Docker #697
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| # Build, publish and sign the container image. | |
| # | |
| # Every step lives in the shared reusable workflow | |
| # netresearch/.github/.github/workflows/build-container-bake.yml — this file | |
| # only supplies configuration. The build itself is driven by docker-bake.hcl. | |
| # | |
| # NOTE: as of this workflow, the image is published to GitHub Container | |
| # Registry ONLY. The Docker Hub mirror (docker.io/netresearch/docker-mariadb) | |
| # is no longer updated. | |
| on: | |
| schedule: | |
| - cron: '16 14 * * *' | |
| push: | |
| branches: [ master ] | |
| pull_request: | |
| branches: [ master ] | |
| permissions: {} | |
| jobs: | |
| build: | |
| uses: netresearch/.github/.github/workflows/build-container-bake.yml@main | |
| # A called workflow's job permissions are validated statically at startup, | |
| # so the caller must grant the union of everything the reusable declares — | |
| # including security-events: write, even with scan disabled. | |
| permissions: | |
| contents: read | |
| packages: write | |
| security-events: write | |
| id-token: write | |
| with: | |
| targets: app | |
| # metadata-action writes its tag/label bake files to local $RUNNER_TEMP | |
| # paths; without this, bake would build from the git remote context and | |
| # fail to find them. | |
| bake-source: "." | |
| registry: ghcr.io | |
| metadata-images: ghcr.io/${{ github.repository }} | |
| # Reproduces metadata-action's default tag set plus the previous | |
| # `flavor: latest=true` (type=raw has the lowest priority, so `latest` | |
| # stays a secondary tag and the OCI version label is unchanged). | |
| metadata-tags: | | |
| type=schedule | |
| type=ref,event=branch | |
| type=ref,event=tag | |
| type=ref,event=pr | |
| type=raw,value=latest | |
| # An explicit tag list leaves metadata-action's flavor at `latest=auto`, | |
| # which appends `latest` again on a tag push. The explicit type=raw above | |
| # already reproduces the previous `flavor: latest=true` on every event, | |
| # so turn the implicit one off to emit exactly one `latest`. | |
| metadata-flavor: latest=false | |
| push: ${{ github.event_name != 'pull_request' }} | |
| # Cosign keyless (OIDC) signing, as before. Only runs when push is true. | |
| sign: true | |
| # Container scanning already runs in ci.yml (docker-image-ci -> | |
| # build-container, scan: true); the publish workflow never scanned. | |
| scan: false | |
| # Cache only on pull_request. Any run that PUBLISHES must rebuild for | |
| # real: with cache-from a push build restores the layer chain from | |
| # before the nightly's `apt upgrade`, and would overwrite `:latest` / | |
| # `:master` with a LESS patched image than the nightly just published. | |
| cache: ${{ github.event_name == 'pull_request' }} |