forked from kamba4/sunders
Stefan Bethke
40a92ef6c8
There are no Windows runners, so the workflow never ran. Builds now follow the kaniko setup used in CCCHH/oci-images: - kaniko in a container on the `docker` runner, one matrix job per image - authenticates as forgejo-actions with the PACKAGES_TOKEN secret - adds OCI annotations (ref.name, revision, url, source) Publishing is limited to pushes to refs/heads/main, which push `latest` and an immutable `sha-<commit>` tag. All other refs build with KANIKO_NO_PUSH and do not receive the token. Tags are no longer derived from ref names, so a branch named `latest` or a tag named `main` can no longer overwrite the production image. The docker compose smoke test is dropped, as there is no Docker daemon inside the kaniko container.
44 lines
1.8 KiB
YAML
44 lines
1.8 KiB
YAML
name: Build (and tag) Images
|
|
|
|
on:
|
|
workflow_dispatch: {}
|
|
push: {}
|
|
|
|
# Every push builds both images. Only pushes to the main branch publish them, as
|
|
# `latest` and `sha-<commit>`; all other refs build without pushing and do not
|
|
# receive registry credentials.
|
|
|
|
jobs:
|
|
build-container:
|
|
name: Build ${{ matrix.image }} Image
|
|
runs-on: docker
|
|
container:
|
|
image: ghcr.io/osscontainertools/kaniko:alpine
|
|
strategy:
|
|
matrix:
|
|
image:
|
|
- web
|
|
- data_handler
|
|
steps:
|
|
- name: Install required system packages
|
|
run: apk add --no-cache nodejs git
|
|
|
|
- name: Checkout source code
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Build image
|
|
env:
|
|
KANIKO_NO_PUSH: ${{ !(forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') }}
|
|
KANIKO_GIT_HAMBURG_CCC_DE_USER: forgejo-actions
|
|
KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ (forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') && secrets.PACKAGES_TOKEN || '' }}
|
|
run: /kaniko/executor
|
|
--dockerfile="${{ forgejo.workspace }}/${{ matrix.image }}/Containerfile"
|
|
--context="dir://${{ forgejo.workspace }}/${{ matrix.image }}"
|
|
--destination=git.hamburg.ccc.de/ccchh/sunders/${{ matrix.image }}:latest
|
|
--destination=git.hamburg.ccc.de/ccchh/sunders/${{ matrix.image }}:sha-${{ forgejo.sha }}
|
|
--no-push-cache
|
|
--credential-helpers=env
|
|
--annotation=org.opencontainers.image.ref.name=sunders/${{ matrix.image }}
|
|
--annotation=org.opencontainers.image.revision=${{ forgejo.sha }}
|
|
--annotation=org.opencontainers.image.url=${{ forgejo.server_url }}/${{ forgejo.repository }}
|
|
--annotation=org.opencontainers.image.source=${{ forgejo.server_url }}/${{ forgejo.repository }}
|