11name : Docker
22
3- # This workflow uses actions that are not certified by GitHub.
4- # They are provided by a third-party and are governed by
5- # separate terms of service, privacy policy, and support
6- # documentation.
7-
83on :
94 push :
10- # Publish semver tags as releases.
11- tags : [ 'v*.*.*' ]
5+ tags : ['v*.*.*']
126
137env :
14- # Use docker.io for Docker Hub if empty
158 REGISTRY : ghcr.io
16- # github.repository as <account>/<repo>
179 IMAGE_NAME : ${{ github.repository }}
1810
19-
2011jobs :
2112 build :
22-
23- runs-on : ubuntu-latest
13+ runs-on : ${{ matrix.runner }}
2414 permissions :
2515 contents : read
2616 packages : write
27- # This is used to complete the identity challenge
28- # with sigstore/fulcio when running outside of PRs.
29- id-token : write
30-
17+ strategy :
18+ fail-fast : false
19+ matrix :
20+ include :
21+ - platform : linux/amd64
22+ runner : ubuntu-latest
23+ - platform : linux/arm64
24+ runner : ubuntu-24.04-arm
3125 steps :
3226 - name : Checkout repository
3327 uses : actions/checkout@v4
3428
3529 - name : Clean up disk space
3630 uses : jlumbroso/free-disk-space@main
3731
38- # Install the cosign tool except on PR
39- # https://github.com/sigstore/cosign-installer
40- - name : Install cosign
41- if : github.event_name != 'pull_request'
42- uses : sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
43- with :
44- cosign-release : ' v2.2.4'
45-
46- # Set up BuildKit Docker container builder to be able to build
47- # multi-platform images and export cache
48- # https://github.com/docker/setup-buildx-action
4932 - name : Set up Docker Buildx
50- uses : docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
33+ uses : docker/setup-buildx-action@v3
5134
52- # Login against a Docker registry except on PR
53- # https://github.com/docker/login-action
54- - name : Log into registry ${{ env.REGISTRY }}
55- if : github.event_name != 'pull_request'
56- uses : docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
35+ - name : Log into registry
36+ uses : docker/login-action@v3
5737 with :
5838 registry : ${{ env.REGISTRY }}
5939 username : ${{ github.actor }}
6040 password : ${{ secrets.GITHUB_TOKEN }}
6141
62- # Extract metadata (tags, labels) for Docker
63- # https://github.com/docker/metadata-action
6442 - name : Extract Docker metadata
6543 id : meta
66- uses : docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
44+ uses : docker/metadata-action@v5
6745 with :
6846 images : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
6947
70- # Build and push Docker image with Buildx (don't push on PR)
71- # https://github.com/docker/build-push-action
72- - name : Build and push Docker image
73- id : build-and-push
74- uses : docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
48+ - name : Prepare platform pair
49+ id : platform
50+ run : echo "pair=${platform//\//-}" >> $GITHUB_OUTPUT
51+ env :
52+ platform : ${{ matrix.platform }}
53+
54+ - name : Build and push by digest
55+ id : build
56+ uses : docker/build-push-action@v5
7557 with :
7658 context : .
77- push : ${{ github.event_name != 'pull_request' }}
78- tags : ${{ steps.meta.outputs.tags }}
79- labels : ${{ steps.meta.outputs.labels }}
80- cache-from : type=gha
81- cache-to : type=gha,mode=max
59+ file : .devcontainer/Dockerfile
60+ platforms : ${{ matrix.platform }}
61+ outputs : type=image,name= ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
62+ cache-from : type=gha,scope=${{ steps.platform.outputs.pair }}
63+ cache-to : type=gha,mode=max,scope=${{ steps.platform.outputs.pair }}
8264
83- - name : Free disk space after Docker build
65+ - name : Export digest
8466 run : |
85- docker buildx ls --format '{{.Name}}' | grep -v default | xargs -I {} docker buildx rm {} 2>/dev/null || true
86- docker system prune -af --volumes
87- docker builder prune -af
67+ mkdir -p /tmp/digests
68+ digest="${{ steps.build.outputs.digest }}"
69+ touch "/tmp/digests/${digest#sha256:}"
70+
71+ name : Upload digest
72+ uses : actions/upload-artifact@v4
73+ with :
74+ name : digest-${{ steps.platform.outputs.pair }}
75+ path : /tmp/digests/*
76+ if-no-files-found : error
77+ retention-days : 1
8878
89- rm -rf ~/.docker/buildx || true
90- rm -rf /tmp/docker-actions-toolkit-*/* 2>/dev/null || true
79+ merge :
80+ runs-on : ubuntu-latest
81+ needs : build
82+ permissions :
83+ contents : read
84+ packages : write
85+ steps :
86+ - name : Download digests
87+ uses : actions/download-artifact@v4
88+ with :
89+ path : /tmp/digests
90+ pattern : digest-*
91+ merge-multiple : true
92+
93+ - name : Log into registry
94+ uses : docker/login-action@v3
95+ with :
96+ registry : ${{ env.REGISTRY }}
97+ username : ${{ github.actor }}
98+ password : ${{ secrets.GITHUB_TOKEN }}
9199
92- df -h /
100+ - name : Extract Docker metadata
101+ id : meta
102+ uses : docker/metadata-action@v5
103+ with :
104+ images : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
93105
94- id : lower-repo
95- name : Repository to lowercase
106+ - name : Create manifest list and push
107+ working-directory : /tmp/digests
96108 run : |
97- echo "repository=${GITHUB_REPOSITORY@L}" >> $GITHUB_OUTPUT
109+ docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
110+ $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
111+
112+ apptainer :
113+ runs-on : ubuntu-latest
114+ needs : merge
115+ permissions :
116+ contents : read
117+ packages : write
118+ steps :
119+ - name : Checkout repository
120+ uses : actions/checkout@v4
121+
122+ - name : Clean up disk space
123+ uses : jlumbroso/free-disk-space@main
124+
125+ - name : Extract Docker metadata
126+ id : meta
127+ uses : docker/metadata-action@v5
128+ with :
129+ images : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
130+
131+ - name : Repository to lowercase
132+ id : lower-repo
133+ run : echo "repository=${GITHUB_REPOSITORY@L}" >> $GITHUB_OUTPUT
98134
99- # Build and push .sif files for Apptainer
100135 - name : Setup Apptainer
101136 uses : eWaterCycle/setup-apptainer@v2
137+
102138 - name : Build and push Apptainer
103139 env :
104140 TAGS : ${{ steps.meta.outputs.tags }}
105141 run : |
106- echo ${{ secrets.GITHUB_TOKEN }} | apptainer registry login -u ${{ secrets.GHCR_USERNAME }} --password-stdin docker://ghcr.io
107- apptainer build container.sif docker://${{ env.REGISTRY }}/${{ steps.lower-repo.outputs.repository }}:latest
108- echo "${TAGS}" | xargs -I {} apptainer push container.sif oras://{}-sif
142+ echo ${{ secrets.GITHUB_TOKEN }} | apptainer registry login -u ${{ secrets.GHCR_USERNAME }} --password-stdin docker://ghcr.io
143+ apptainer build container.sif docker://${{ env.REGISTRY }}/${{ steps.lower-repo.outputs.repository }}:latest
144+ echo "${TAGS}" | xargs -I {} apptainer push container.sif oras://{}-sif
0 commit comments