1
- name : Docker
2
-
3
- # This workflow uses actions that are not certified by GitHub.
4
- # They are provided by a third-party and are governed by
5
- # separate terms of service, privacy policy, and support
6
- # documentation.
1
+ name : Publish docker image
7
2
8
3
on :
9
4
workflow_dispatch
10
-
11
- env :
12
- # Use docker.io for Docker Hub if empty
13
- REGISTRY : ghcr.io
14
- # github.repository as <account>/<repo>
15
- IMAGE_NAME : ${{ github.repository }}
16
-
17
5
18
6
jobs :
19
- build :
20
-
21
- runs-on : ubuntu-latest
22
- permissions :
23
- contents : read
24
- packages : write
25
- # This is used to complete the identity challenge
26
- # with sigstore/fulcio when running outside of PRs.
27
- id-token : write
28
-
29
- steps :
30
- - name : Checkout repository
31
- uses : actions/checkout@v4
32
-
33
- # Install the cosign tool except on PR
34
- # https://github.com/sigstore/cosign-installer
35
- - name : Install cosign
36
- if : github.event_name != 'pull_request'
37
- uses : sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
38
- with :
39
- cosign-release : ' v2.2.4'
40
-
41
- # Set up BuildKit Docker container builder to be able to build
42
- # multi-platform images and export cache
43
- # https://github.com/docker/setup-buildx-action
44
- - name : Set up Docker Buildx
45
- uses : docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
46
-
47
- # Login against a Docker registry except on PR
48
- # https://github.com/docker/login-action
49
- - name : Log into registry ${{ env.REGISTRY }}
50
- if : github.event_name != 'pull_request'
51
- uses : docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
52
- with :
53
- registry : ${{ env.REGISTRY }}
54
- username : ${{ github.actor }}
55
- password : ${{ secrets.GITHUB_TOKEN }}
56
-
57
- # Extract metadata (tags, labels) for Docker
58
- # https://github.com/docker/metadata-action
59
- - name : Extract Docker metadata
60
- id : meta
61
- uses : docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
62
- with :
63
- images : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
64
-
65
- # Build and push Docker image with Buildx (don't push on PR)
66
- # https://github.com/docker/build-push-action
67
- - name : Build and push Docker image
68
- id : build-and-push
69
- uses : docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
70
- with :
71
- context : .
72
- push : ${{ github.event_name != 'pull_request' }}
73
- tags : ${{ steps.meta.outputs.tags }}
74
- labels : ${{ steps.meta.outputs.labels }}
75
- cache-from : type=gha
76
- cache-to : type=gha,mode=max
77
-
78
- # Sign the resulting Docker image digest except on PRs.
79
- # This will only write to the public Rekor transparency log when the Docker
80
- # repository is public to avoid leaking data. If you would like to publish
81
- # transparency data even for private images, pass --force to cosign below.
82
- # https://github.com/sigstore/cosign
83
- - name : Sign the published Docker image
84
- if : ${{ github.event_name != 'pull_request' }}
85
- env :
86
- # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
87
- TAGS : ${{ steps.meta.outputs.tags }}
88
- DIGEST : ${{ steps.build-and-push.outputs.digest }}
89
- # This step uses the identity token to provision an ephemeral certificate
90
- # against the sigstore community Fulcio instance.
91
- run : echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
7
+ publish-docker-image :
8
+ runs-on : ubuntu-latest
9
+ steps :
10
+ - uses : actions/checkout@v2
11
+ - name : Login to GitHub Container Registry
12
+ uses : docker/login-action@v1
13
+ with :
14
+ registry : ghcr.io
15
+ username : ${{ github.actor }}
16
+ password : ${{ secrets.GITHUB_TOKEN }}
17
+ - name : Build the hello-docker Docker image
18
+ run :
19
+ docker build . --tag ghcr.io/pkkht/robotrestapp:latest
20
+ docker push ghcr.io/pkkht/robotrestapp:latest
0 commit comments