Docker publish rootless ARM #152
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker publish rootless ARM | |
| on: | |
| schedule: | |
| - cron: '00 0 * * *' | |
| push: | |
| branches: [ "main" ] | |
| paths: | |
| - 'backend/**' | |
| - 'frontend/**' | |
| - 'Dockerfile' | |
| - 'Dockerfile.rootless' | |
| - '.dockerignore' | |
| - '.github/workflows' | |
| # Publish semver tags as releases. | |
| tags: [ 'v*.*.*' ] | |
| pull_request: | |
| branches: [ "main" ] | |
| paths: | |
| - 'backend/**' | |
| - 'frontend/**' | |
| - 'Dockerfile' | |
| - 'Dockerfile.rootless' | |
| - '.dockerignore' | |
| - '.github/workflows' | |
| env: | |
| # Use docker.io for Docker Hub if empty | |
| REGISTRY: ghcr.io | |
| # github.repository as <account>/<repo> | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build-rootless: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| steps: | |
| # Step 1: Checkout repository | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| # Step 2: Set up Buildx without specifying driver | |
| - name: Set up Docker Buildx | |
| uses: docker/[email protected] | |
| with: | |
| install: true # Ensure Buildx is installed and set up properly | |
| use: true # Use Buildx instance directly for this job | |
| # Step 3: Login to Docker registry except on PR | |
| - name: Log into registry ${{ env.REGISTRY }} | |
| if: github.event_name != 'pull_request' | |
| uses: docker/[email protected] | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Step 4: Extract metadata for Docker images | |
| - name: Extract Docker metadata | |
| id: metadata | |
| uses: docker/[email protected] | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=schedule,pattern=nightly | |
| flavor: | | |
| suffix=-rootless-arm,onlatest=true | |
| # Step 5: Build and push the Docker image | |
| - name: Build and push Docker image | |
| id: build-and-push | |
| uses: docker/[email protected] | |
| with: | |
| context: . | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.metadata.outputs.tags }} | |
| labels: ${{ steps.metadata.outputs.labels }} | |
| platforms: linux/arm64,linux/arm/v7 | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| build-args: | | |
| VERSION=${{ github.ref_name }} | |
| COMMIT=${{ github.sha }} | |
| # Step 6: Attest built image to prove build provenance | |
| - name: Attest | |
| uses: actions/attest-build-provenance@v1 | |
| id: attest | |
| if: ${{ github.event_name != 'pull_request' }} | |
| with: | |
| subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| subject-digest: ${{ steps.build-and-push.outputs.digest }} | |
| push-to-registry: true |