Skip to content

Commit 74718c9

Browse files
RadCod3RadCod3
authored
Merge pull request #50 from RadCod3/fix/42-docker-publish-workflow
fix: ensure 'latest' Docker tag points only to releases
2 parents fc7f6fc + aaddd1c commit 74718c9

File tree

3 files changed

+110
-106
lines changed

3 files changed

+110
-106
lines changed

‎.github/workflows/docker-publish.yml‎

Lines changed: 104 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ on:
55
branches:
66
- main
77
tags:
8-
- 'v*'
8+
- "v*"
99

1010
env:
1111
REGISTRY: ghcr.io
@@ -23,103 +23,106 @@ jobs:
2323
image-version: ${{ steps.meta.outputs.version }}
2424

2525
steps:
26-
- name: Checkout repository
27-
uses: actions/checkout@v4
28-
29-
- name: Validate version tag
30-
if: startsWith(github.ref, 'refs/tags/v')
31-
run: |
32-
# Extract version from tag (e.g., v0.1.0 -> 0.1.0)
33-
TAG_VERSION=${GITHUB_REF#refs/tags/v}
34-
echo "Tag version: $TAG_VERSION"
35-
36-
# Extract version from pyproject.toml
37-
PYPROJECT_VERSION=$(grep '^version = ' pyproject.toml | cut -d'"' -f2)
38-
echo "pyproject.toml version: $PYPROJECT_VERSION"
39-
40-
# Compare versions
41-
if [ "$TAG_VERSION" != "$PYPROJECT_VERSION" ]; then
42-
echo "::error::Version mismatch! Tag version ($TAG_VERSION) doesn't match pyproject.toml version ($PYPROJECT_VERSION)"
43-
exit 1
44-
fi
45-
46-
echo "::notice::Version validation passed: $TAG_VERSION"
47-
48-
- name: Set up Docker Buildx
49-
uses: docker/setup-buildx-action@v3
50-
51-
- name: Log in to Container Registry
52-
if: github.event_name != 'pull_request'
53-
uses: docker/login-action@v3
54-
with:
55-
registry: ${{ env.REGISTRY }}
56-
username: ${{ github.actor }}
57-
password: ${{ secrets.GITHUB_TOKEN }}
58-
59-
- name: Extract metadata (tags, labels) for Docker
60-
id: meta
61-
uses: docker/metadata-action@v5
62-
with:
63-
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
64-
tags: |
65-
type=ref,event=branch
66-
type=ref,event=pr
67-
type=semver,pattern={{version}}
68-
type=semver,pattern={{major}}.{{minor}}
69-
type=semver,pattern={{major}}
70-
type=raw,value=latest,enable={{is_default_branch}}
71-
72-
- name: Build and push Docker image
73-
id: build
74-
uses: docker/build-push-action@v5
75-
with:
76-
context: .
77-
file: ./Dockerfile
78-
platforms: linux/amd64,linux/arm64
79-
push: ${{ github.event_name != 'pull_request' }}
80-
tags: ${{ steps.meta.outputs.tags }}
81-
labels: ${{ steps.meta.outputs.labels }}
82-
cache-from: type=gha
83-
cache-to: type=gha,mode=max
84-
build-args: |
85-
BUILDKIT_INLINE_CACHE=1
86-
87-
- name: Determine scan tag
88-
id: scan-tag
89-
if: github.event_name != 'pull_request'
90-
run: |
91-
# Lowercase the image name (Docker registries require lowercase)
92-
IMAGE_NAME_LOWER=$(echo "${{ env.IMAGE_NAME }}" | tr '[:upper:]' '[:lower:]')
93-
94-
# Use the version tag if this is a tag push, otherwise use latest
95-
if [[ "${{ github.ref }}" == refs/tags/* ]]; then
96-
TAG="${GITHUB_REF#refs/tags/}"
97-
SCAN_TAG="${{ env.REGISTRY }}/${IMAGE_NAME_LOWER}:${TAG#v}"
98-
else
99-
SCAN_TAG="${{ env.REGISTRY }}/${IMAGE_NAME_LOWER}:latest"
100-
fi
101-
echo "tag=$SCAN_TAG" >> $GITHUB_OUTPUT
102-
echo "Scanning image: $SCAN_TAG"
103-
104-
- name: Run security scan on image
105-
if: github.event_name != 'pull_request'
106-
uses: aquasecurity/trivy-action@master
107-
with:
108-
image-ref: ${{ steps.scan-tag.outputs.tag }}
109-
format: 'sarif'
110-
output: 'trivy-results.sarif'
111-
112-
- name: Upload Trivy scan results to GitHub Security tab
113-
if: github.event_name != 'pull_request'
114-
uses: github/codeql-action/upload-sarif@v3
115-
with:
116-
sarif_file: 'trivy-results.sarif'
117-
118-
- name: Generate build summary
119-
if: github.event_name != 'pull_request'
120-
run: |
121-
echo "## Docker Build Summary" >> $GITHUB_STEP_SUMMARY
122-
echo "- **Image**: \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
123-
echo "- **Tags**: \`${{ steps.meta.outputs.tags }}\`" >> $GITHUB_STEP_SUMMARY
124-
echo "- **Platforms**: \`linux/amd64, linux/arm64\`" >> $GITHUB_STEP_SUMMARY
125-
echo "- **Registry**: \`${{ env.REGISTRY }}\`" >> $GITHUB_STEP_SUMMARY
26+
- name: Checkout repository
27+
uses: actions/checkout@v4
28+
29+
- name: Validate version tag
30+
if: startsWith(github.ref, 'refs/tags/v')
31+
run: |
32+
# Extract version from tag (e.g., v0.1.0 -> 0.1.0)
33+
TAG_VERSION=${GITHUB_REF#refs/tags/v}
34+
echo "Tag version: $TAG_VERSION"
35+
36+
# Extract version from pyproject.toml
37+
PYPROJECT_VERSION=$(grep '^version = ' pyproject.toml | cut -d'"' -f2)
38+
echo "pyproject.toml version: $PYPROJECT_VERSION"
39+
40+
# Compare versions
41+
if [ "$TAG_VERSION" != "$PYPROJECT_VERSION" ]; then
42+
echo "::error::Version mismatch! Tag version ($TAG_VERSION) doesn't match pyproject.toml version ($PYPROJECT_VERSION)"
43+
exit 1
44+
fi
45+
46+
echo "::notice::Version validation passed: $TAG_VERSION"
47+
48+
- name: Set up Docker Buildx
49+
uses: docker/setup-buildx-action@v3
50+
51+
- name: Log in to Container Registry
52+
if: github.event_name != 'pull_request'
53+
uses: docker/login-action@v3
54+
with:
55+
registry: ${{ env.REGISTRY }}
56+
username: ${{ github.actor }}
57+
password: ${{ secrets.GITHUB_TOKEN }}
58+
59+
- name: Extract metadata (tags, labels) for Docker
60+
id: meta
61+
uses: docker/metadata-action@v5
62+
with:
63+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
64+
flavor: |
65+
latest=false
66+
tags: |
67+
type=ref,event=branch
68+
type=ref,event=pr
69+
type=semver,pattern={{version}}
70+
type=semver,pattern={{major}}.{{minor}}
71+
type=semver,pattern={{major}}
72+
type=raw,value=edge,enable={{is_default_branch}}
73+
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
74+
75+
- name: Build and push Docker image
76+
id: build
77+
uses: docker/build-push-action@v5
78+
with:
79+
context: .
80+
file: ./Dockerfile
81+
platforms: linux/amd64,linux/arm64
82+
push: ${{ github.event_name != 'pull_request' }}
83+
tags: ${{ steps.meta.outputs.tags }}
84+
labels: ${{ steps.meta.outputs.labels }}
85+
cache-from: type=gha
86+
cache-to: type=gha,mode=max
87+
build-args: |
88+
BUILDKIT_INLINE_CACHE=1
89+
90+
- name: Determine scan tag
91+
id: scan-tag
92+
if: github.event_name != 'pull_request'
93+
run: |
94+
# Lowercase the image name (Docker registries require lowercase)
95+
IMAGE_NAME_LOWER=$(echo "${{ env.IMAGE_NAME }}" | tr '[:upper:]' '[:lower:]')
96+
97+
# Use the version tag if this is a tag push, otherwise use edge
98+
if [[ "${{ github.ref }}" == refs/tags/* ]]; then
99+
TAG="${GITHUB_REF#refs/tags/}"
100+
SCAN_TAG="${{ env.REGISTRY }}/${IMAGE_NAME_LOWER}:${TAG#v}"
101+
else
102+
SCAN_TAG="${{ env.REGISTRY }}/${IMAGE_NAME_LOWER}:edge"
103+
fi
104+
echo "tag=$SCAN_TAG" >> $GITHUB_OUTPUT
105+
echo "Scanning image: $SCAN_TAG"
106+
107+
- name: Run security scan on image
108+
if: github.event_name != 'pull_request'
109+
uses: aquasecurity/trivy-action@master
110+
with:
111+
image-ref: ${{ steps.scan-tag.outputs.tag }}
112+
format: "sarif"
113+
output: "trivy-results.sarif"
114+
115+
- name: Upload Trivy scan results to GitHub Security tab
116+
if: github.event_name != 'pull_request'
117+
uses: github/codeql-action/upload-sarif@v4
118+
with:
119+
sarif_file: "trivy-results.sarif"
120+
121+
- name: Generate build summary
122+
if: github.event_name != 'pull_request'
123+
run: |
124+
echo "## Docker Build Summary" >> $GITHUB_STEP_SUMMARY
125+
echo "- **Image**: \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
126+
echo "- **Tags**: \`${{ steps.meta.outputs.tags }}\`" >> $GITHUB_STEP_SUMMARY
127+
echo "- **Platforms**: \`linux/amd64, linux/arm64\`" >> $GITHUB_STEP_SUMMARY
128+
echo "- **Registry**: \`${{ env.REGISTRY }}\`" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/release.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@ name: Create Release
33
on:
44
push:
55
tags:
6-
- 'v*'
6+
- "v*"
77
workflow_dispatch:
88
inputs:
99
tag:
10-
description: 'Tag to create release for (e.g., v0.1.0)'
10+
description: "Tag to create release for (e.g., v0.1.0)"
1111
required: true
1212
type: string
1313

@@ -26,7 +26,7 @@ jobs:
2626
- name: Checkout code
2727
uses: actions/checkout@v4
2828
with:
29-
fetch-depth: 0 # Fetch all history for changelog generation
29+
fetch-depth: 0 # Fetch all history for changelog generation
3030

3131
- name: Get version from tag
3232
id: get-version
@@ -83,7 +83,7 @@ jobs:
8383
uses: lewagon/[email protected]
8484
with:
8585
ref: ${{ github.ref }}
86-
check-name: 'build'
86+
check-name: "build"
8787
repo-token: ${{ secrets.GITHUB_TOKEN }}
8888
wait-interval: 10
8989
allowed-conclusions: success

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -315,7 +315,8 @@ LamPyrid provides production-ready Docker images published to GitHub Container R
315315

316316
### Available Images
317317

318-
- **Latest**: `ghcr.io/radcod3/lampyrid:latest` (main branch)
318+
- **Latest Stable**: `ghcr.io/radcod3/lampyrid:latest` (latest release - recommended for production)
319+
- **Development**: `ghcr.io/radcod3/lampyrid:edge` (main branch - latest features, may be unstable)
319320
- **Versioned**: `ghcr.io/radcod3/lampyrid:0.2.0`, `ghcr.io/radcod3/lampyrid:0.2`, `ghcr.io/radcod3/lampyrid:0`
320321
- **Platforms**: linux/amd64, linux/arm64
321322

0 commit comments

Comments
 (0)