Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
144 changes: 15 additions & 129 deletions .github/workflows/docker-build.yml
Original file line number Diff line number Diff line change
@@ -1,141 +1,27 @@
name: Publish Docker image (Multi-arch)

name: Build and Push Docker Image
on:
push:
tags:
- '*'
- '!nightly*'
workflow_dispatch:
inputs:
tag:
description: 'Tag name to build (e.g., v0.10.8-alpha.3)'
required: true
type: string

branches: [ "main" ]
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
build_single_arch:
name: Build & push (${{ matrix.arch }})
strategy:
fail-fast: false
matrix:
include:
- arch: amd64
platform: linux/amd64
runner: ubuntu-latest
- arch: arm64
platform: linux/arm64
runner: ubuntu-24.04-arm
runs-on: ${{ matrix.runner }}
outputs:
tag: ${{ steps.version.outputs.tag }}

build:
runs-on: ubuntu-latest
permissions:
packages: write
contents: read
id-token: write

packages: write
steps:
- name: Check out
uses: actions/checkout@v4
with:
fetch-depth: ${{ github.event_name == 'workflow_dispatch' && 0 || 1 }}
ref: ${{ github.event.inputs.tag || github.ref }}

- name: Resolve tag & write VERSION
id: version
run: |
if [ -n "${{ github.event.inputs.tag }}" ]; then
TAG="${{ github.event.inputs.tag }}"
if ! git rev-parse "refs/tags/$TAG" >/dev/null 2>&1; then
echo "::error::Tag '$TAG' does not exist"
exit 1
fi
else
TAG=${GITHUB_REF#refs/tags/}
fi
echo "TAG=${TAG}" >> $GITHUB_ENV
echo "tag=${TAG}" >> $GITHUB_OUTPUT
echo "${TAG}" > VERSION
echo "Building tag: ${TAG} for ${{ matrix.arch }}"

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Log in to Docker Hub
- uses: actions/checkout@v4
- name: Log in to Container Registry
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}

- name: Extract metadata (labels)
id: meta
uses: docker/metadata-action@v5
with:
images: calciumion/new-api

- name: Build & push
id: build
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push
uses: docker/build-push-action@v6
with:
context: .
platforms: ${{ matrix.platform }}
push: true
tags: |
calciumion/new-api:${{ env.TAG }}-${{ matrix.arch }}
calciumion/new-api:latest-${{ matrix.arch }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
provenance: mode=max
sbom: true

- name: Install cosign
uses: sigstore/cosign-installer@v3

- name: Sign image with cosign
run: cosign sign --yes calciumion/new-api@${{ steps.build.outputs.digest }}

- name: Image summary
run: |
echo "### Docker Image Digest (${{ matrix.arch }})" >> $GITHUB_STEP_SUMMARY
echo '```' >> $GITHUB_STEP_SUMMARY
echo "calciumion/new-api:${TAG}-${{ matrix.arch }}" >> $GITHUB_STEP_SUMMARY
echo "${{ steps.build.outputs.digest }}" >> $GITHUB_STEP_SUMMARY
echo '```' >> $GITHUB_STEP_SUMMARY

create_manifests:
name: Create multi-arch manifests
needs: [build_single_arch]
runs-on: ubuntu-latest
if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'

steps:
- name: Set version
run: echo "TAG=${{ needs.build_single_arch.outputs.tag }}" >> $GITHUB_ENV

- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}

- name: Create & push manifest (version)
run: |
docker buildx imagetools create \
-t calciumion/new-api:${TAG} \
calciumion/new-api:${TAG}-amd64 \
calciumion/new-api:${TAG}-arm64

- name: Create & push manifest (latest)
run: |
docker buildx imagetools create \
-t calciumion/new-api:latest \
calciumion/new-api:latest-amd64 \
calciumion/new-api:latest-arm64

- name: Manifest summary
run: |
echo "### Multi-arch Manifest" >> $GITHUB_STEP_SUMMARY
echo '```' >> $GITHUB_STEP_SUMMARY
docker buildx imagetools inspect calciumion/new-api:${TAG} >> $GITHUB_STEP_SUMMARY
echo '```' >> $GITHUB_STEP_SUMMARY
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
23 changes: 23 additions & 0 deletions .github/workflows/docker-image.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
name: Build and Push Docker Image
on:
push:
branches: [ "main" ]
jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v4
- uses: docker/setup-buildx-action@v3
- uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/build-push-action@v6
with:
context: .
push: true
tags: ghcr.io/wangyaodujing123/new-api:latest

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Avoid hardcoded GHCR namespace in image tag

ghcr.io/wangyaodujing123/new-api:latest is repo/user-specific and can break in org repos/forks. Use ${{ github.repository }} (or shared env) like the other workflow.

Proposed fix
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
 jobs:
   build:
@@
       - uses: docker/build-push-action@v6
         with:
           context: .
           push: true
-          tags: ghcr.io/wangyaodujing123/new-api:latest
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker-image.yml at line 23, The image tag in the workflow
currently hardcodes the GHCR namespace
("ghcr.io/wangyaodujing123/new-api:latest"); update the tags value to use the
repository-aware variable (e.g., `${{ github.repository }}`) or a shared
workflow env so the tag becomes dynamic (something like `${{ github.repository
}}:latest`), ensuring the change is applied where the "tags:" key contains the
hardcoded "ghcr.io/wangyaodujing123/new-api:latest".

Loading