actions/.github/workflows/release-docker-ghcr.yml at 9d39c5c353e93bfe4a2ad0c8ae9fdfe43acff543 · init4tech/actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
name: Release Docker to GHCR
on:
  workflow_call:

permissions:
    contents: write
    packages: write

env:
  REGISTRY_IMAGE: ghcr.io/${{ github.repository }}

jobs:
    release_docker:
        runs-on: ${{ matrix.runner }}
        permissions:
            packages: write
            contents: write
        strategy:
            fail-fast: false
            matrix:
                include:
                    - runner: ubuntu-latest
                      target: x86_64-unknown-linux-gnu
                      os: linux
                      arch: x86_64
                    - runner: ubuntu-24.04-arm
                      target: aarch64-unknown-linux-gnu
                      os: linux
                      arch: arm64
        steps:
        - name: Prepare
          run: |
            platform=${{ matrix.os }}/${{ matrix.arch }}
            echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
        - uses: actions/checkout@v6
        - name: Docker meta
          id: meta
          uses: docker/metadata-action@v5
          with:
            images: ${{ env.REGISTRY_IMAGE }}
            tags: |
              type=ref,event=branch
              type=ref,event=pr
              type=semver,pattern={{version}}
              type=semver,pattern={{major}}.{{minor}}
              type=sha
              type=raw,value=latest,enable=true
        - name: Set up Docker Buildx
          uses: docker/setup-buildx-action@v3
        - name: Login to GitHub Container Registry
          uses: docker/login-action@v3
          with:
            registry: ghcr.io
            username: ${{ github.actor }}
            password: ${{ secrets.GITHUB_TOKEN }}
        - name: Build and push
          id: push
          uses: docker/build-push-action@v6
          with:
            tags: ${{ steps.meta.outputs.tags }}
            annotations: ${{ steps.meta.outputs.annotations }}
            labels: ${{ steps.meta.outputs.labels }}
            platforms: ${{ matrix.os }}/${{ matrix.arch }}
            outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
            cache-from: type=gha
            cache-to: type=gha

        - name: Export digest
          run: |
            mkdir -p /tmp/digests
            digest="${{ steps.build.outputs.digest }}"
            touch "/tmp/digests/${digest#sha256:}"
        - name: Upload digest
          uses: actions/upload-artifact@v6
          with:
            name: digests-${{ env.PLATFORM_PAIR }}
            path: /tmp/digests/*
            if-no-files-found: error
            retention-days: 1
        - name: Generate artifact attestation
          uses: actions/attest-build-provenance@v4
          with:
            subject-name: ${{ env.REGISTRY_IMAGE }}
            subject-digest: ${{ steps.push.outputs.digest }}
            push-to-registry: true

    merge:
      runs-on: ubuntu-latest
      needs:
        - release_docker
      steps:
        - name: Download digests
          uses: actions/download-artifact@v7
          with:
            path: /tmp/digests
            pattern: digests-*
            merge-multiple: true
        - name: Set up Docker Buildx
          uses: docker/setup-buildx-action@v3
        - name: Docker meta
          id: meta
          uses: docker/metadata-action@v5
          with:
            images: ${{ env.REGISTRY_IMAGE }}
        - name: Login to Docker Hub
          uses: docker/login-action@v3
          with:
            username: ${{ secrets.DOCKERHUB_USERNAME }}
            password: ${{ secrets.DOCKERHUB_TOKEN }}
        - name: Create manifest list and push
          working-directory: /tmp/digests
          run: |
            docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
              $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
        - name: Inspect image
          run: |
            docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}