100 lines
3.3 KiB
YAML
100 lines
3.3 KiB
YAML
name: Container image
|
|
|
|
# Three modes, all driven by the same job:
|
|
# - Tag push (v*) → full release: :v1.2.3, :1.2, :latest, :sha-<short>
|
|
# - Branch push → canary: :<branch>, :sha-<short>
|
|
# - Pull request → smoke test: build only, nothing pushed
|
|
#
|
|
# metadata-action emits the right subset of tags for each event based
|
|
# on the `tags:` rules below — no manual branching needed.
|
|
on:
|
|
push:
|
|
branches:
|
|
- '**'
|
|
tags:
|
|
- 'v*'
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
jobs:
|
|
image:
|
|
runs-on: ubuntu-latest
|
|
# The default `ubuntu-latest` label on aether-runner maps to
|
|
# `node:16-bullseye`, which has no docker CLI. Override to an
|
|
# act-compatible image that ships docker + buildx. The runner
|
|
# already bind-mounts /var/run/docker.sock into every job
|
|
# container, so we do NOT add a `volumes:` entry — doing so
|
|
# produces a duplicate-mount error from the daemon.
|
|
container:
|
|
image: catthehacker/ubuntu:act-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
- name: Set up Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
# github.repository is owner/name in the repo's original casing;
|
|
# registries require lowercase. Normalise once and reuse below.
|
|
- name: Resolve image name
|
|
id: img
|
|
run: |
|
|
repo='${{ github.repository }}'
|
|
echo "ref=git.cer.sh/${repo,,}" >> "$GITHUB_OUTPUT"
|
|
|
|
# Version stamp baked into the binary via -ldflags. Tag pushes
|
|
# use the tag name directly; everything else gets a short SHA
|
|
# suffix so `qu version` on a canary build is debuggable.
|
|
- name: Compute version
|
|
id: ver
|
|
run: |
|
|
if [[ "$GITHUB_REF" == refs/tags/* ]]; then
|
|
v="${GITHUB_REF_NAME}"
|
|
else
|
|
v="${GITHUB_REF_NAME}-${GITHUB_SHA:0:7}"
|
|
fi
|
|
echo "version=$v" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Login to Gitea registry
|
|
if: github.event_name == 'push'
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: git.cer.sh
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Docker metadata
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ steps.img.outputs.ref }}
|
|
tags: |
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
|
|
type=ref,event=branch
|
|
type=sha,prefix=sha-,format=short
|
|
|
|
- name: Build (and push on push events)
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile
|
|
platforms: linux/amd64,linux/arm64
|
|
push: ${{ github.event_name == 'push' }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
VERSION=${{ steps.ver.outputs.version }}
|
|
# Inline cache embeds layer metadata into the pushed image
|
|
# itself — no external cache server needed, which keeps the
|
|
# workflow self-contained on the Gitea runner.
|
|
cache-from: type=inline
|
|
cache-to: type=inline
|