [ 'v*.*.*' ]
|
|
||||||
pull_request:
|
|
||||||
branches: [ "main" ]
|
|
||||||
|
|
||||||
env:
|
env:
|
||||||
# Use docker.io for Docker Hub if empty
|
DOCKER_REGISTRY: ghcr.io
|
||||||
REGISTRY: ghcr.io
|
|
||||||
# github.repository as <account>/<repo>
|
|
||||||
IMAGE_NAME: ${{ github.repository }}
|
|
||||||
|
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
|
name: Build Docker image
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
permissions:
|
permissions:
|
||||||
contents: read
|
contents: read
|
||||||
packages: write
|
packages: write
|
||||||
# This is used to complete the identity challenge
|
strategy:
|
||||||
# with sigstore/fulcio when running outside of PRs.
|
matrix:
|
||||||
id-token: write
|
platform:
|
||||||
|
- linux/amd64
|
||||||
|
- linux/arm64
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout repository
|
- name: Checkout repository
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
|
- name: Set up QEMU
|
||||||
# Install the cosign tool except on PR
|
uses: docker/setup-qemu-action@v3
|
||||||
# https://github.com/sigstore/cosign-installer
|
|
||||||
- name: Install cosign
|
|
||||||
if: github.event_name != 'pull_request'
|
|
||||||
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
|
|
||||||
with:
|
with:
|
||||||
cosign-release: 'v2.2.4'
|
platforms: ${{ matrix.platform }}
|
||||||
|
|
||||||
# Set up BuildKit Docker container builder to be able to build
|
|
||||||
# multi-platform images and export cache
|
|
||||||
# https://github.com/docker/setup-buildx-action
|
|
||||||
- name: Set up Docker Buildx
|
- name: Set up Docker Buildx
|
||||||
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
|
uses: docker/setup-buildx-action@v3
|
||||||
|
- name: Login to GitHub Container Registry
|
||||||
# Login against a Docker registry except on PR
|
uses: docker/login-action@v3
|
||||||
# https://github.com/docker/login-action
|
|
||||||
- name: Log into registry ${{ env.REGISTRY }}
|
|
||||||
if: github.event_name != 'pull_request'
|
|
||||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
|
||||||
with:
|
with:
|
||||||
registry: ${{ env.REGISTRY }}
|
registry: ${{ env.DOCKER_REGISTRY }}
|
||||||
username: ${{ github.actor }}
|
username: ${{ github.actor }}
|
||||||
password: ${{ secrets.GITHUB_TOKEN }}
|
password: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
- name: Prepare Docker image name
|
||||||
# Extract metadata (tags, labels) for Docker
|
id: docker-image-name
|
||||||
# https://github.com/docker/metadata-action
|
env:
|
||||||
- name: Extract Docker metadata
|
REPOSITORY: ${{ github.repository }}
|
||||||
id: meta
|
run: echo "value=${DOCKER_REGISTRY}/${REPOSITORY,,}" >> $GITHUB_OUTPUT
|
||||||
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
|
|
||||||
with:
|
|
||||||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
|
||||||
|
|
||||||
# Build and push Docker image with Buildx (don't push on PR)
|
|
||||||
# https://github.com/docker/build-push-action
|
|
||||||
- name: Build and push Docker image
|
- name: Build and push Docker image
|
||||||
id: build-and-push
|
uses: docker/build-push-action@v5
|
||||||
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
|
id: build-and-push-docker-image
|
||||||
with:
|
with:
|
||||||
context: .
|
context: .
|
||||||
push: ${{ github.event_name != 'pull_request' }}
|
platforms: ${{ matrix.platform }}
|
||||||
tags: ${{ steps.meta.outputs.tags }}
|
outputs: type=registry,name=${{ steps.docker-image-name.outputs.value }},push-by-digest=true
|
||||||
labels: ${{ steps.meta.outputs.labels }}
|
cache-from: type=gha,scope=buildkit-${{ matrix.platform }}
|
||||||
cache-from: type=gha
|
cache-to: type=gha,mode=max,scope=buildkit-${{ matrix.platform }}
|
||||||
cache-to: type=gha,mode=max
|
- name: Export digest
|
||||||
|
run: |
|
||||||
# Sign the resulting Docker image digest except on PRs.
|
mkdir -p /tmp/digests
|
||||||
# This will only write to the public Rekor transparency log when the Docker
|
digest="${{ steps.build-and-push-docker-image.outputs.digest }}"
|
||||||
# repository is public to avoid leaking data. If you would like to publish
|
touch "/tmp/digests/${digest#sha256:}"
|
||||||
# transparency data even for private images, pass --force to cosign below.
|
- name: Upload digest
|
||||||
# https://github.com/sigstore/cosign
|
uses: actions/upload-artifact@v3
|
||||||
- name: Sign the published Docker image
|
with:
|
||||||
if: ${{ github.event_name != 'pull_request' }}
|
name: digests
|
||||||
|
path: /tmp/digests/*
|
||||||
|
if-no-files-found: error
|
||||||
|
retention-days: 1
|
||||||
|
publish-manifest-list:
|
||||||
|
name: Publish Docker manifest list
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
permissions:
|
||||||
|
packages: write
|
||||||
|
needs:
|
||||||
|
- build
|
||||||
|
outputs:
|
||||||
|
image: ${{ steps.retrieve-image.outputs.value }}
|
||||||
|
steps:
|
||||||
|
- name: Set up Docker Buildx
|
||||||
|
uses: docker/setup-buildx-action@v3
|
||||||
|
- name: Login to GitHub Container Registry
|
||||||
|
uses: docker/login-action@v3
|
||||||
|
with:
|
||||||
|
registry: ${{ env.DOCKER_REGISTRY }}
|
||||||
|
username: ${{ github.actor }}
|
||||||
|
password: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
- name: Prepare Docker metadata
|
||||||
|
uses: docker/metadata-action@v5
|
||||||
|
id: docker-metadata
|
||||||
|
with:
|
||||||
|
images: ${{ env.DOCKER_REGISTRY }}/${{ github.repository }}
|
||||||
|
tags: |
|
||||||
|
type=ref,event=branch
|
||||||
|
type=ref,event=pr
|
||||||
|
type=sha
|
||||||
|
flavor: |
|
||||||
|
latest=true
|
||||||
|
- name: Download digests
|
||||||
|
uses: actions/download-artifact@v3
|
||||||
|
with:
|
||||||
|
name: digests
|
||||||
|
path: /tmp/digests
|
||||||
|
- name: Prepare Docker image name
|
||||||
|
id: docker-image-name
|
||||||
env:
|
env:
|
||||||
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
|
REPOSITORY: ${{ github.repository }}
|
||||||
TAGS: ${{ steps.meta.outputs.tags }}
|
run: echo "value=${DOCKER_REGISTRY}/${REPOSITORY,,}" >> $GITHUB_OUTPUT
|
||||||
DIGEST: ${{ steps.build-and-push.outputs.digest }}
|
- name: Create and push manifest list
|
||||||
# This step uses the identity token to provision an ephemeral certificate
|
run: |
|
||||||
# against the sigstore community Fulcio instance.
|
docker buildx imagetools create \
|
||||||
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
|
$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
|
||||||
|
$(printf '${{ steps.docker-image-name.outputs.value }}@sha256:%s ' $(ls /tmp/digests)) \
|
||||||
|
- name: Retrieve image
|
||||||
|
id: retrieve-image
|
||||||
|
run: echo "value=$(echo "$DOCKER_METADATA_OUTPUT_JSON" | jq -r '.tags[1]')" >> $GITHUB_OUTPUT
|
||||||
|
- name: Inspect image
|
||||||
|
run: |
|
||||||
|
docker buildx imagetools inspect ${{ steps.retrieve-image.outputs.value }}
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user