Skip to content

Commit 0347ec6

Browse files
Copilotneilime
Copilot
and
neilime
committed
Add container registry credentials support via secrets
Co-authored-by: neilime <[email protected]>
1 parent 993f97e commit 0347ec6

File tree

2 files changed

+79
-29
lines changed

2 files changed

+79
-29
lines changed

‎.github/workflows/continuous-integration.md‎

Lines changed: 35 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -207,26 +207,51 @@ container: |
207207
"env": {
208208
"NODE_ENV": "production"
209209
},
210-
"ports": [8080],
211-
"volumes": ["/tmp:/tmp"],
212210
"options": "--cpus 2"
213211
}
214212
```
215213

216-
All properties from [GitHub's container specification](https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/run-jobs-in-a-container) are supported except `credentials` (use secrets instead).
214+
**Supported properties:**
215+
216+
- `image` (string, required) - Container image name
217+
- `env` (object) - Environment variables
218+
- `options` (string) - Additional Docker options
219+
220+
**Note:** `ports` and `volumes` are not currently supported due to GitHub Actions workflow syntax limitations.
221+
222+
#### Container Registry Credentials
223+
224+
For private container images, use the `container-registry-username` and `container-registry-password` secrets:
225+
226+
```yaml
227+
jobs:
228+
continuous-integration:
229+
uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@main
230+
secrets:
231+
container-registry-username: ${{ secrets.REGISTRY_USERNAME }}
232+
container-registry-password: ${{ secrets.REGISTRY_PASSWORD }}
233+
with:
234+
container: "ghcr.io/myorg/my-private-image:latest"
235+
```
236+
237+
See [GitHub's container specification](https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/run-jobs-in-a-container) for more details.
217238

218239
When specified, steps will execute inside this container instead of checking out code. The container should have the project code and dependencies pre-installed.
219240

220241
<!-- secrets:start -->
221242

222243
## Secrets
223244

224-
| **Secret** | **Description** | **Required** |
225-
| ------------------- | -------------------------------------------------------------------------------------------------------------------- | ------------ |
226-
| **`build-secrets`** | Secrets to be used during the build step. | **false** |
227-
| | Must be a multi-line env formatted string. | |
228-
| | Example: | |
229-
| | <!-- textlint-disable --><pre lang="txt">SECRET_EXAMPLE=$\{{ secrets.SECRET_EXAMPLE }}</pre><!-- textlint-enable --> | |
245+
| **Secret** | **Description** | **Required** |
246+
| --------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ------------ |
247+
| **`build-secrets`** | Secrets to be used during the build step. | **false** |
248+
| | Must be a multi-line env formatted string. | |
249+
| | Example: | |
250+
| | <!-- textlint-disable --><pre lang="txt">SECRET_EXAMPLE=$\{{ secrets.SECRET_EXAMPLE }}</pre><!-- textlint-enable --> | |
251+
| **`container-registry-username`** | Username for authenticating to the container registry. | **false** |
252+
| | Required when using private container images. | |
253+
| **`container-registry-password`** | Password or token for authenticating to the container registry. | **false** |
254+
| | Required when using private container images. | |
230255

231256
<!-- secrets:end -->
232257

@@ -342,7 +367,7 @@ jobs:
342367

343368
### Continuous Integration with Advanced Container Options
344369

345-
This example shows how to use advanced container options like environment variables, ports, volumes, and additional Docker options.
370+
This example shows how to use advanced container options like environment variables and additional Docker options.
346371

347372
```yaml
348373
name: Continuous Integration - Advanced Container Options
@@ -366,8 +391,6 @@ jobs:
366391
"NODE_ENV": "production",
367392
"CI": "true"
368393
},
369-
"ports": [3000, 8080],
370-
"volumes": ["/tmp:/tmp", "/cache:/cache"],
371394
"options": "--cpus 2 --memory 4g"
372395
}
373396
# When using container mode, code-ql and dependency-review are typically disabled

‎.github/workflows/continuous-integration.yml‎

Lines changed: 44 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -99,13 +99,16 @@ on:
9999
"env": {
100100
"NODE_ENV": "production"
101101
},
102-
"ports": [8080],
103-
"volumes": ["/tmp:/tmp"],
104102
"options": "--cpus 2"
105103
}
106104
```
107105
108-
All properties from GitHub's container specification are supported except credentials (use secrets instead).
106+
Supported properties: image (required), env (object), options (string).
107+
Note: ports and volumes are not currently supported due to GitHub Actions limitations.
108+
109+
For container registry credentials (username/password), use the container-registry-username
110+
and container-registry-password secrets.
111+
109112
See https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/run-jobs-in-a-container
110113
111114
When specified, steps will execute inside this container instead of checking out code.
@@ -123,6 +126,16 @@ on:
123126
SECRET_EXAMPLE=$\{{ secrets.SECRET_EXAMPLE }}
124127
```
125128
required: false
129+
container-registry-username:
130+
description: |
131+
Username for authenticating to the container registry.
132+
Required when using private container images.
133+
required: false
134+
container-registry-password:
135+
description: |
136+
Password or token for authenticating to the container registry.
137+
Required when using private container images.
138+
required: false
126139
outputs:
127140
build-artifact-id:
128141
description: "ID of the build artifact) uploaded during the build step."
@@ -167,16 +180,6 @@ jobs:
167180
config.env = container.env;
168181
}
169182
170-
// Add ports if provided
171-
if (container.ports && container.ports.length > 0) {
172-
config.ports = container.ports;
173-
}
174-
175-
// Add volumes if provided
176-
if (container.volumes && container.volumes.length > 0) {
177-
config.volumes = container.volumes;
178-
}
179-
180183
// Merge user options with default --user root:root
181184
if (container.options) {
182185
config.options = `${config.options} ${container.options}`;
@@ -218,7 +221,13 @@ jobs:
218221
setup:
219222
name: ⚙️ Setup
220223
runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
221-
container: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config) || null }}
224+
container:
225+
image: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).image || null }}
226+
env: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).env || null }}
227+
options: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).options || null }}
228+
credentials:
229+
username: ${{ secrets.container-registry-username }}
230+
password: ${{ secrets.container-registry-password }}
222231
needs: parse-container
223232
if: ${{ always() && !cancelled() && !failure() }}
224233
permissions:
@@ -336,7 +345,13 @@ jobs:
336345
name: 👕 Lint
337346
if: inputs.checks == true && inputs.lint && always() && !cancelled() && !failure()
338347
runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
339-
container: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config) || null }}
348+
container:
349+
image: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).image || null }}
350+
env: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).env || null }}
351+
options: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).options || null }}
352+
credentials:
353+
username: ${{ secrets.container-registry-username }}
354+
password: ${{ secrets.container-registry-password }}
340355
needs:
341356
- parse-container
342357
- setup
@@ -392,7 +407,13 @@ jobs:
392407
if: inputs.checks == true && always() && !cancelled() && !failure()
393408
runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
394409
# jscpd:ignore-start
395-
container: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config) || null }}
410+
container:
411+
image: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).image || null }}
412+
env: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).env || null }}
413+
options: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).options || null }}
414+
credentials:
415+
username: ${{ secrets.container-registry-username }}
416+
password: ${{ secrets.container-registry-password }}
396417
needs:
397418
- parse-container
398419
- setup
@@ -438,7 +459,13 @@ jobs:
438459
name: 🧪 Test
439460
if: inputs.checks == true && inputs.test && always() && !cancelled() && !failure()
440461
runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
441-
container: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config) || null }}
462+
container:
463+
image: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).image || null }}
464+
env: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).env || null }}
465+
options: ${{ inputs.container != '' && fromJSON(needs.parse-container.outputs.config).options || null }}
466+
credentials:
467+
username: ${{ secrets.container-registry-username }}
468+
password: ${{ secrets.container-registry-password }}
442469
needs:
443470
- parse-container
444471
- setup

0 commit comments

Comments
 (0)