106 lines
3.1 KiB
YAML
106 lines
3.1 KiB
YAML
name: build & push docker container
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
tags:
|
|
- '*'
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
strategy:
|
|
matrix:
|
|
platform:
|
|
- linux/amd64
|
|
- linux/arm64
|
|
runs-on: ${{ matrix.platform == 'linux/arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ghcr.io/${{ github.repository }}
|
|
flavor: |
|
|
suffix=-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
|
|
|
|
- name: Set up Docker
|
|
uses: docker/setup-docker-action@v4
|
|
|
|
- name: Login to GitHub Container Registry
|
|
if: github.event_name != 'pull_request'
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ github.token }}
|
|
|
|
- name: Build and push arch-specific image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: ${{ matrix.platform }}
|
|
push: ${{ github.event_name != 'pull_request' }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
provenance: false
|
|
|
|
create_manifest:
|
|
if: github.event_name != 'pull_request'
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
artifact-metadata: write
|
|
attestations: write
|
|
steps:
|
|
- name: Docker meta for final tags
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ghcr.io/${{ github.repository }}
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ github.token }}
|
|
|
|
- name: Create and push manifest list
|
|
id: push
|
|
env:
|
|
AMD64_IMAGE: ghcr.io/${{ github.repository }}:${{ steps.meta.outputs.version }}-amd64
|
|
ARM64_IMAGE: ghcr.io/${{ github.repository }}:${{ steps.meta.outputs.version }}-arm64
|
|
IMAGE: ghcr.io/${{ github.repository }}:${{ steps.meta.outputs.version }}
|
|
TAGS: ${{ steps.meta.outputs.tags }}
|
|
run: |
|
|
echo "$TAGS" | xargs -I {} \
|
|
docker buildx imagetools create -t {} $AMD64_IMAGE $ARM64_IMAGE
|
|
|
|
# Inspect digest for attestation
|
|
DIGEST=$(docker buildx imagetools inspect "$IMAGE" --format "{{index .Manifest.Digest}}")
|
|
echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Attest
|
|
uses: actions/attest-build-provenance@v3
|
|
id: attest
|
|
with:
|
|
subject-name: ghcr.io/${{ github.repository }}
|
|
subject-digest: ${{ steps.push.outputs.digest }}
|