feat: publish Docker images to GHCR #4580
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| release: | |
| types: [published] | |
| env: | |
| platforms: "linux/386,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/amd64,linux/ppc64le,linux/riscv64,linux/s390x" | |
| permissions: | |
| contents: read | |
| jobs: | |
| docker: | |
| name: Docker image | |
| runs-on: ubuntu-latest | |
| concurrency: | |
| group: ${{ github.workflow }}-build-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| id-token: write # for cosign keyless signing via GitHub OIDC | |
| contents: read | |
| packages: write # for pushing images and signatures to GitHub Container Registry | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: docker-build-publish-sign | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🤖 Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - name: 🏗️ Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| with: | |
| version: latest | |
| cache-binary: false | |
| - name: 🔑 Log in to Docker | |
| uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 | |
| if: ${{ github.event_name != 'pull_request' }} | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: 🔑 Log in to GitHub Container Registry | |
| uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 | |
| if: ${{ github.event_name != 'pull_request' }} | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: 🏷️ Fetch git tags for `git describe` | |
| run: "git fetch --force --prune --unshallow --tags" | |
| - name: 📝 Run `git describe` and save its output | |
| run: echo "GIT_DESCRIBE=$(git describe --tags --always --long)" >> "$GITHUB_OUTPUT" | |
| id: git-describe | |
| - name: 📝 Calculate metadata for minimal Docker images | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| id: meta | |
| with: | |
| images: | | |
| ${{ github.repository }} | |
| ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}} | |
| type=edge | |
| annotations: | | |
| io.artifacthub.package.license=Apache-2.0 WITH LLVM-exception | |
| io.artifacthub.package.readme-url=https://raw.githubusercontent.com/favonia/cloudflare-ddns/main/build/SUMMARY.markdown | |
| io.artifacthub.package.maintainers=[{"name":"favonia","email":"favonia@email.com"}] | |
| env: | |
| DOCKER_METADATA_ANNOTATIONS_LEVELS: index | |
| - name: 🚀 Build and deploy minimal Docker images | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| id: build | |
| with: | |
| target: "minimal" | |
| push: ${{ github.event_name != 'pull_request' }} | |
| build-args: | | |
| ${{ format('GIT_DESCRIBE={0}', steps.git-describe.outputs.GIT_DESCRIBE) }} | |
| platforms: ${{ env.platforms }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| annotations: ${{ steps.meta.outputs.annotations }} | |
| provenance: "mode=max" | |
| - name: 🔎 Verify minimal image mirrors | |
| if: ${{ github.event_name != 'pull_request' }} | |
| run: | | |
| docker buildx imagetools inspect "docker.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}" | |
| docker buildx imagetools inspect "ghcr.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}" | |
| env: | |
| STEPS_BUILD_OUTPUTS_DIGEST: ${{ steps.build.outputs.digest }} | |
| - name: ✍️ Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: ✍️ Sign the minimal Docker images | |
| if: ${{ github.event_name == 'release' }} | |
| run: | | |
| cosign sign --recursive --yes \ | |
| "docker.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}" \ | |
| "ghcr.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}" | |
| env: | |
| STEPS_BUILD_OUTPUTS_DIGEST: ${{ steps.build.outputs.digest }} | |
| - name: 🔎 Verify the signed minimal Docker images | |
| if: ${{ github.event_name == 'release' }} | |
| run: | | |
| cosign verify \ | |
| --certificate-identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/build.yaml@${GITHUB_REF}" \ | |
| --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ | |
| "docker.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}" \ | |
| "ghcr.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}" | |
| env: | |
| STEPS_BUILD_OUTPUTS_DIGEST: ${{ steps.build.outputs.digest }} | |
| - name: 📝 Calculate metadata for Docker images with alpine | |
| if: ${{ github.event_name != 'release' }} | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| id: meta-alpine | |
| with: | |
| images: | | |
| ${{ github.repository }} | |
| ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=edge,suffix=-alpine | |
| annotations: | | |
| io.artifacthub.package.license=Apache-2.0 WITH LLVM-exception | |
| io.artifacthub.package.readme-url=https://raw.githubusercontent.com/favonia/cloudflare-ddns/main/build/SUMMARY.markdown | |
| io.artifacthub.package.maintainers=[{"name":"favonia","email":"favonia@email.com"}] | |
| env: | |
| DOCKER_METADATA_ANNOTATIONS_LEVELS: index | |
| - name: 🚀 Build and deploy Docker images with alpine | |
| if: ${{ github.event_name != 'release' }} | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| id: build-alpine | |
| with: | |
| target: "alpine" | |
| push: ${{ github.event_name != 'pull_request' }} | |
| build-args: | | |
| ${{ format('GIT_DESCRIBE={0}', steps.git-describe.outputs.GIT_DESCRIBE) }} | |
| platforms: ${{ env.platforms }} | |
| tags: ${{ steps.meta-alpine.outputs.tags }} | |
| labels: ${{ steps.meta-alpine.outputs.labels }} | |
| annotations: ${{ steps.meta-alpine.outputs.annotations }} | |
| provenance: "mode=max" | |
| - name: 🔎 Verify alpine image mirrors | |
| if: ${{ github.event_name != 'pull_request' && github.event_name != 'release' }} | |
| run: | | |
| docker buildx imagetools inspect "docker.io/favonia/cloudflare-ddns@${STEPS_BUILD_ALPINE_OUTPUTS_DIGEST}" | |
| docker buildx imagetools inspect "ghcr.io/favonia/cloudflare-ddns@${STEPS_BUILD_ALPINE_OUTPUTS_DIGEST}" | |
| env: | |
| STEPS_BUILD_ALPINE_OUTPUTS_DIGEST: ${{ steps.build-alpine.outputs.digest }} |