2024-07-25 02:08:26 +02:00
|
|
|
name: Docker
|
|
|
|
|
|
|
|
# This workflow uses actions that are not certified by GitHub.
|
|
|
|
# They are provided by a third-party and are governed by
|
|
|
|
# separate terms of service, privacy policy, and support
|
|
|
|
# documentation.
|
|
|
|
|
|
|
|
on:
|
|
|
|
schedule:
|
2024-07-25 21:07:10 +00:00
|
|
|
- cron: "25 0 * * *"
|
2024-07-25 02:08:26 +02:00
|
|
|
push:
|
2024-07-25 21:07:10 +00:00
|
|
|
branches: ["main"]
|
2024-07-25 02:08:26 +02:00
|
|
|
# Publish semver tags as releases.
|
2024-07-25 21:07:10 +00:00
|
|
|
tags: ["v*.*.*"]
|
2024-07-25 02:08:26 +02:00
|
|
|
pull_request:
|
2024-07-25 21:07:10 +00:00
|
|
|
branches: ["main"]
|
2024-11-26 18:18:02 +00:00
|
|
|
workflow_dispatch:
|
2024-07-25 02:08:26 +02:00
|
|
|
|
|
|
|
env:
|
|
|
|
# Use docker.io for Docker Hub if empty
|
|
|
|
REGISTRY: ghcr.io
|
|
|
|
# github.repository as <account>/<repo>
|
|
|
|
IMAGE_NAME: ${{ github.repository }}
|
|
|
|
|
|
|
|
jobs:
|
2025-02-28 16:11:59 +01:00
|
|
|
# test:
|
|
|
|
# runs-on: ubuntu-latest
|
|
|
|
# permissions:
|
|
|
|
# contents: read
|
|
|
|
# packages: write
|
|
|
|
# id-token: write
|
2025-02-26 11:03:28 +01:00
|
|
|
|
2025-02-28 16:11:59 +01:00
|
|
|
# steps:
|
|
|
|
# - name: Checkout repository
|
|
|
|
# uses: actions/checkout@v4
|
2025-02-26 11:03:28 +01:00
|
|
|
|
2025-02-28 16:11:59 +01:00
|
|
|
# - name: Set up Docker Buildx
|
|
|
|
# uses: docker/setup-buildx-action@v3
|
2025-02-26 11:03:28 +01:00
|
|
|
|
2025-02-28 16:11:59 +01:00
|
|
|
# - name: Test
|
|
|
|
# id: test
|
|
|
|
# uses: docker/build-push-action@v6
|
|
|
|
# with:
|
|
|
|
# context: .
|
|
|
|
# platforms: linux/amd64
|
|
|
|
# cache-from: type=gha,scope=x64
|
|
|
|
# pull: true
|
|
|
|
# cache-to: type=gha,mode=max,scope=x64
|
|
|
|
# target: test
|
2025-02-26 11:03:28 +01:00
|
|
|
|
2024-07-25 02:08:26 +02:00
|
|
|
build:
|
2025-02-28 16:11:59 +01:00
|
|
|
# needs: test
|
2024-12-11 00:46:53 +00:00
|
|
|
runs-on: ubuntu-latest
|
2024-07-25 02:08:26 +02:00
|
|
|
permissions:
|
|
|
|
contents: read
|
|
|
|
packages: write
|
|
|
|
id-token: write
|
|
|
|
|
2025-02-26 11:03:28 +01:00
|
|
|
strategy:
|
|
|
|
matrix:
|
|
|
|
platform: [linux/amd64, linux/arm64]
|
|
|
|
|
2024-07-25 02:08:26 +02:00
|
|
|
steps:
|
|
|
|
- name: Checkout repository
|
|
|
|
uses: actions/checkout@v4
|
|
|
|
|
2025-02-28 16:11:10 +01:00
|
|
|
- name: Prepare variables
|
|
|
|
id: vars
|
|
|
|
run: |
|
|
|
|
SURFIX=$(echo ${{ matrix.platform }} | cut -d'/' -f2)
|
|
|
|
echo "SURFIX=$SURFIX" >> $GITHUB_OUTPUT
|
|
|
|
# Generate a unique local tag for the image
|
|
|
|
echo "LOCAL_TAG=local-${{ github.sha }}-$SURFIX" >> $GITHUB_OUTPUT
|
2025-02-27 20:20:55 +00:00
|
|
|
|
2025-02-28 16:17:54 +01:00
|
|
|
- name: Set up QEMU
|
|
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
|
2025-02-26 11:03:28 +01:00
|
|
|
# Set up BuildKit Docker container builder
|
2024-07-25 02:08:26 +02:00
|
|
|
- name: Set up Docker Buildx
|
2024-11-30 12:43:56 +00:00
|
|
|
uses: docker/setup-buildx-action@v3
|
2024-07-25 02:08:26 +02:00
|
|
|
|
|
|
|
# Extract metadata (tags, labels) for Docker
|
|
|
|
- name: Extract Docker metadata
|
|
|
|
id: meta
|
2024-11-30 12:43:56 +00:00
|
|
|
uses: docker/metadata-action@v5
|
2024-07-25 02:08:26 +02:00
|
|
|
with:
|
2024-07-25 21:07:10 +00:00
|
|
|
tags: |
|
|
|
|
type=ref,event=branch
|
|
|
|
type=ref,event=pr
|
2025-02-27 19:41:54 +00:00
|
|
|
type=semver,pattern={{version}}
|
|
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
|
|
type=semver,pattern={{major}}
|
|
|
|
type=raw,enable=${{ github.ref_type == 'tag' }}, value=latest
|
2024-07-25 02:08:26 +02:00
|
|
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
|
|
|
|
2025-02-28 16:24:20 +01:00
|
|
|
- name: Set up apt cache
|
|
|
|
uses: actions/cache@v4
|
|
|
|
id: cache
|
|
|
|
with:
|
|
|
|
path: |
|
|
|
|
var-cache-apt
|
|
|
|
var-lib-apt
|
|
|
|
/root/.cache/uv
|
2025-02-28 16:28:32 +01:00
|
|
|
key: cache-${{ hashFiles('Dockerfile') }}-${{ steps.vars.outputs.SURFIX }}
|
2025-02-28 16:24:20 +01:00
|
|
|
|
|
|
|
- name: Inject cache into docker
|
2025-02-28 17:14:40 +01:00
|
|
|
uses: reproducible-containers/buildkit-cache-dance@v3.1.2
|
2025-02-28 16:24:20 +01:00
|
|
|
with:
|
|
|
|
cache-map: |
|
|
|
|
{
|
|
|
|
"var-cache-apt": "/var/cache/apt",
|
|
|
|
"var-lib-apt": "/var/lib/apt",
|
|
|
|
"root-cache-uv": "/root/.cache/uv"
|
|
|
|
}
|
|
|
|
skip-extraction: ${{ steps.cache.outputs.cache-hit }}
|
|
|
|
|
2025-02-28 16:11:10 +01:00
|
|
|
# Build and export Docker image for each platform (without pushing)
|
|
|
|
- name: Build Docker image
|
|
|
|
id: build
|
2024-11-30 12:43:56 +00:00
|
|
|
uses: docker/build-push-action@v6
|
2024-07-25 02:08:26 +02:00
|
|
|
with:
|
|
|
|
context: .
|
2024-12-11 01:02:59 +00:00
|
|
|
pull: true
|
2025-02-28 16:11:10 +01:00
|
|
|
push: false
|
|
|
|
load: true # Export to local Docker instead of pushing
|
|
|
|
tags: ${{ steps.vars.outputs.LOCAL_TAG }}
|
2024-07-25 02:08:26 +02:00
|
|
|
labels: ${{ steps.meta.outputs.labels }}
|
2025-02-26 11:03:28 +01:00
|
|
|
platforms: ${{ matrix.platform }}
|
2025-02-27 19:10:26 +00:00
|
|
|
cache-from: type=gha,scope=${{ matrix.platform }}
|
|
|
|
cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
|
2025-02-27 19:41:54 +00:00
|
|
|
build-args: GITHUB_BUILD=true,VERSION=${{ github.ref_type == 'tag' && github.ref_name || github.sha }}
|
2025-02-28 16:11:10 +01:00
|
|
|
outputs: type=docker,dest=/tmp/image-${{ steps.vars.outputs.SURFIX }}.tar
|
2025-02-20 20:50:11 +00:00
|
|
|
|
2025-02-28 16:11:10 +01:00
|
|
|
# Upload the tarball as an artifact
|
|
|
|
- name: Upload image artifact
|
|
|
|
uses: actions/upload-artifact@v4
|
|
|
|
with:
|
|
|
|
name: docker-image-${{ steps.vars.outputs.SURFIX }}
|
|
|
|
path: /tmp/image-${{ steps.vars.outputs.SURFIX }}.tar
|
|
|
|
retention-days: 1
|
2025-02-20 20:50:11 +00:00
|
|
|
|
2025-02-28 16:11:10 +01:00
|
|
|
merge-and-push:
|
2025-02-26 11:03:28 +01:00
|
|
|
needs: build
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
if: github.event_name != 'pull_request'
|
|
|
|
permissions:
|
|
|
|
contents: read
|
|
|
|
packages: write
|
|
|
|
id-token: write
|
|
|
|
|
|
|
|
steps:
|
|
|
|
- name: Checkout repository
|
|
|
|
uses: actions/checkout@v4
|
|
|
|
|
2025-02-28 16:11:10 +01:00
|
|
|
# Install the cosign tool
|
|
|
|
- name: Install cosign
|
|
|
|
uses: sigstore/cosign-installer@v3
|
|
|
|
|
|
|
|
# Set up Docker Buildx
|
|
|
|
- name: Set up Docker Buildx
|
|
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
|
|
|
|
# Log into registry
|
2025-02-26 11:03:28 +01:00
|
|
|
- name: Log into registry ${{ env.REGISTRY }}
|
|
|
|
uses: docker/login-action@v3
|
2025-02-20 20:50:11 +00:00
|
|
|
with:
|
2025-02-26 11:03:28 +01:00
|
|
|
registry: ${{ env.REGISTRY }}
|
|
|
|
username: ${{ github.actor }}
|
|
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
2024-07-25 02:08:26 +02:00
|
|
|
|
2025-02-28 16:11:10 +01:00
|
|
|
# Extract Docker metadata for tagging
|
2025-02-26 11:03:28 +01:00
|
|
|
- name: Extract Docker metadata
|
|
|
|
id: meta
|
|
|
|
uses: docker/metadata-action@v5
|
|
|
|
with:
|
|
|
|
tags: |
|
|
|
|
type=ref,event=branch
|
|
|
|
type=ref,event=pr
|
|
|
|
type=semver,pattern={{version}}
|
|
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
|
|
type=semver,pattern={{major}}
|
|
|
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
|
|
|
|
2025-02-28 16:11:10 +01:00
|
|
|
# Download all image artifacts
|
|
|
|
- name: Download AMD64 image
|
|
|
|
uses: actions/download-artifact@v4
|
|
|
|
with:
|
|
|
|
name: docker-image-amd64
|
|
|
|
path: /tmp
|
2025-02-26 11:03:28 +01:00
|
|
|
|
2025-02-28 16:11:10 +01:00
|
|
|
- name: Download ARM64 image
|
|
|
|
uses: actions/download-artifact@v4
|
|
|
|
with:
|
|
|
|
name: docker-image-arm64
|
|
|
|
path: /tmp
|
|
|
|
|
|
|
|
# Load images into Docker
|
|
|
|
- name: Load images
|
|
|
|
run: |
|
|
|
|
docker load --input /tmp/image-amd64.tar
|
|
|
|
docker load --input /tmp/image-arm64.tar
|
2025-02-26 11:03:28 +01:00
|
|
|
|
2025-02-28 16:11:10 +01:00
|
|
|
# Create manifest lists and push
|
|
|
|
- name: Create and push manifest lists
|
2025-02-26 11:03:28 +01:00
|
|
|
run: |
|
|
|
|
TAGS="${{ steps.meta.outputs.tags }}"
|
2025-02-28 17:43:57 +01:00
|
|
|
args=""
|
|
|
|
|
|
|
|
docker tag local-${{ github.sha }}-amd64 local-amd64
|
|
|
|
docker tag local-${{ github.sha }}-arm64 local-arm64
|
|
|
|
|
2025-02-26 11:03:28 +01:00
|
|
|
for TAG in $TAGS; do
|
2025-02-28 17:43:57 +01:00
|
|
|
# Create tag arguments
|
|
|
|
for tag in $tags; do
|
|
|
|
args="$args -t $tag"
|
2025-02-26 11:03:28 +01:00
|
|
|
done
|
|
|
|
|
2025-02-28 17:09:23 +01:00
|
|
|
if [ "${{ github.ref_type }}" == "tag" ]; then
|
2025-02-28 17:43:57 +01:00
|
|
|
args="$args -t latest"
|
2025-02-28 17:09:23 +01:00
|
|
|
fi
|
2025-02-28 17:43:57 +01:00
|
|
|
docker buildx imagetools create $args \
|
|
|
|
local-amd64 \
|
|
|
|
local-arm64
|
2025-02-28 17:09:23 +01:00
|
|
|
|
2025-02-28 16:11:10 +01:00
|
|
|
# Sign the manifest
|
|
|
|
- name: Sign the manifests
|
2024-07-25 02:08:26 +02:00
|
|
|
env:
|
|
|
|
TAGS: ${{ steps.meta.outputs.tags }}
|
2025-02-26 11:03:28 +01:00
|
|
|
run: |
|
|
|
|
for TAG in $TAGS; do
|
|
|
|
cosign sign --yes $TAG
|
|
|
|
done
|