Document how to verify the integrity of a release (#4784) #2047

	name: Build autobuild container that runs tests on dashboard.sitespeed.io
	on:
	push:
	branches:
	- main
	# release.yml dispatches this workflow after the "new version" commit lands,
	# because that commit is pushed with GITHUB_TOKEN and so doesn't trigger
	# push-based workflows on its own.
	workflow_dispatch:
	jobs:
	docker:
	runs-on: ubuntu-24.04
	# On workflow_dispatch the head_commit object is null, so the docs: skip
	# heuristic only applies to real pushes.
	if: ${{ github.event_name == 'workflow_dispatch' \|\| !contains(github.event.head_commit.message, 'docs:') }}
	steps:
	-
	name: Harden Runner
	uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
	with:
	egress-policy: audit
	-
	name: Set up QEMU
	uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
	-
	name: Set up Docker Buildx
	uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
	-
	name: Login to DockerHub
	uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
	with:
	username: ${{ secrets.DOCKERHUB_USERNAME }}
	password: ${{ secrets.DOCKERHUB_TOKEN }}
	-
	name: Build and push sitespeed.io
	uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
	with:
	platforms: linux/amd64
	push: true
	provenance: false
	tags: sitespeedio/sitespeed.io-autobuild:main

Navigation Menu