Build and push Docker image with Buildx

The commit adds steps to build and push a Docker image using Buildx in the GitHub Actions workflow. It includes checking out the repository, installing the cosign tool, setting up Docker buildx, logging into the Docker registry, extracting metadata for Docker, and finally building and pushing the Docker image with the specified tags and platforms. The commit ensures that the image is only pushed when the event name is not a pull request.

.github/workflows/main.yml

@@ -1,29 +1,79 @@
+name: Docker
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
 on:
   push:
+    branches: [ "main" ]
+
+env:
+  # Use docker.io for Docker Hub if empty
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}
+
 
 jobs:
   build:
-    name: Build, push, and deploy
+
     runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
+    permissions:
+      contents: read
+      packages: write
+      # This is used to complete the identity challenge
+      # with sigstore/fulcio when running outside of PRs.
+      id-token: write
+
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
 
-    - name: Checkout
+      # Install the cosign tool except on PR
-      uses: actions/checkout@v2
+      # https://github.com/sigstore/cosign-installer
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: 'v1.11.0'
 
-    - name: Build container image
-      platforms: linux/amd64,linux/arm64
-      run: |
-        docker build \
-        --tag ghcr.io/hra42/my-idlers-arm64:$(echo $GITHUB_SHA | head -c7) \
-        --tag ghcr.io/hra42/my-idlers-arm64:latest \
-        .
-    - name: Container registry login
-      run: |
-        echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
 
-    - name: Push image to GHCR
+      # Workaround: https://github.com/docker/build-push-action/issues/461
-      if: github.ref == 'refs/heads/main'
+      - name: Setup Docker buildx
-      run: |
+        uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
-        docker push ghcr.io/hra42/my-idlers-arm64:$(echo $GITHUB_SHA | head -c7)
+
-        docker push ghcr.io/hra42/my-idlers-arm64:latest
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+              latest
+
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max