|
1 | 1 | name: Docker
|
2 | 2 |
|
3 |
| -# This workflow uses actions that are not certified by GitHub. |
4 |
| -# They are provided by a third-party and are governed by |
5 |
| -# separate terms of service, privacy policy, and support |
6 |
| -# documentation. |
7 |
| - |
8 | 3 | on:
|
9 | 4 | push:
|
10 |
| - branches: [ "dev" ] |
11 |
| - # Publish version tags as releases. |
12 |
| - tags: [ 'v*.*.*' ] |
13 |
| - |
14 |
| -env: |
15 |
| - # Use docker.io for Docker Hub if empty |
16 |
| - REGISTRY: ghcr.io |
17 |
| - # github.repository as <account>/<repo> |
18 |
| - IMAGE_NAME: ${{ github.repository }} |
19 |
| - |
| 5 | + branches: |
| 6 | + - dev |
| 7 | + - master |
| 8 | + tags: |
| 9 | + - v* |
| 10 | + workflow_dispatch: |
20 | 11 |
|
21 | 12 | jobs:
|
22 | 13 | build:
|
23 |
| - |
24 | 14 | runs-on: ubuntu-latest
|
25 | 15 | permissions:
|
26 | 16 | contents: read
|
27 | 17 | packages: write
|
28 |
| - # This is used to complete the identity challenge |
29 |
| - # with sigstore/fulcio when running outside of PRs. |
30 | 18 | id-token: write
|
31 | 19 |
|
32 | 20 | steps:
|
33 | 21 | - name: Checkout repository
|
34 | 22 | uses: actions/checkout@v3
|
35 | 23 |
|
36 |
| - # Install the cosign tool except on PR |
37 |
| - # https://github.com/sigstore/cosign-installer |
38 | 24 | - name: Install cosign
|
39 |
| - if: github.event_name != 'pull_request' |
40 |
| - uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 #v2.6.0 |
41 |
| - with: |
42 |
| - cosign-release: 'v1.11.0' |
| 25 | + uses: sigstore/cosign-installer@main |
43 | 26 |
|
| 27 | + - name: Check cosign install |
| 28 | + run: cosign version |
44 | 29 |
|
45 |
| - # Workaround: https://github.com/docker/build-push-action/issues/461 |
46 | 30 | - name: Setup Docker buildx
|
47 |
| - uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf |
| 31 | + uses: docker/setup-buildx-action@v2 |
48 | 32 |
|
49 |
| - # Login against a Docker registry except on PR |
50 |
| - # https://github.com/docker/login-action |
51 |
| - - name: Log into registry ${{ env.REGISTRY }} |
52 |
| - if: github.event_name != 'pull_request' |
53 |
| - uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c |
| 33 | + - name: Login ghcr.io |
| 34 | + uses: docker/login-action@v2 |
54 | 35 | with:
|
55 |
| - registry: ${{ env.REGISTRY }} |
| 36 | + registry: ghcr.io |
56 | 37 | username: ${{ github.actor }}
|
57 | 38 | password: ${{ secrets.GITHUB_TOKEN }}
|
58 | 39 |
|
59 |
| - # Extract metadata (tags, labels) for Docker |
60 |
| - # https://github.com/docker/metadata-action |
61 | 40 | - name: Extract Docker metadata
|
62 | 41 | id: meta
|
63 |
| - uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 |
| 42 | + uses: docker/metadata-action@v4 |
64 | 43 | with:
|
65 |
| - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} |
| 44 | + images: ghcr.io/${{ github.repository }} |
66 | 45 |
|
67 |
| - # Build and push Docker image with Buildx (don't push on PR) |
68 |
| - # https://github.com/docker/build-push-action |
69 | 46 | - name: Build and push Docker image
|
70 | 47 | id: build-and-push
|
71 |
| - uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a |
| 48 | + uses: docker/build-push-action@v3 |
72 | 49 | with:
|
73 | 50 | context: .
|
74 |
| - push: ${{ github.event_name != 'pull_request' }} |
| 51 | + push: true |
75 | 52 | tags: ${{ steps.meta.outputs.tags }}
|
76 | 53 | labels: ${{ steps.meta.outputs.labels }}
|
77 | 54 | cache-from: type=gha
|
78 | 55 | cache-to: type=gha,mode=max
|
79 | 56 |
|
80 |
| - |
81 |
| - # Sign the resulting Docker image digest except on PRs. |
82 |
| - # This will only write to the public Rekor transparency log when the Docker |
83 |
| - # repository is public to avoid leaking data. If you would like to publish |
84 |
| - # transparency data even for private images, pass --force to cosign below. |
85 |
| - # https://github.com/sigstore/cosign |
86 | 57 | - name: Sign the published Docker image
|
87 |
| - if: ${{ github.event_name != 'pull_request' }} |
88 | 58 | env:
|
89 | 59 | COSIGN_EXPERIMENTAL: "true"
|
90 |
| - # This step uses the identity token to provision an ephemeral certificate |
91 |
| - # against the sigstore community Fulcio instance. |
92 | 60 | run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
|
0 commit comments