Reorganization #229

Workflow file for this run

.github/workflows/docker_build.yml at 4adb2f9

	name: Docker

	# This workflow uses actions that are not certified by GitHub.
	# They are provided by a third-party and are governed by
	# separate terms of service, privacy policy, and support
	# documentation.

	on:
	# schedule:
	# - cron: "22 21 * * *"
	push:
	branches: ["main"]
	# Publish semver tags as releases.
	# tags: ["..*"]
	pull_request:
	branches: ["main"]

	env:
	# Use docker.io for Docker Hub if empty
	REGISTRY: ghcr.io
	# github.repository as <account>/<repo>
	IMAGE_NAME: ${{ github.repository }}
	COMPARE_TAG: latest

	jobs:
	setup:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: write
	# This is used to complete the identity challenge
	# with sigstore/fulcio when running outside of PRs.
	id-token: write
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4.2.2
	with:
	submodules: "recursive"
	fetch-depth: 1

	- name: Install cosign
	if: github.event_name != 'pull_request'
	uses: sigstore/cosign-installer@v3.8.0 # v3.1.1
	with:
	cosign-release: "v2.2.4"

	- name: Cache Repository
	uses: actions/cache@v4.2.0
	with:
	path: ./
	key: ${{ runner.os }}-repo-${{ github.sha }}

	github-build:
	if: github.event_name != 'release'
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: write
	pull-requests: write
	security-events: write
	# This is used to complete the identity challenge
	# with sigstore/fulcio when running outside of PRs.
	id-token: write
	outputs:
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}
	image: ${{ steps.build-and-push.outputs.image }}
	needs:
	- setup
	steps:
	# - name: Checkout repository
	# uses: actions/checkout@v4
	# with:
	# submodules: "recursive"

	# # Install the cosign tool except on PR
	# # https://github.com/sigstore/cosign-installer
	# - name: Install cosign
	# if: github.event_name != 'pull_request'
	# uses: sigstore/cosign-installer@v3.8.0 # v3.1.1
	# with:
	# cosign-release: "v2.2.4"

	# # Set up BuildKit Docker container builder to be able to build
	# # multi-platform images and export cache
	# # https://github.com/docker/setup-buildx-action
	# - name: Set up Docker Buildx
	# uses: docker/setup-buildx-action@v3.8.0

	# Login against a Docker registry except on PR
	# https://github.com/docker/login-action
	- name: Restore Cached Repository
	uses: actions/cache@v4.2.0
	with:
	path: ./
	key: ${{ runner.os }}-repo-${{ github.sha }}

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3.8.0 # v3.6.1

	- name: Log into registry ${{ env.REGISTRY }}
	uses: docker/login-action@v3.0.0
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	# Extract metadata (tags, labels) for Docker
	# https://github.com/docker/metadata-action
	- name: Extract Docker metadata
	id: meta
	uses: docker/metadata-action@v5.6.1
	with:
	images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
	tags: \|
	type=semver,pattern={{version}}
	type=semver,pattern={{major}}.{{minor}}
	type=semver,pattern={{major}}
	type=ref,event=branch
	type=ref,event=pr

	# Build and push Docker image with Buildx (don't push on PR)
	# https://github.com/docker/build-push-action
	- name: Build and push Docker image
	id: build-and-push
	uses: docker/build-push-action@v6.13.0
	with:
	context: .
	push: true
	load: ${{ github.event_name == 'pull_request' }}
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}
	cache-from: type=gha
	cache-to: type=gha,mode=max
	dockerhub-build:
	if: github.event_name != 'release'
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: write
	pull-requests: write
	security-events: write
	# This is used to complete the identity challenge
	# with sigstore/fulcio when running outside of PRs.
	id-token: write
	outputs:
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}
	needs:
	- setup
	steps:
	- name: Restore Cached Repository
	uses: actions/cache@v4.2.0
	with:
	path: ./
	key: ${{ runner.os }}-repo-${{ github.sha }}

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3.8.0 # v3.6.1

	- name: Login to Docker Hub
	uses: docker/login-action@v3.3.0
	with:
	username: ${{ secrets.DOCKERHUB_USERNAME }}
	password: ${{ secrets.DOCKERHUB_TOKEN }}

	- name: Extract Docker metadata
	id: meta
	uses: docker/metadata-action@v5.6.1
	with:
	images: ${{ env.IMAGE_NAME }}
	tags: \|
	type=ref,event=branch
	type=ref,event=pr

	- name: Build and push Docker image to Docker Hub
	id: build-and-push-docker
	uses: docker/build-push-action@v6.13.0
	with:
	context: .
	push: true
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}
	cache-from: type=gha
	cache-to: type=gha,mode=max

	docker-scout:
	if: github.event_name != 'release'
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: write
	pull-requests: write
	security-events: write
	# This is used to complete the identity challenge
	# with sigstore/fulcio when running outside of PRs.
	id-token: write
	needs:
	- github-build
	- dockerhub-build
	steps:
	- name: Login to Docker Hub
	uses: docker/login-action@v3
	with:
	username: ${{ secrets.DOCKERHUB_USERNAME }}
	password: ${{ secrets.DOCKERHUB_TOKEN }}
	- name: Docker Scout
	id: docker-scout
	uses: docker/scout-action@v1
	with:
	# command: cves,recommendations,compare
	command: compare
	image: ${{ needs.github-build.outputs.tags }}
	to: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.COMPARE_TAG }}
	ignore-unchanged: false
	write-comment: true
	github-token: ${{ secrets.GITHUB_TOKEN }} # to be able to write the comment
	# sarif-file: docker-scout.sarif

	# - name: Upload analysis results to GitHub
	# id: upload-sarif
	# if: ${{ github.event_name != 'pull_request' }}
	# uses: github/codeql-action/upload-sarif@v3
	# with:
	# sarif_file: docker-scout.sarif
	# wait-for-processing: true

	# # Sign the resulting Docker image digest except on PRs.
	# # This will only write to the public Rekor transparency log when the Docker
	# # repository is public to avoid leaking data. If you would like to publish
	# # transparency data even for private images, pass --force to cosign below.
	# # https://github.com/sigstore/cosign
	# - name: Sign the published Docker image
	# if: ${{ github.event_name != 'pull_request' }}
	# env:
	# # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
	# TAGS: ${{ steps.meta.outputs.tags }}
	# DIGEST: ${{ steps.build-and-push.outputs.digest }}
	# # This step uses the identity token to provision an ephemeral certificate
	# # against the sigstore community Fulcio instance.
	# run: echo "${TAGS}" \| xargs -I {} cosign sign --yes {}@${DIGEST}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Reorganization #229

Workflow file

Reorganization #229

Jobs

Run details

Workflow file for this run