Skip to content

fix: Redundant test workflow (#10) #94

fix: Redundant test workflow (#10)

fix: Redundant test workflow (#10) #94

Workflow file for this run

name: Create and publish a Docker image
# Configures this workflow to run every time a change is pushed to the branch called `release`.
on:
workflow_dispatch:
schedule:
# Weekly auto-update
- cron: '0 4 * * 0' # Runs at 4:00 AM UTC every Sunday
pull_request:
branches:
- latest
paths:
# Only runs when the Dockerfile or the workflow file itself is changed.
- 'Dockerfile'
- '.github/workflows/publish.yaml'
push:
branches:
- latest
paths:
# Only runs when the Dockerfile or the workflow file itself is changed.
- 'Dockerfile'
- '.github/workflows/publish.yaml'
# Defines two custom environment variables for the workflow.
# These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
# Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this workflow.
permissions:
contents: read
packages: write
attestations: write
id-token: write
# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
jobs:
prep:
runs-on: ubuntu-latest
outputs:
# Lowercase image name is needed for docker to work properly.
# Otherwise we get "invalid reference format: repository name must be lowercase"
IMAGE_LOWERCASE: ${{ steps.lower.outputs.IMAGE_LOWERCASE }}
steps:
- name: Lowercase image name
id: lower
run: |
IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
echo "IMAGE_LOWERCASE=$(echo $IMAGE | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
test:
strategy:
fail-fast: false
# This job runs on two different runners: one for x86_64 and one for ARM.
# The ARM runner is used to test the image on an ARM architecture.
# The x86_64 runner is used to test the image on an x86_64 architecture.
matrix:
include:
- platform: linux/amd64
runner: ubuntu-24.04
- platform: linux/arm64
runner: ubuntu-24.04-arm
runs-on: ${{ matrix.runner }}
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
- name: Install container-structure-test
run: |
if [ "${{ matrix.platform }}" == "linux/arm64" ]; then
ARCH="arm64"
else
ARCH="amd64"
fi
curl -LO "https://storage.googleapis.com/container-structure-test/latest/container-structure-test-linux-${ARCH}"
chmod +x "container-structure-test-linux-${ARCH}"
sudo mv "container-structure-test-linux-${ARCH}" /usr/local/bin/container-structure-test
- name: Run tests
run: |
./test.sh ${{ matrix.platform }}
build_and_push_image:
needs:
- prep
- test
env:
IMAGE_LOWERCASE: ${{ needs.prep.outputs.IMAGE_LOWERCASE }}
strategy:
fail-fast: false
matrix:
include:
- platform: linux/amd64
runner: ubuntu-24.04
- platform: linux/arm64
runner: ubuntu-24.04-arm
runs-on: ${{ matrix.runner }}
steps:
- name: Prepare
run: |
platform=${{ matrix.platform }}
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
- name: Checkout repository
uses: actions/checkout@v4
# Needed for push-by-digest, which is not available in the default Docker driver.
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
# Uses the `docker/login-action` action to log in to the Container registry using the account and password
# that will publish the packages. Once published, the packages are scoped to the account defined here.
- name: Log in to the Container registry
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
# This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract
# tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step
# to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
with:
images: ${{ env.IMAGE_LOWERCASE }}
# This step uses the `docker/build-push-action` action to build the image, based on your repository's
# `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
# It uses the `context` parameter to define the build's context as the set of files located in the specified path.
# For more information, see [Usage](https://github.com/docker/build-push-action#usage) in the README of the
# `docker/build-push-action` repository.
# It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
- name: Build and push Docker image by digest
id: push
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
with:
context: .
tags: ${{ env.IMAGE_LOWERCASE }}
labels: ${{ steps.meta.outputs.labels }}
platforms: ${{ matrix.platform }}
outputs: type=image,push-by-digest=true,name-canonical=true,push=true
- name: Export digest
run: |
mkdir -p ${{ runner.temp }}/digests
digest="${{ steps.push.outputs.digest }}"
touch "${{ runner.temp }}/digests/${digest#sha256:}"
- name: Upload digest for merge-images step
uses: actions/upload-artifact@v4
with:
name: digests-${{ env.PLATFORM_PAIR }}
path: ${{ runner.temp }}/digests/*
if-no-files-found: error
retention-days: 1
# This step generates an artifact attestation for the image, which is an unforgettable statement about where and how
# it was built. It increases supply chain security for people who consume the image.
# For more information, see:
# [Using artifact attestations to establish provenance for builds](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
- name: Generate artifact attestation
uses: actions/attest-build-provenance@v2
with:
subject-name: ${{ env.IMAGE_LOWERCASE }}
subject-digest: ${{ steps.push.outputs.digest }}
push-to-registry: true
merge_pushed_images:
runs-on: ubuntu-latest
needs:
- prep
- build_and_push_image
env:
IMAGE_LOWERCASE: ${{ needs.prep.outputs.IMAGE_LOWERCASE }}
steps:
- name: Download digests
uses: actions/download-artifact@v4
with:
path: ${{ runner.temp }}/digests
pattern: digests-*
merge-multiple: true
- name: Log in to the Container registry
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
with:
images: ${{ env.IMAGE_LOWERCASE }}
tags: |
type=ref,event=branch
type=ref,event=pr
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
- name: Create manifest list and push
working-directory: ${{ runner.temp }}/digests
run: |
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
$(printf "$IMAGE_LOWERCASE@sha256:%s " *)