Build and push Docker image with Buildx

The commit adds steps to build and push a Docker image using Buildx in the GitHub Actions workflow. It includes checking out the repository, installing the cosign tool, setting up Docker buildx, logging into the Docker registry, extracting metadata for Docker, and finally building and pushing the Docker image with the specified tags and platforms. The commit ensures that the image is only pushed when the event name is not a pull request.
This commit is contained in:
Henry Rausch 2023-11-16 23:46:25 +01:00
parent 0c3dd6b7e2
commit 32580be6b4
No known key found for this signature in database
GPG Key ID: A6BD2929733D78DD

View File

@ -1,29 +1,79 @@
name: Docker
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
on:
push:
branches: [ "main" ]
env:
# Use docker.io for Docker Hub if empty
REGISTRY: ghcr.io
# github.repository as <account>/<repo>
IMAGE_NAME: ${{ github.repository }}
jobs:
build:
name: Build, push, and deploy
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main'
permissions:
contents: read
packages: write
# This is used to complete the identity challenge
# with sigstore/fulcio when running outside of PRs.
id-token: write
steps:
- name: Checkout repository
uses: actions/checkout@v3
- name: Checkout
uses: actions/checkout@v2
# Install the cosign tool except on PR
# https://github.com/sigstore/cosign-installer
- name: Install cosign
if: github.event_name != 'pull_request'
uses: sigstore/cosign-installer@main
with:
cosign-release: 'v1.11.0'
- name: Build container image
platforms: linux/amd64,linux/arm64
run: |
docker build \
--tag ghcr.io/hra42/my-idlers-arm64:$(echo $GITHUB_SHA | head -c7) \
--tag ghcr.io/hra42/my-idlers-arm64:latest \
.
- name: Container registry login
run: |
echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
- name: Push image to GHCR
if: github.ref == 'refs/heads/main'
run: |
docker push ghcr.io/hra42/my-idlers-arm64:$(echo $GITHUB_SHA | head -c7)
docker push ghcr.io/hra42/my-idlers-arm64:latest
# Workaround: https://github.com/docker/build-push-action/issues/461
- name: Setup Docker buildx
uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
# Login against a Docker registry except on PR
# https://github.com/docker/login-action
- name: Log into registry ${{ env.REGISTRY }}
if: github.event_name != 'pull_request'
uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
# Extract metadata (tags, labels) for Docker
# https://github.com/docker/metadata-action
- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
latest
# Build and push Docker image with Buildx (don't push on PR)
# https://github.com/docker/build-push-action
- name: Build and push Docker image
id: build-and-push
uses: docker/build-push-action@v2
with:
context: .
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
platforms: linux/amd64,linux/arm64
cache-from: type=gha
cache-to: type=gha,mode=max