release: v0.10.0 (worker 0.3.0, receiver 0.2.1, admin 0.7.0) #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build and publish the pi-dispatch job image to GHCR so operators `docker pull` instead of the slow local | |
| # build (Chromium + Playwright + fonts, minutes). main is branch-protected (a PR is required and the five | |
| # contract checks in pi-upgrade-check.yml must be green, admins included), so a push here is an already-gated | |
| # merge — nothing in this workflow merges anything (CONST-MERGE-NEVER-AUTOMATIC). | |
| # | |
| # The pushed image is a snapshot of THIS repo's runner + guardrails at the built commit. Operators who bake | |
| # their own toolchain into image/Dockerfile still build locally; the pull is only the fast default path. | |
| # | |
| # No secret required: GHCR auth uses the built-in GITHUB_TOKEN (packages: write). One-time after the first | |
| # successful run: make the ghcr.io/edgehero/pi-job package Public in the org's package settings, otherwise | |
| # `docker pull` needs auth. | |
| # | |
| # Tags: `latest`, the git `sha`, and the PRODUCT version from the root package.json (so a release cuts a | |
| # tag that never moves, and a deployment can pin `ghcr.io/edgehero/pi-job:<version>` instead of tracking latest). | |
| name: image | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "image/**" | |
| - "package.json" # the ROOT one: a product version bump republishes under its own tag | |
| - ".github/workflows/image.yml" | |
| # Manual re-run (available once this file is on the default branch). | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: read | |
| packages: write # push to ghcr.io/edgehero/* | |
| concurrency: | |
| group: image | |
| cancel-in-progress: false | |
| env: | |
| IMAGE: ghcr.io/edgehero/pi-job | |
| jobs: | |
| build-push: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-qemu-action@v3 # arm64 emulation for the multi-arch build | |
| - uses: docker/setup-buildx-action@v3 | |
| - uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Resolve the product version (the tag operators can pin) | |
| id: v | |
| run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT" | |
| - name: Tags + labels | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE }} | |
| tags: | | |
| type=raw,value=latest | |
| type=raw,value=${{ steps.v.outputs.version }} | |
| type=sha | |
| - name: Build + push (amd64 + arm64) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . # repo root — the Dockerfile copies image/runner + guardrails from here | |
| file: image/Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |