forked from kamba4/sunders
Stefan Bethke
6ec1b9fc5a
All checks were successful
Build (and tag) Images / build (push) Successful in 1m23s
There are no Windows runners; build the images with kaniko in a container on the `docker` runner, as on the link-updates branch, while keeping the publishing restrictions: - only pushes to refs/heads/main publish, as `latest` and `sha-<commit>` - other refs build with --no-push under a ci-<commit> tag - registry credentials are only passed to the build when publishing The docker compose smoke test is dropped, as there is no Docker daemon inside the kaniko container.
85 lines
3.4 KiB
YAML
85 lines
3.4 KiB
YAML
name: Build (and tag) Images
|
|
|
|
on:
|
|
push:
|
|
workflow_dispatch:
|
|
|
|
# Images are only published for pushes to the main branch. All other refs (branches,
|
|
# renovate branches, tags) are built, but never pushed, and do not get registry credentials.
|
|
#
|
|
# Note: a workflow run for a pushed ref uses the workflow file from that ref, so this
|
|
# condition alone does not stop someone with push access from publishing images. The
|
|
# registry credentials must additionally be restricted to the protected main branch.
|
|
|
|
env:
|
|
IMAGE_PREFIX: git.hamburg.ccc.de/ccchh/sunders
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: docker
|
|
container:
|
|
image: ghcr.io/osscontainertools/kaniko:alpine
|
|
steps:
|
|
- name: Install required system packages
|
|
run: apk add --no-cache nodejs git
|
|
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set image tags
|
|
id: vars
|
|
env:
|
|
COMMIT_SHA: ${{ forgejo.sha }}
|
|
PUBLISH: ${{ forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main' }}
|
|
run: |
|
|
if [ "$PUBLISH" = "true" ]; then
|
|
echo "publish=true" >> "$GITHUB_OUTPUT"
|
|
echo "tag=latest" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "publish=false" >> "$GITHUB_OUTPUT"
|
|
# Never derive tags from ref names: they are attacker-controlled and may collide with `latest`.
|
|
echo "tag=ci-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
echo "sha_tag=sha-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build web image
|
|
env:
|
|
IMAGE: web
|
|
PUBLISH: ${{ steps.vars.outputs.publish }}
|
|
TAG: ${{ steps.vars.outputs.tag }}
|
|
SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
|
|
KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_USERNAME || '' }}
|
|
KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_TOKEN || '' }}
|
|
run: |
|
|
if [ "$PUBLISH" = "true" ]; then
|
|
set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --destination="$IMAGE_PREFIX/$IMAGE:$SHA_TAG"
|
|
else
|
|
set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --no-push
|
|
fi
|
|
/kaniko/executor \
|
|
--dockerfile="$GITHUB_WORKSPACE/$IMAGE/Containerfile" \
|
|
--context="dir://$GITHUB_WORKSPACE/$IMAGE" \
|
|
--no-push-cache \
|
|
--credential-helpers=env \
|
|
"$@"
|
|
|
|
- name: Build data_handler image
|
|
env:
|
|
IMAGE: data_handler
|
|
PUBLISH: ${{ steps.vars.outputs.publish }}
|
|
TAG: ${{ steps.vars.outputs.tag }}
|
|
SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
|
|
KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_USERNAME || '' }}
|
|
KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_TOKEN || '' }}
|
|
run: |
|
|
if [ "$PUBLISH" = "true" ]; then
|
|
set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --destination="$IMAGE_PREFIX/$IMAGE:$SHA_TAG"
|
|
else
|
|
set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --no-push
|
|
fi
|
|
/kaniko/executor \
|
|
--dockerfile="$GITHUB_WORKSPACE/$IMAGE/Containerfile" \
|
|
--context="dir://$GITHUB_WORKSPACE/$IMAGE" \
|
|
--no-push-cache \
|
|
--credential-helpers=env \
|
|
"$@"
|