Skip to content

Commit 2f21f19

Browse files
mceachenmceachen
committed
refactor(docker-build): switch to name ARM runners. Update to latest action versions. Added permissions and oci-mediatypes. Switched to tags parameter.
1 parent 1c99078 commit 2f21f19

File tree

1 file changed

+120
-28
lines changed

1 file changed

+120
-28
lines changed

‎.github/workflows/docker-build.yml‎

Lines changed: 120 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -2,65 +2,157 @@ name: Build Docker Images
22

33
on: push
44

5+
env:
6+
DOCKERHUB_IMAGE: photostructure/base-tools-debian
7+
GHCR_IMAGE: ghcr.io/photostructure/base-tools-debian
8+
59
jobs:
610
build:
7-
name: Build Docker Images
8-
runs-on: ubuntu-latest
11+
name: Build ${{ matrix.platform }}
12+
permissions:
13+
contents: read
14+
packages: write
15+
strategy:
16+
fail-fast: false
17+
matrix:
18+
include:
19+
- platform: linux/amd64
20+
runner: ubuntu-latest
21+
- platform: linux/arm64
22+
runner: ubuntu-24.04-arm
23+
runs-on: ${{ matrix.runner }}
924

1025
steps:
11-
- name: Checkout
12-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
26+
- name: Prepare
27+
run: |
28+
platform=${{ matrix.platform }}
29+
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
1330
14-
- name: Set up QEMU
15-
id: qemu
16-
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
17-
with:
18-
platforms: arm64
31+
- name: Checkout
32+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
1933

2034
- name: Set up Buildx
21-
id: buildx
22-
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
35+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
2336

2437
- name: Docker meta
2538
id: meta
26-
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804
39+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
2740
with:
41+
images: |
42+
${{ env.DOCKERHUB_IMAGE }}
43+
${{ env.GHCR_IMAGE }}
2844
labels: |
2945
org.opencontainers.image.title="PhotoStructure base tools"
3046
org.opencontainers.image.description="This image is used to compile native dependencies used by the PhotoStructure for Docker image"
3147
org.opencontainers.image.documentation="https://photostructure.com/server/photostructure-for-docker/"
32-
images: |
33-
photostructure/base-tools-debian
34-
ghcr.io/photostructure/base-tools-debian
35-
tags: |
36-
# minimal git SHA tag
37-
type=sha
38-
type=ref,event=branch
39-
type=ref,event=tag
40-
type=raw,value=latest,enable={{is_default_branch}}
4148
4249
- name: Log in to Docker Hub
4350
if: github.event_name != 'pull_request'
44-
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
51+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
4552
with:
4653
registry: docker.io
4754
username: ${{ secrets.DOCKERHUB_USER }}
4855
password: ${{ secrets.DOCKERHUB_PASS }}
4956

5057
- name: Log in to GitHub Container Registry
5158
if: github.event_name != 'pull_request'
52-
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
59+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
5360
with:
5461
registry: ghcr.io
5562
username: ${{ github.repository_owner }}
5663
password: ${{ secrets.GITHUB_TOKEN }}
5764

58-
- name: Build and push
59-
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4
65+
- name: Build and push by digest
66+
id: build
67+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
6068
with:
6169
context: .
6270
file: ./Dockerfile
63-
platforms: linux/amd64,linux/arm64
64-
push: ${{ github.event_name != 'pull_request' }}
65-
tags: ${{ steps.meta.outputs.tags }}
71+
platforms: ${{ matrix.platform }}
6672
labels: ${{ steps.meta.outputs.labels }}
73+
tags: |
74+
${{ env.DOCKERHUB_IMAGE }}
75+
${{ env.GHCR_IMAGE }}
76+
outputs: type=image,oci-mediatypes=true,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
77+
78+
- name: Export digest
79+
if: github.event_name != 'pull_request'
80+
run: |
81+
mkdir -p ${{ runner.temp }}/digests
82+
digest="${{ steps.build.outputs.digest }}"
83+
touch "${{ runner.temp }}/digests/${digest#sha256:}"
84+
85+
- name: Upload digest
86+
if: github.event_name != 'pull_request'
87+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
88+
with:
89+
name: digests-${{ env.PLATFORM_PAIR }}
90+
path: ${{ runner.temp }}/digests/*
91+
if-no-files-found: error
92+
retention-days: 1
93+
94+
merge:
95+
name: Create multi-arch manifest
96+
runs-on: ubuntu-latest
97+
if: github.event_name != 'pull_request'
98+
needs: build
99+
permissions:
100+
contents: read
101+
packages: write
102+
103+
steps:
104+
- name: Download digests
105+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
106+
with:
107+
path: ${{ runner.temp }}/digests
108+
pattern: digests-*
109+
merge-multiple: true
110+
111+
- name: Log in to Docker Hub
112+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
113+
with:
114+
registry: docker.io
115+
username: ${{ secrets.DOCKERHUB_USER }}
116+
password: ${{ secrets.DOCKERHUB_PASS }}
117+
118+
- name: Log in to GitHub Container Registry
119+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
120+
with:
121+
registry: ghcr.io
122+
username: ${{ github.repository_owner }}
123+
password: ${{ secrets.GITHUB_TOKEN }}
124+
125+
- name: Set up Buildx
126+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
127+
128+
- name: Docker meta
129+
id: meta
130+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
131+
with:
132+
images: |
133+
${{ env.DOCKERHUB_IMAGE }}
134+
${{ env.GHCR_IMAGE }}
135+
tags: |
136+
type=sha
137+
type=ref,event=branch
138+
type=ref,event=tag
139+
type=raw,value=latest,enable={{is_default_branch}}
140+
141+
- name: Create manifest list and push to Docker Hub
142+
working-directory: ${{ runner.temp }}/digests
143+
run: |
144+
docker buildx imagetools create \
145+
$(jq -cr '.tags | map(select(startswith("${{ env.DOCKERHUB_IMAGE }}")) | "-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
146+
$(printf '${{ env.DOCKERHUB_IMAGE }}@sha256:%s ' *)
147+
148+
- name: Create manifest list and push to GHCR
149+
working-directory: ${{ runner.temp }}/digests
150+
run: |
151+
docker buildx imagetools create \
152+
$(jq -cr '.tags | map(select(startswith("${{ env.GHCR_IMAGE }}")) | "-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
153+
$(printf '${{ env.GHCR_IMAGE }}@sha256:%s ' *)
154+
155+
- name: Inspect images
156+
run: |
157+
docker buildx imagetools inspect ${{ env.DOCKERHUB_IMAGE }}:${{ steps.meta.outputs.version }}
158+
docker buildx imagetools inspect ${{ env.GHCR_IMAGE }}:${{ steps.meta.outputs.version }}

0 commit comments

Comments
 (0)