v0.2.1: guard the installer's system-PATH write #32
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Generated by stoatworks-unraid/scripts/gen-docker.mjs from fleet.json. | |
| # Repo: srt-router. Edit fleet.json and regenerate — direct edits are overwritten. | |
| # | |
| # Builds the container image(s) for this repo and publishes them to GHCR. | |
| # | |
| # This is the only real verification these images get: there is no container | |
| # runtime on the machine they were authored on, so "it builds" is a claim this | |
| # workflow either proves or disproves. Treat a red run as the image not existing. | |
| name: docker | |
| on: | |
| push: | |
| branches: [main, master] | |
| tags: ['v*'] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| packages: write | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - image: srt-router | |
| dockerfile: Dockerfile | |
| context: . | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: docker/setup-buildx-action@v4 | |
| # Only log in for pushes. Pull requests from forks have no package write | |
| # token, and a login step that fails there turns every PR red for a | |
| # reason that has nothing to do with the change. | |
| - name: Log in to GHCR | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: ${{ matrix.context }} | |
| file: ${{ matrix.dockerfile }} | |
| # Pull requests build but do not publish, so a broken Dockerfile is | |
| # caught without putting an unreviewed image on the registry. | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: | | |
| ghcr.io/stoatworks-labs/${{ matrix.image }}:latest | |
| ghcr.io/stoatworks-labs/${{ matrix.image }}:${{ github.sha }} | |
| # Links the GHCR package to this repo. Where the image name already | |
| # matches the repo name GitHub infers this and the package inherits | |
| # the repo's public visibility; where it does not — the website | |
| # publishes stoatworks-website from stoatworks-labs.github.io — the | |
| # package is left unlinked and stays PRIVATE, so an anonymous | |
| # docker pull gets a 403 while every other image in the fleet works. | |
| labels: | | |
| org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} | |
| cache-from: type=gha,scope=${{ matrix.image }} | |
| cache-to: type=gha,mode=max,scope=${{ matrix.image }} |