mirror of
https://github.com/aculix/negotium.git
synced 2026-09-11 07:28:17 +00:00
Aculix Technologies
6e00c0a814
The package page showed a sha256 hash instead of a usable tag. cosign pushes a separate artifact per build, tagged sha256-<digest>.sig, and because it goes up after the image it was the newest entry. Sixty-odd nightly runs had filled the listing with them. Dropping the signing step leaves :latest visible. The tradeoff is real: published images are no longer signed against the sigstore log. There's no way to keep cosign and hide its artifacts, since GHCR renders them as ordinary versions, so it's signing against a readable package page. Also makes the tagging explicit instead of relying on the action default. latest=auto moves :latest onto any pushed vX.Y.Z tag. Version goes to 2.0.0: storage moved to a new key format, migrated on first open, and Backspace no longer deletes. Removes the analytics tag from index.html.
87 lines
2.9 KiB
YAML
87 lines
2.9 KiB
YAML
name: Docker
|
|
|
|
# This workflow uses actions that are not certified by GitHub.
|
|
# They are provided by a third-party and are governed by
|
|
# separate terms of service, privacy policy, and support
|
|
# documentation.
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '34 4 * * *'
|
|
push:
|
|
branches: [ "main" ]
|
|
# Publish semver tags as releases.
|
|
tags: [ 'v*.*.*' ]
|
|
pull_request:
|
|
branches: [ "main" ]
|
|
|
|
env:
|
|
# Use docker.io for Docker Hub if empty
|
|
REGISTRY: ghcr.io
|
|
# github.repository as <account>/<repo>
|
|
IMAGE_NAME: ${{ github.repository }}
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
# Set up QEMU for multi-platform builds
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
|
|
|
|
# Set up BuildKit Docker container builder to be able to build
|
|
# multi-platform images and export cache
|
|
# https://github.com/docker/setup-buildx-action
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
|
|
|
|
# Login against a Docker registry except on PR
|
|
# https://github.com/docker/login-action
|
|
- name: Log into registry ${{ env.REGISTRY }}
|
|
if: github.event_name != 'pull_request'
|
|
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# Extract metadata (tags, labels) for Docker
|
|
# https://github.com/docker/metadata-action
|
|
- name: Extract Docker metadata
|
|
id: meta
|
|
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
|
|
with:
|
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
|
# latest=auto also moves :latest onto any pushed vX.Y.Z tag, so the
|
|
# tag people actually pull tracks the newest release as well as main.
|
|
flavor: |
|
|
latest=auto
|
|
tags: |
|
|
type=raw,value=latest,enable={{is_default_branch}}
|
|
type=ref,event=branch
|
|
type=ref,event=pr
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=semver,pattern={{major}}
|
|
|
|
# Build and push Docker image with Buildx (don't push on PR)
|
|
# https://github.com/docker/build-push-action
|
|
- name: Build and push Docker image
|
|
id: build-and-push
|
|
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64,linux/arm64,linux/arm/v7
|
|
push: ${{ github.event_name != 'pull_request' }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|