1313 outputs :
1414 version : ${{ steps.validate.outputs.version }}
1515 steps :
16- - uses : actions/checkout@v5
16+ - uses : actions/checkout@v7
1717 with :
1818 fetch-depth : 0
1919 token : ${{ secrets.WORKFLOW_TOKEN }}
@@ -22,37 +22,65 @@ jobs:
2222 uses : hawk-digital-environments/hawk-pipeline-actions/validate-release-branch@v1
2323
2424 test-docker-build :
25- name : Test Docker Build
26- runs-on : ubuntu-latest
25+ name : Test Docker Build (${{ matrix.arch }})
26+ runs-on : ${{ matrix.runner }}
2727 needs : validate
28+ permissions :
29+ contents : read
30+ packages : write
31+ strategy :
32+ # Always test both architectures, so an arch-specific breakage is
33+ # visible instead of being masked by the other job failing first.
34+ fail-fast : false
35+ matrix :
36+ include :
37+ - platform : linux/amd64
38+ arch : amd64
39+ runner : ubuntu-latest
40+ - platform : linux/arm64
41+ arch : arm64
42+ runner : ubuntu-latest
2843 steps :
2944 - name : Checkout release branch
30- uses : actions/checkout@v5
45+ uses : actions/checkout@v7
3146
3247 - name : Set up QEMU
33- uses : docker/setup-qemu-action@v3
48+ uses : docker/setup-qemu-action@v4
3449
3550 - name : Set up Docker Buildx
36- uses : docker/setup-buildx-action@v3
51+ uses : docker/setup-buildx-action@v4
52+
53+ # Required for the registry-backed build cache below
54+ - name : Log in to the GitHub Container registry
55+ uses : docker/login-action@v4
56+ with :
57+ registry : ghcr.io
58+ username : ${{ github.actor }}
59+ password : ${{ secrets.GITHUB_TOKEN }}
3760
3861 - name : Test Docker build
39- uses : docker/build-push-action@v5
62+ uses : docker/build-push-action@v7
4063 with :
4164 context : .
4265 file : ./Dockerfile
4366 push : false
67+ # Runs the full build, then discards the image. Keeps this a real
68+ # build test while populating the cache for the publish pipeline.
69+ outputs : type=cacheonly
4470 target : app_prod
45- platforms : linux/amd64,linux/arm64
46- tags : digitalenvironments/hawki:release-test
47- cache-from : type=gha,scope=${{ needs.validate.outputs.version }}
48- cache-to : type=gha,mode=max,scope=${{ needs.validate.outputs.version }}
71+ platforms : ${{ matrix.platform }}
72+ # One cache ref per architecture: keeps each export small enough to
73+ # avoid the 504s seen when exporting one combined multi-arch cache.
74+ cache-from : type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-${{ matrix.arch }}
75+ # ignore-error: a flaky cache export must not fail the release gate
76+ cache-to : type=registry,ref=ghcr.io/hawk-digital-environments/hawki:buildcache-${{ matrix.arch }},mode=max,ignore-error=true
4977
5078 release :
5179 name : Merge and Tag Release
5280 runs-on : ubuntu-latest
5381 needs : [ validate, test-docker-build ]
5482 steps :
55- - uses : actions/checkout@v5
83+ - uses : actions/checkout@v7
5684 with :
5785 fetch-depth : 0
5886 token : ${{ secrets.WORKFLOW_TOKEN }}
0 commit comments