feat: apply the WSJ27SE graphic profile to /handbok #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Docker Image | |
| on: | |
| push: | |
| release: | |
| types: [published] | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| concurrency: | |
| group: build-image-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| docker: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| # pnpm records an explicit tarball URL when a package was resolved from a | |
| # non-default registry, so a lockfile touched by `pnpm add` behind an npm | |
| # mirror names a host this runner cannot resolve. Assert the property | |
| # here, where the message says what happened — instead of ENOTFOUND on a | |
| # random package minutes into the image build. | |
| - name: Lockfile must resolve from registry.npmjs.org only | |
| run: | | |
| if grep -E 'tarball: https?://' pnpm-lock.yaml | grep -v 'registry\.npmjs\.org'; then | |
| echo "::error::pnpm-lock.yaml contains tarball URLs on a non-npmjs host (see CLAUDE.md)" | |
| exit 1 | |
| fi | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=sha | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=semver,pattern={{version}} | |
| - name: Build and push | |
| id: push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| push: true | |
| platforms: linux/amd64 | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| build-args: | | |
| NEXT_BASE_PATH=/_services/cms | |
| - name: Generate artifact attestation | |
| uses: actions/attest-build-provenance@v3 | |
| with: | |
| subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}} | |
| subject-digest: ${{ steps.push.outputs.digest }} | |
| push-to-registry: true |