Bump version #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish container image | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: | |
| contents: read | |
| packages: write | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Decide image tags (semver latest) | |
| id: meta | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| IMAGE_LOWER=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]') | |
| REF_TAG="${GITHUB_REF_NAME}" | |
| NEW_VER="${REF_TAG#v}" | |
| FULL_IMAGE="ghcr.io/${IMAGE_LOWER}" | |
| # Tags already on GHCR (this push is not listed yet). | |
| # Registry HTTP API expects a JWT from the token endpoint, not raw GITHUB_TOKEN on /v2/.../tags/list. | |
| SCOPE="repository:${IMAGE_LOWER}:pull" | |
| TOKEN_JSON=$(curl -sS -u "${{ github.actor }}:${GITHUB_TOKEN}" \ | |
| "https://ghcr.io/token?service=ghcr.io&scope=${SCOPE}" || true) | |
| REGISTRY_TOKEN=$(echo "${TOKEN_JSON}" | jq -r '.token // empty' 2>/dev/null) || true | |
| if [ -z "${REGISTRY_TOKEN}" ]; then | |
| echo "Failed to get GHCR registry token (tags list skipped)" | |
| MAX_VER="" | |
| else | |
| HTTP=$(curl -sS -o /tmp/ghcr-tags.json -w "%{http_code}" \ | |
| -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ | |
| "https://ghcr.io/v2/${IMAGE_LOWER}/tags/list?n=1000" || true) | |
| if [ "${HTTP}" = "200" ] && [ -s /tmp/ghcr-tags.json ]; then | |
| MAX_VER=$( | |
| jq -r '(.tags // [])[]' /tmp/ghcr-tags.json | while read -r t; do | |
| [[ "${t}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+ ]] || continue | |
| [ "${t}" = "latest" ] && continue | |
| echo "${t#v}" | |
| done | sort -V | tail -1 || true | |
| ) | |
| else | |
| echo "Failed to get tags from GHCR: ${HTTP}" | |
| MAX_VER="" | |
| fi | |
| fi | |
| # Push :latest only when this release is strictly newer than the highest v* tag on GHCR. | |
| if [ -z "${MAX_VER}" ]; then | |
| PUSH_LATEST=true | |
| elif [ "${NEW_VER}" != "${MAX_VER}" ] && [ "$(printf '%s\n' "${MAX_VER}" "${NEW_VER}" | sort -V | tail -1)" = "${NEW_VER}" ]; then | |
| PUSH_LATEST=true | |
| else | |
| PUSH_LATEST=false | |
| fi | |
| { | |
| echo "tags<<__TAGS__" | |
| echo "${FULL_IMAGE}:${REF_TAG}" | |
| if [ "${PUSH_LATEST}" = true ]; then | |
| echo "${FULL_IMAGE}:latest" | |
| fi | |
| echo "__TAGS__" | |
| } >> "${GITHUB_OUTPUT}" | |
| echo "PUSH_LATEST=${PUSH_LATEST} (existing max semver on GHCR: ${MAX_VER:-<none>}, this tag: ${REF_TAG})" | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} |