chore: import upstream snapshot with attribution
This commit is contained in:
wehub-resource-sync
@@ -0,0 +1,153 @@
|
||||
name: Build & Push Docker Image
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
tag:
|
||||
description: "Image tag to publish under (e.g. 3.5.0 to rebuild a released version, or 3.5.0-fix.1 for a side-by-side). Leave blank for dev-<run_id>."
|
||||
required: false
|
||||
type: string
|
||||
push_latest:
|
||||
description: "Also tag the resulting image as `latest` (use when rebuilding a stable release)."
|
||||
required: false
|
||||
type: boolean
|
||||
default: false
|
||||
push:
|
||||
tags:
|
||||
- "v*"
|
||||
|
||||
env:
|
||||
REGISTRY: ghcr.io
|
||||
IMAGE_NAME: ${{ github.repository }}
|
||||
# Docker Hub mirror — same image, different registry. Credentials
|
||||
# come from the DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets (token,
|
||||
# not account password). If either secret is empty, the Docker Hub
|
||||
# login step is skipped and only GHCR gets pushed.
|
||||
DOCKERHUB_IMAGE: caorushizi/mediago
|
||||
|
||||
jobs:
|
||||
docker:
|
||||
name: Build and push multi-arch image
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v4
|
||||
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
# GitHub Actions forbids `secrets.*` inside `if:` expressions
|
||||
# directly — it fails with `Unrecognized named-value: 'secrets'`.
|
||||
# The blessed workaround: pull the secret through `env:` (which
|
||||
# IS allowed) inside a single check step, write a boolean to
|
||||
# step outputs, and have every downstream step guard on the
|
||||
# output instead of the raw secret.
|
||||
- name: Detect Docker Hub credentials
|
||||
id: dockerhub
|
||||
env:
|
||||
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
run: |
|
||||
if [ -n "$DOCKERHUB_USERNAME" ] && [ -n "$DOCKERHUB_TOKEN" ]; then
|
||||
echo "enabled=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "enabled=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
# Only log in (and later push) to Docker Hub when both secrets are
|
||||
# configured. Lets forks / trial runs without Docker Hub
|
||||
# credentials still build-and-push to GHCR.
|
||||
- name: Login to Docker Hub
|
||||
if: steps.dockerhub.outputs.enabled == 'true'
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
|
||||
# Compose the list of target images based on which registries we
|
||||
# actually have credentials for. Without this, metadata-action
|
||||
# would always generate Docker Hub tags and build-push-action
|
||||
# would then fail with 401 on forks that haven't set the secrets.
|
||||
- name: Resolve image targets
|
||||
id: targets
|
||||
run: |
|
||||
{
|
||||
echo "images<<EOF"
|
||||
echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
|
||||
if [ "${{ steps.dockerhub.outputs.enabled }}" = "true" ]; then
|
||||
echo "${{ env.DOCKERHUB_IMAGE }}"
|
||||
fi
|
||||
echo "EOF"
|
||||
} >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Docker meta
|
||||
id: meta
|
||||
uses: docker/metadata-action@v6
|
||||
with:
|
||||
images: ${{ steps.targets.outputs.images }}
|
||||
tags: |
|
||||
# 1. Manual rebuild with an explicit tag (e.g. `3.5.0`, `3.5.0-fix.1`)
|
||||
type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}
|
||||
# 2. Tag push: v1.0.0 → 1.0.0
|
||||
type=semver,pattern={{version}}
|
||||
# 3. `latest`: on stable semver tag pushes, or when the manual
|
||||
# rebuild explicitly asks for it
|
||||
type=raw,value=latest,enable=${{ (startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, 'beta')) || inputs.push_latest }}
|
||||
# 4. Fallback for manual triggers with no custom tag
|
||||
type=raw,value=dev-${{ github.run_id }},enable=${{ !startsWith(github.ref, 'refs/tags/') && inputs.tag == '' }}
|
||||
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v7
|
||||
with:
|
||||
context: .
|
||||
platforms: linux/amd64,linux/arm64
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
# `metadata-action` already emits the standard OCI labels
|
||||
# (image.title / description / source / licenses / version /
|
||||
# revision / created). `revision` uses github.sha, so two
|
||||
# builds that re-use a tag are distinguishable via
|
||||
# `docker inspect`.
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
|
||||
- name: Build Summary
|
||||
run: |
|
||||
echo "### 🎉 Docker Image Published" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "**Registries:**" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
|
||||
if [ "${{ steps.dockerhub.outputs.enabled }}" = "true" ]; then
|
||||
echo "- \`docker.io/${{ env.DOCKERHUB_IMAGE }}\`" >> $GITHUB_STEP_SUMMARY
|
||||
fi
|
||||
echo "**Platforms:** linux/amd64, linux/arm64" >> $GITHUB_STEP_SUMMARY
|
||||
echo "**Version:** \`${{ steps.meta.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
|
||||
echo "**Commit:** \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "**Tags:**" >> $GITHUB_STEP_SUMMARY
|
||||
echo "${{ steps.meta.outputs.tags }}" | while read tag; do
|
||||
echo "- \`${tag}\`" >> $GITHUB_STEP_SUMMARY
|
||||
done
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "**Pull:**" >> $GITHUB_STEP_SUMMARY
|
||||
echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
|
||||
echo "docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}" >> $GITHUB_STEP_SUMMARY
|
||||
if [ "${{ steps.dockerhub.outputs.enabled }}" = "true" ]; then
|
||||
echo "docker pull ${{ env.DOCKERHUB_IMAGE }}:${{ steps.meta.outputs.version }}" >> $GITHUB_STEP_SUMMARY
|
||||
fi
|
||||
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
|
||||
Reference in New Issue
Block a user