name: Docker # This workflow uses actions that are not certified by GitHub. # They are provided by a third-party and are governed by # separate terms of service, privacy policy, and support # documentation. on: schedule: - cron: "25 0 * * *" push: branches: ["main"] # Publish semver tags as releases. tags: ["v*.*.*"] pull_request: branches: ["main"] workflow_dispatch: env: # Use docker.io for Docker Hub if empty REGISTRY: ghcr.io # github.repository as / IMAGE_NAME: ${{ github.repository }} jobs: test: runs-on: ubuntu-latest permissions: contents: read packages: write id-token: write steps: - name: Checkout repository uses: actions/checkout@v4 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - name: Test id: test uses: docker/build-push-action@v6 with: context: . platforms: linux/amd64 cache-from: type=gha,scope=x64 pull: true cache-to: type=gha,mode=max,scope=x64 target: test build: needs: test runs-on: ubuntu-latest permissions: contents: read packages: write id-token: write strategy: matrix: platform: [linux/amd64, linux/arm64] steps: - name: Checkout repository uses: actions/checkout@v4 # Install the cosign tool except on PR - name: Install cosign if: github.event_name != 'pull_request' uses: sigstore/cosign-installer@v3 # Set up BuildKit Docker container builder - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 # Login against a Docker registry except on PR - name: Log into registry ${{ env.REGISTRY }} if: github.event_name != 'pull_request' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} # Extract metadata (tags, labels) for Docker - name: Extract Docker metadata id: meta uses: docker/metadata-action@v5 with: tags: | type=ref,event=branch type=ref,event=pr type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=semver,pattern={{major}} type=raw,enable=${{ github.ref_type == 'tag' }}, value=latest images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} # Build and push Docker image with platform-specific tag - name: Build and push Docker image id: build-and-push uses: docker/build-push-action@v6 with: context: . pull: true push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }}-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }} labels: ${{ steps.meta.outputs.labels }} platforms: ${{ matrix.platform }} cache-from: type=gha,scope=${{ matrix.platform }} cache-to: type=gha,mode=max,scope=${{ matrix.platform }} build-args: GITHUB_BUILD=true,VERSION=${{ github.ref_type == 'tag' && github.ref_name || github.sha }} # Sign the platform specific image - name: Sign the published Docker image if: ${{ github.event_name != 'pull_request' }} env: TAGS: ${{ steps.meta.outputs.tags }} DIGEST: ${{ steps.build-and-push.outputs.digest }} run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} merge: needs: build runs-on: ubuntu-latest if: github.event_name != 'pull_request' permissions: contents: read packages: write id-token: write steps: - name: Checkout repository uses: actions/checkout@v4 - name: Log into registry ${{ env.REGISTRY }} uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Extract Docker metadata id: meta uses: docker/metadata-action@v5 with: tags: | type=ref,event=branch type=ref,event=pr type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=semver,pattern={{major}} type=raw,enable=${{ github.ref_type == 'tag' }}, value=latest images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - name: Install cosign uses: sigstore/cosign-installer@v3 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - name: Create and push manifest run: | TAGS="${{ steps.meta.outputs.tags }}" for TAG in $TAGS; do # Create manifest list and push it docker buildx imagetools create -t $TAG \ $TAG-amd64 \ $TAG-arm64 done - name: Install cosign uses: sigstore/cosign-installer@v3 - name: Sign the manifest env: TAGS: ${{ steps.meta.outputs.tags }} run: | for TAG in $TAGS; do cosign sign --yes $TAG done