|
1 |
| ---- |
2 |
| -name: Publish |
3 |
| - |
4 |
| -## Overview |
5 |
| -# Build and publish a container image |
6 |
| -# |
7 |
| -# This will clone a repository and attempt to build a |
8 |
| -# Docker-compatible container image. If the image is |
9 |
| -# build successfully, it will be published to zero or |
10 |
| -# more container registries. The image's tags will be |
11 |
| -# based on the semantic version (semver) associated |
12 |
| -# with tags associated with the commit being built. |
13 |
| -# |
14 |
| -# Images may built for a variety of platforms |
15 |
| -# and architectures. By default, images are built |
16 |
| -# for: |
17 |
| -# |
18 |
| -# * linux/amd64 |
19 |
| -# * linux/arm64 |
20 |
| -# * linux/arm/v6 |
21 |
| -# * linux/arm/v7 |
22 |
| -# |
23 |
| -# Supported image registries include: |
24 |
| -# |
25 |
| -# * Dockerhub |
26 |
| -# * GHCR |
27 |
| -# * Quay |
28 |
| -# |
29 |
| -## Environment Variables |
30 |
| -# |
31 |
| -# This action may be configured through a variety |
32 |
| -# of environment variables: |
33 |
| -# |
34 |
| -# * DOCKERHUB_USERNAME (no default) |
35 |
| -# * DOCKERHUB_PAT (no default) |
36 |
| -# * GHCR_USERNAME (no default) |
37 |
| -# * GHCR_PAT (no default) |
38 |
| -# * QUAY_USERNAME (no default) |
39 |
| -# * QUAY_PAT (no default) |
40 |
| -# * dockerhub_image (default: DOCKERHUB_USERNAME/repo_name) |
41 |
| -# * ghcr_image (default: GHCR_USERNAME/repo_name) |
42 |
| -# * quay_image (default: QUAY_USERNAME/repo_name) |
43 |
| -# * context (default: .) |
44 |
| -# * dockerfile (default: $CONTEXT/Dockerfile) |
45 |
| -# * platforms (linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7) |
46 |
| -# |
47 |
| -# To push to Dockerhub, GHCR, or Quay, define the |
48 |
| -# corresponding _USERNAME and _PAT variables (e.g., to |
49 |
| -# push to GHCR, define GHCR_USERNAME and GHCR_PAT). If |
50 |
| -# the _USERNAME and _PAT for a given platform aren't defined, |
51 |
| -# they'll be skipped. Zero, some, or all platforms may be |
52 |
| -# used. |
53 |
| -# |
54 |
| -# Note: acknowledged that GHCR users PATs while Dockerhub and |
55 |
| -# Quay don't use that terminology. What can I say.. I did |
56 |
| -# GHCR first before considering Dockerhub or Quay. |
57 |
| -# |
58 |
| -## Image tagging and labeling |
59 |
| -# |
60 |
| -# Depending on how the action was triggered, tags are applied |
61 |
| -# to the images differently. |
62 |
| -# |
63 |
| -# When commits are pushed to the `main` branch with no version |
64 |
| -# tag, an image will be built and pushed with the tag `:edge`. |
65 |
| -# |
66 |
| -# However, when commits are pushed with a version tag (e.g., |
67 |
| -# a tag that starts with `v`) -- such as when a release is |
68 |
| -# cut -- then several tags are applied: |
69 |
| -# |
70 |
| -# * :edge |
71 |
| -# * :latest |
72 |
| -# * :{major version} |
73 |
| -# * :{major.minor version} |
74 |
| -# * :{major.minor.patch version} |
75 |
| -# * :{short commit SHA} |
76 |
| -# * :{full commit SHA} |
77 |
| -# |
78 |
| -# So, if a commit is pushed with a tag of 'v1.2.3' then |
79 |
| -# the following tags are added to the resulting image: |
80 |
| -# |
81 |
| -# * :edge |
82 |
| -# * :latest |
83 |
| -# * v1 |
84 |
| -# * v1.2 |
85 |
| -# * v1.2.3 |
86 |
| -# * sha-db12abc |
87 |
| -# * sha-db12abc7b3025c32d44b54c84ae2c851f1eeaebc |
88 |
| -# |
89 |
| -# Additionally, images have standard OCI annotations |
90 |
| -# and labels (e.g., `org.opencontainers.image. ...) |
91 |
| -# added automatically. For more information, check |
92 |
| -# out the annotation spec: |
93 |
| -# |
94 |
| -# https://github.com/opencontainers/image-spec/blob/main/annotations.md |
95 |
| -# |
96 |
| -## READMEs and descriptions |
97 |
| -# |
98 |
| -# For registries that support it, descriptions are automatically |
99 |
| -# added / updated after successfully publishing the relevant |
100 |
| -# images. These descriptions are taken from the repository's |
101 |
| -# /README.md files. |
102 |
| -# |
103 |
| -# Note: descriptions are only updated when releases are cut. If, |
104 |
| -# for example, a commit is pushed to `main` that doesn't have a tag |
105 |
| -# that starts with `v*` then while the `:edge` tag is updated, the |
106 |
| -# desciption won't be updated. Such is the trade-off of living |
107 |
| -# on the `:edge`. |
108 |
| - |
109 |
| -# yamllint disable-line rule:truthy |
| 1 | +name: Deploy |
110 | 2 | on:
|
111 |
| - push: |
112 |
| - branches: |
113 |
| - - "main" |
114 |
| - tags: |
115 |
| - - "v*" |
116 |
| - workflow_dispatch: |
117 |
| - |
118 |
| -permissions: read-all |
119 |
| - |
| 3 | + workflow_run: |
| 4 | + workflows: ["CI"] |
| 5 | + branches: [main] |
| 6 | + types: |
| 7 | + - completed |
120 | 8 | jobs:
|
121 |
| - publish_image: |
| 9 | + docker: |
| 10 | + if: ${{ github.event.workflow_run.conclusion == 'success' }} |
122 | 11 | runs-on: ubuntu-latest
|
123 | 12 | steps:
|
124 |
| - - name: Checkout |
125 |
| - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # pin@v3 |
126 |
| - |
127 |
| - - name: Set up QEMU |
128 |
| - uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # pin@v2 |
129 |
| - |
130 |
| - - name: Set up Docker Buildx |
131 |
| - uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # pin@v2 |
132 |
| - |
133 |
| - - name: Custom Variables |
134 |
| - id: customvars |
135 |
| - shell: bash |
136 |
| - run: | |
137 |
| - ( echo -n "dockerhub=" |
138 |
| - if [ -n "${{ secrets.DOCKERHUB_USERNAME }}" ] \ |
139 |
| - && [ -n "${{ secrets.DOCKERHUB_PAT }}" ] ; then |
140 |
| - echo "true" |
141 |
| - else |
142 |
| - echo "false" |
143 |
| - fi |
144 |
| -
|
145 |
| - echo -n "ghcr=" |
146 |
| - if [ -n "${{ secrets.GHCR_USERNAME }}" ] \ |
147 |
| - && [ -n "${{ secrets.GHCR_PAT }}" ] ; then |
148 |
| - echo "true" |
149 |
| - else |
150 |
| - echo "false" |
151 |
| - fi |
152 |
| -
|
153 |
| - echo -n "quay=" |
154 |
| - if [ -n "${{ secrets.QUAY_USERNAME }}" ] \ |
155 |
| - && [ -n "${{ secrets.QUAY_PAT }}" ] ; then |
156 |
| - echo "quay=true" |
157 |
| - else |
158 |
| - echo "quay=false" |
159 |
| - fi |
160 |
| -
|
161 |
| - echo -n "is_release=" |
162 |
| - if [[ "${{ github.ref }}" =~ refs/tags/v.* ]] ; then |
163 |
| - echo "true" |
164 |
| - else |
165 |
| - echo "false" |
166 |
| - fi |
167 |
| -
|
168 |
| - echo -n "dockerhub_image=" |
169 |
| - if [ -n "${{ env.dockerhub_image }}" ] ; then |
170 |
| - echo "${{ env.dockerhub_image }}" |
171 |
| - else |
172 |
| - echo "${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}" |
173 |
| - fi |
174 |
| -
|
175 |
| - echo -n "ghcr_image=" |
176 |
| - if [ -n "${{ env.ghcr_image }}" ] ; then |
177 |
| - echo "${{ env.ghcr_image }}" |
178 |
| - else |
179 |
| - echo "${{ secrets.GHCR_USERNAME }}/${{ github.event.repository.name }}" |
180 |
| - fi |
181 |
| -
|
182 |
| - echo -n "quay_image=" |
183 |
| - if [ -n "${{ env.quay_image }}" ] ; then |
184 |
| - echo "${{ env.quay_image }}" |
185 |
| - else |
186 |
| - echo "${{ secrets.QUAY_USERNAME }}/${{ github.event.repository.name }}" |
187 |
| - fi |
188 |
| -
|
189 |
| - echo -n "context=" |
190 |
| - if [ -n "${{ env.context }}" ] ; then |
191 |
| - echo "${{ env.context }}" |
192 |
| - else |
193 |
| - echo "." |
194 |
| - fi |
195 |
| -
|
196 |
| - echo -n "dockerfile=" |
197 |
| - if [ -n "${{ env.dockerfile }}" ] ; then |
198 |
| - echo "${{ env.dockerfile }}" |
199 |
| - else |
200 |
| - echo "${{ env.context }}/Dockerfile" |
201 |
| - fi |
202 |
| -
|
203 |
| - echo -n "platforms=" |
204 |
| - if [ -n "${{ env.platforms }}" ] ; then |
205 |
| - echo ${{ env.platforms }} |
206 |
| - else |
207 |
| - echo "linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6" |
208 |
| - fi |
209 |
| - ) >> $GITHUB_OUTPUT |
210 |
| -
|
211 |
| - - name: Login to GitHub Packages |
212 |
| - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # pin@v2 |
213 |
| - if: ${{ steps.customvars.outputs.ghcr == 'true' }} |
| 13 | + - uses: actions/checkout@v4 |
| 14 | + # https://github.com/docker/login-action#github-container-registry |
| 15 | + - uses: docker/login-action@v3 |
214 | 16 | with:
|
215 |
| - username: ${{ secrets.GHCR_USERNAME }} |
216 |
| - password: ${{ secrets.GHCR_PAT }} |
217 | 17 | registry: ghcr.io
|
218 |
| - |
219 |
| - - name: Login to Dockerhub |
220 |
| - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # pin@v2 |
221 |
| - if: ${{ steps.customvars.outputs.dockerhub == 'true' }} |
222 |
| - with: |
223 |
| - username: ${{ secrets.DOCKERHUB_USERNAME }} |
224 |
| - password: ${{ secrets.DOCKERHUB_PAT }} |
225 |
| - registry: registry.hub.docker.com |
226 |
| - |
227 |
| - - name: Login to Quay |
228 |
| - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # pin@v2 |
229 |
| - if: ${{ steps.customvars.outputs.quay == 'true' }} |
230 |
| - with: |
231 |
| - username: ${{ secrets.QUAY_USERNAME }} |
232 |
| - password: ${{ secrets.QUAY_PAT }} |
233 |
| - registry: quay.io |
234 |
| - |
235 |
| - - name: Docker metadata |
236 |
| - id: meta |
237 |
| - uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # pin@v5 |
238 |
| - with: |
239 |
| - images: | |
240 |
| - name=registry.hub.docker.com/${{ steps.customvars.outputs.dockerhub_image }},enable=${{ steps.customvars.outputs.dockerhub == 'true' }} |
241 |
| - name=ghcr.io/${{ steps.customvars.outputs.ghcr_image }},enable=${{ steps.customvars.outputs.ghcr == 'true' }} |
242 |
| - name=quay.io/${{ steps.customvars.outputs.quay_image }},enable=${{ steps.customvars.outputs.quay == 'true' }} |
243 |
| - tags: | |
244 |
| - type=raw,value=latest,enable=${{ steps.customvars.outputs.is_release == 'true' }} |
245 |
| - type=semver,pattern={{version}},enable=${{ steps.customvars.outputs.is_release == 'true' }} |
246 |
| - type=semver,pattern={{major}},enable=${{ steps.customvars.outputs.is_release == 'true' }} |
247 |
| - type=semver,pattern={{major}}.{{minor}},enable=${{ steps.customvars.outputs.is_release == 'true' }} |
248 |
| - type=edge,branch=main |
249 |
| - type=sha |
250 |
| - type=sha,format=long |
251 |
| - env: |
252 |
| - DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index |
253 |
| - |
254 |
| - - name: Build and push |
255 |
| - uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # pin@v4 |
| 18 | + username: ${{ github.actor }} |
| 19 | + password: ${{ secrets.GITHUB_TOKEN }} |
| 20 | + # https://github.com/docker/setup-buildx-action#usage |
| 21 | + - uses: docker/setup-buildx-action@v3 |
| 22 | + # https://github.com/docker/build-push-action#usage |
| 23 | + - uses: docker/build-push-action@v6 |
256 | 24 | with:
|
257 | 25 | push: true
|
258 |
| - sbom: true |
259 |
| - platforms: ${{ steps.customvars.outputs.platforms }} |
260 |
| - tags: ${{ steps.meta.outputs.tags }} |
261 |
| - labels: ${{ steps.meta.outputs.labels }} |
262 |
| - annotations: ${{ steps.meta.outputs.annotations }} |
263 |
| - context: ${{ steps.customvars.outputs.context }} |
264 |
| - file: ${{ steps.customvars.outputs.dockerfile }} |
265 |
| - |
266 |
| - - name: update DockerHub description |
267 |
| - uses: christian-korneck/update-container-description-action@d36005551adeaba9698d8d67a296bd16fa91f8e8 # pin@v1 |
268 |
| - if: ${{ steps.customvars.outputs.dockerhub == 'true' }} && ${{ steps.customvars.outputs.is_release == 'true' }} |
269 |
| - with: |
270 |
| - destination_container_repo: ${{ steps.customvars.outputs.dockerhub_image }} |
271 |
| - provider: dockerhub |
272 |
| - env: |
273 |
| - DOCKER_USER: ${{ secrets.DOCKERHUB_USERNAME }} |
274 |
| - DOCKER_PASS: ${{ secrets.DOCKERHUB_PAT }} |
275 |
| - |
276 |
| - - name: update Quay description |
277 |
| - uses: christian-korneck/update-container-description-action@d36005551adeaba9698d8d67a296bd16fa91f8e8 # pin@v1 |
278 |
| - if: ${{ steps.customvars.outputs.quay == 'true' }} && ${{ steps.customvars.outputs.is_release == 'true' }} |
279 |
| - with: |
280 |
| - destination_container_repo: ${{ steps.customvars.outputs.quay_image }} |
281 |
| - provider: quay |
282 |
| - env: |
283 |
| - DOCKER_APIKEY: ${{ secrets.QUAY_PAT }} |
| 26 | + tags: | |
| 27 | + ghcr.io/${{ github.repository }}:latest |
| 28 | + cache-from: type=gha |
| 29 | + cache-to: type=gha,mode=max |
0 commit comments