feat: a trigger may inject an operator-authored skills directory (iss… #14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build and publish the receiver image to GHCR so operators `docker compose --profile receiver up` a | |
| # prebuilt multi-arch image instead of building locally. main is branch-protected (a PR is required and the | |
| # five contract checks in pi-upgrade-check.yml must be green, admins included), so a push here is an | |
| # already-gated merge — nothing in this workflow merges anything (CONST-MERGE-NEVER-AUTOMATIC). | |
| # | |
| # The pushed image is a snapshot of the receiver AND the worker sources it imports (`@edgehero/pi-dispatch` | |
| # is a workspace dependency) at the built commit — hence the worker paths in the trigger: a change to a | |
| # shared module the receiver imports must rebuild this image even when receiver/ itself is untouched. | |
| # | |
| # No secret required: GHCR auth uses the built-in GITHUB_TOKEN (packages: write). One-time after the first | |
| # successful run: make the ghcr.io/edgehero/pi-dispatch-receiver package Public in the org's package | |
| # settings, otherwise `docker pull` needs auth. | |
| # | |
| # Tags: `latest`, the git `sha`, and the PRODUCT version from the root package.json (so a release cuts a | |
| # tag that never moves, and a deployment can pin `ghcr.io/edgehero/pi-dispatch-receiver:<version>` instead of tracking latest). | |
| name: receiver-image | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "receiver/**" | |
| - "worker/src/**" | |
| - "worker/package.json" | |
| - "package-lock.json" | |
| - "package.json" # the ROOT one: a product version bump republishes under its own tag | |
| - ".github/workflows/receiver-image.yml" | |
| # Manual re-run (available once this file is on the default branch). | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: read | |
| packages: write # push to ghcr.io/edgehero/* | |
| concurrency: | |
| group: receiver-image | |
| cancel-in-progress: false | |
| env: | |
| IMAGE: ghcr.io/edgehero/pi-dispatch-receiver | |
| jobs: | |
| build-push: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-qemu-action@v3 # arm64 emulation for the multi-arch build | |
| - uses: docker/setup-buildx-action@v3 | |
| - uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Resolve the product version (the tag operators can pin) | |
| id: v | |
| run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT" | |
| - name: Tags + labels | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE }} | |
| tags: | | |
| type=raw,value=latest | |
| type=raw,value=${{ steps.v.outputs.version }} | |
| type=sha | |
| - name: Build + push (amd64 + arm64) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . # repo root — the Dockerfile copies worker/ and receiver/ workspace sources from here | |
| file: receiver/Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |