Build and push Docker image #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and push Docker image | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| IMAGE: ghcr.io/${{ github.repository }} | |
| jobs: | |
| # ── Build each platform on its native runner in parallel ───────────────── | |
| build: | |
| name: Build (${{ matrix.platform }}) | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - platform: linux/amd64 | |
| runner: ubuntu-latest | |
| - platform: linux/arm64 | |
| runner: ubuntu-24.04-arm | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: docker/setup-buildx-action@v4 | |
| - uses: docker/login-action@v4 | |
| if: github.event_name != 'pull_request' | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: docker/metadata-action@v6 | |
| id: meta | |
| with: | |
| images: ${{ env.IMAGE }} | |
| # PR: build only to validate compilation — no push | |
| - name: Build (PR validation) | |
| if: github.event_name == 'pull_request' | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| platforms: ${{ matrix.platform }} | |
| push: false | |
| # Push: build and push by raw digest (no tag yet — tagged in merge job) | |
| - name: Build and push by digest | |
| if: github.event_name != 'pull_request' | |
| id: build | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| platforms: ${{ matrix.platform }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true | |
| - name: Export digest | |
| if: github.event_name != 'pull_request' | |
| run: | | |
| mkdir -p /tmp/digests | |
| digest="${{ steps.build.outputs.digest }}" | |
| touch "/tmp/digests/${digest#sha256:}" | |
| - name: Upload digest artifact | |
| if: github.event_name != 'pull_request' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: digest-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }} | |
| path: /tmp/digests/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| # ── Merge digests into a single manifest list, then attest ─────────────── | |
| merge: | |
| name: Merge, attest SBOM and provenance | |
| needs: build | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write # required for OIDC signing | |
| attestations: write # required to push attestations to registry | |
| steps: | |
| - uses: actions/checkout@v6 # needed for source-based SBOM scan | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| path: /tmp/digests | |
| pattern: digest-* | |
| merge-multiple: true | |
| - uses: docker/setup-buildx-action@v4 | |
| - uses: imjasonh/setup-crane@v0.5 | |
| - uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: docker/metadata-action@v6 | |
| id: meta | |
| with: | |
| images: ${{ env.IMAGE }} | |
| tags: | | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=sha | |
| - name: Create and push manifest list | |
| id: manifest | |
| working-directory: /tmp/digests | |
| run: | | |
| docker buildx imagetools create \ | |
| $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | |
| $(printf '${{ env.IMAGE }}@sha256:%s ' *) | |
| primary_tag=$(jq -r '.tags[0]' <<< "$DOCKER_METADATA_OUTPUT_JSON") | |
| echo "digest=$(crane digest "${primary_tag}")" >> "$GITHUB_OUTPUT" | |
| - name: Generate SBOM | |
| run: | | |
| curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin | |
| syft . -o spdx-json=sbom.spdx.json | |
| - name: Attest SBOM | |
| uses: actions/attest@v4 | |
| with: | |
| subject-name: ${{ env.IMAGE }} | |
| subject-digest: ${{ steps.manifest.outputs.digest }} | |
| predicate-type: https://spdx.dev/Document | |
| predicate-path: sbom.spdx.json | |
| - name: Attest build provenance | |
| uses: actions/attest-build-provenance@v4 | |
| with: | |
| subject-name: ${{ env.IMAGE }} | |
| subject-digest: ${{ steps.manifest.outputs.digest }} | |
| - name: Summary | |
| run: | | |
| echo "## Docker image published" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| | |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "|---|---|" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| **Repository** | \`${{ env.IMAGE }}\` |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| **Digest** | \`${{ steps.manifest.outputs.digest }}\` |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "**Tags**" >> "$GITHUB_STEP_SUMMARY" | |
| while IFS= read -r tag; do | |
| echo "- \`${tag}\`" >> "$GITHUB_STEP_SUMMARY" | |
| done <<< "${{ steps.meta.outputs.tags }}" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```bash' >> "$GITHUB_STEP_SUMMARY" | |
| echo "docker pull ${{ env.IMAGE }}:${{ steps.meta.outputs.version }}" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" |