FilesExpand file tree

v2.0.1

/

docker-publish.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

141 lines (127 loc) · 5.45 KB

v2.0.1

/

docker-publish.yml

Copy path

Top

File metadata and controls

• Code
• Blame

141 lines (127 loc) · 5.45 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

name: Docker

# This workflow uses actions that are not certified by GitHub.

# They are provided by a third-party and are governed by

# separate terms of service, privacy policy, and support

# documentation.

on:

schedule:

- cron: "27 0 * * *"

push:

branches: ["main", "next"]

# Publish semver tags as releases.

tags: ["v*.*.*"]

pull_request:

branches: ["main", "next"]

workflow_dispatch:

inputs:

description:

required: false

description: "Description of the run."

type: string

default: "Manual run"

env:

# Use docker.io for Docker Hub if empty

REGISTRY: ghcr.io

# github.repository as <account>/<repo>

IMAGE_NAME: ${{ github.repository }}

jobs:

build:

runs-on: ubuntu-latest-xl

permissions:

contents: read

packages: write

# This is used to complete the identity challenge

# with sigstore/fulcio when running outside of PRs.

id-token: write

steps:

- name: Checkout repository

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

# Install the cosign tool except on PR

# https://github.com/sigstore/cosign-installer

- name: Install cosign

if: github.event_name != 'pull_request'

uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 #v4.1.2

with:

cosign-release: "v3.1.3"

# Set up BuildKit Docker container builder to be able to build

# multi-platform images and export cache

# https://github.com/docker/setup-buildx-action

- name: Set up Docker Buildx

uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

# Login against a Docker registry except on PR

# https://github.com/docker/login-action

- name: Log into registry ${{ env.REGISTRY }}

if: github.event_name != 'pull_request'

uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

with:

registry: ${{ env.REGISTRY }}

username: ${{ github.actor }}

password: ${{ secrets.GITHUB_TOKEN }}

# Extract metadata (tags, labels) for Docker

# https://github.com/docker/metadata-action

- name: Extract Docker metadata

id: meta

uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0

with:

images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

tags: |

type=schedule

type=ref,event=branch

type=ref,event=tag

type=ref,event=pr

type=semver,pattern={{version}}

type=semver,pattern={{major}}.{{minor}}

type=semver,pattern={{major}}

type=sha

type=edge

# Custom rule to prevent pre-releases from getting latest tag

type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}

- name: Go Build Cache for Docker

uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6

with:

path: go-build-cache

key: ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.sum') }}

- name: Inject go-build-cache

uses: reproducible-containers/buildkit-cache-dance@5422eac04292c961a382e0f584ea0f03ad9da723 # v3.4.0

with:

cache-map: |

{

"go-build-cache/apk": "/var/cache/apk",

"go-build-cache/pkg": "/go/pkg/mod",

"go-build-cache/build": "/root/.cache/go-build"

}

# Build and push Docker image with Buildx (don't push on PR)

# https://github.com/docker/build-push-action

- name: Build and push Docker image

id: build-and-push

uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0

with:

context: .

push: ${{ github.event_name != 'pull_request' }}

tags: ${{ steps.meta.outputs.tags }}

labels: ${{ steps.meta.outputs.labels }}

cache-from: type=gha

cache-to: type=gha,mode=max

platforms: linux/amd64,linux/arm64

build-args: |

VERSION=${{ github.ref_type == 'tag' && github.ref_name || 'dev' }}

secrets: |

oauth_client_id=${{ secrets.OAUTH_CLIENT_ID }}

oauth_client_secret=${{ secrets.OAUTH_CLIENT_SECRET }}

# Sign the resulting Docker image digest except on PRs.

# Publish both v2-compatible .sig tags and native Sigstore bundles.

# --yes also consents to publishing signing metadata to the public log.

# https://github.com/sigstore/cosign

- name: Sign the published Docker image (legacy)

if: ${{ github.event_name != 'pull_request' }}

env:

# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable

DIGEST: ${{ steps.build-and-push.outputs.digest }}

# This step uses the identity token to provision an ephemeral certificate

# against the sigstore community Fulcio instance.

run: cosign sign --yes --new-bundle-format=false --use-signing-config=false --registry-referrers-mode=legacy "${REGISTRY}/${IMAGE_NAME}@${DIGEST}"

- name: Sign the published Docker image (native bundle)

if: ${{ github.event_name != 'pull_request' }}

env:

DIGEST: ${{ steps.build-and-push.outputs.digest }}

run: cosign sign --yes "${REGISTRY}/${IMAGE_NAME}@${DIGEST}"