-
Notifications
You must be signed in to change notification settings - Fork 0
142 lines (120 loc) · 4.29 KB
/
build-and-push.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
name: Build and Push Docker Image
on:
push:
branches:
- master
- develop
tags:
- 'v*'
pull_request:
branches:
- master
- develop
permissions:
contents: read
packages: write
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Install cosign
uses: sigstore/[email protected]
- name: Verify distroless base image
run: make verify || exit 1
- name: Cache Docker layers
uses: actions/cache@v4
with:
path: /tmp/.buildx-cache
key: ${{ runner.os }}-buildx-${{ github.sha }}
restore-keys: |
${{ runner.os }}-buildx-
- name: Set env
run: echo "DISTROLESS_IMAGE=$(grep DISTROLESS_IMAGE image.env | cut -d '=' -f2)" >> $GITHUB_ENV
- name: Build Docker image
uses: docker/build-push-action@v6
with:
context: .
tags: sholdee/adguardexporter:test-${{ github.sha }}
platforms: linux/amd64,linux/arm64
cache-from: type=local,src=/tmp/.buildx-cache
cache-to: type=local,dest=/tmp/.buildx-cache
build-args: |
DISTROLESS_IMAGE=${{ env.DISTROLESS_IMAGE }}
push:
runs-on: ubuntu-latest
needs: build
if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/tags/')
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Install cosign
if: github.event_name != 'pull_request'
uses: sigstore/[email protected]
- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Log in to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Cache Docker layers
uses: actions/cache@v4
with:
path: /tmp/.buildx-cache
key: ${{ runner.os }}-buildx-${{ github.sha }}
restore-keys: |
${{ runner.os }}-buildx-
- name: Docker meta
id: meta
uses: docker/metadata-action@v5
with:
images: |
sholdee/adguardexporter
ghcr.io/${{ github.repository_owner }}/adguard-exporter
tags: |
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
type=raw,value=develop,enable=${{ github.ref == 'refs/heads/develop' }}
type=ref,event=branch
type=ref,event=tag
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
- name: Set env
run: echo "DISTROLESS_IMAGE=$(grep DISTROLESS_IMAGE image.env | cut -d '=' -f2)" >> $GITHUB_ENV
- name: Build and push Docker image
uses: docker/build-push-action@v6
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
platforms: linux/amd64,linux/arm64
cache-from: type=local,src=/tmp/.buildx-cache
cache-to: type=local,dest=/tmp/.buildx-cache
build-args: |
DISTROLESS_IMAGE=${{ env.DISTROLESS_IMAGE }}
- name: Sign the images with GitHub OIDC Token
if: github.event_name != 'pull_request'
env:
COSIGN_EXPERIMENTAL: 1
run: |
echo "${{ steps.meta.outputs.tags }}" | tr ',' '\n' | while read -r image; do
cosign sign --yes "${image}"
done
- name: Verify Docker manifest
run: |
docker buildx imagetools inspect sholdee/adguardexporter:latest
docker buildx imagetools inspect ghcr.io/${{ github.repository }}:latest
if [[ "${{ github.ref }}" == "refs/heads/develop" ]]; then
docker buildx imagetools inspect sholdee/adguardexporter:develop
docker buildx imagetools inspect ghcr.io/${{ github.repository }}:develop
fi