Publish Docker image to GHCR #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Docker image to GHCR | |
| # Builds the image on GitHub's runners and pushes it to ghcr.io. | |
| # | |
| # This exists because pushing from a laptop needs a Personal Access Token with | |
| # `write:packages`. Actions gets an automatic GITHUB_TOKEN that already has it — | |
| # see `permissions:` below — so nobody has to create or store a PAT. | |
| on: | |
| push: | |
| tags: ["v*"] # every release tag publishes a matching image | |
| workflow_dispatch: # ...and you can run it by hand from the Actions tab | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build-and-push: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write # this is what replaces the PAT | |
| steps: | |
| # The image is ~11GB. A stock runner has ~14GB free on /, which is not | |
| # enough, so reclaim the preinstalled toolchains we don't use first. | |
| - name: Free up disk space | |
| run: | | |
| echo "before:"; df -h / | tail -1 | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \ | |
| /usr/local/share/boost /usr/local/lib/node_modules \ | |
| /opt/hostedtoolcache/CodeQL "$AGENT_TOOLSDIRECTORY" || true | |
| sudo apt-get clean | |
| docker image prune -af || true | |
| echo "after:"; df -h / | tail -1 | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=tag | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }} | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| # linux/amd64 only: this image installs nine projects, and emulating | |
| # arm64 under QEMU pushes the build past the runner's time limit. | |
| platforms: linux/amd64 | |
| provenance: false | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Summary | |
| run: | | |
| echo "### Image published :whale:" >> $GITHUB_STEP_SUMMARY | |
| echo '```bash' >> $GITHUB_STEP_SUMMARY | |
| echo "docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| echo "Make it public: repo → Packages → aios → Package settings → Change visibility" \ | |
| >> $GITHUB_STEP_SUMMARY |