|
|
|
@@ -13,17 +13,17 @@ concurrency:
|
|
|
|
|
cancel-in-progress: true
|
|
|
|
|
|
|
|
|
|
env:
|
|
|
|
|
DOCKERHUB_IMAGE: amruthpillai/reactive-resume
|
|
|
|
|
GHCR_IMAGE: ${{ github.repository }}
|
|
|
|
|
IMAGE: ${{ github.repository }}
|
|
|
|
|
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
|
|
|
|
|
|
|
|
|
|
jobs:
|
|
|
|
|
mode:
|
|
|
|
|
runs-on: blacksmith-16vcpu-ubuntu-2404
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
|
|
|
|
|
outputs:
|
|
|
|
|
nightly: ${{ steps.mode.outputs.nightly }}
|
|
|
|
|
release: ${{ steps.mode.outputs.release }}
|
|
|
|
|
matrix: ${{ steps.mode.outputs.matrix }}
|
|
|
|
|
|
|
|
|
|
steps:
|
|
|
|
|
- name: Determine publishing mode
|
|
|
|
@@ -32,9 +32,11 @@ jobs:
|
|
|
|
|
if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
|
|
|
|
|
echo "nightly=true" >> "$GITHUB_OUTPUT"
|
|
|
|
|
echo "release=false" >> "$GITHUB_OUTPUT"
|
|
|
|
|
echo 'matrix={"include":[{"platform":"linux/amd64","runner":"ubuntu-latest","arch":"amd64"}]}' >> "$GITHUB_OUTPUT"
|
|
|
|
|
else
|
|
|
|
|
echo "nightly=false" >> "$GITHUB_OUTPUT"
|
|
|
|
|
echo "release=true" >> "$GITHUB_OUTPUT"
|
|
|
|
|
echo 'matrix={"include":[{"platform":"linux/amd64","runner":"ubuntu-latest","arch":"amd64"},{"platform":"linux/arm64","runner":"ubuntu-24.04-arm","arch":"arm64"}]}' >> "$GITHUB_OUTPUT"
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
build:
|
|
|
|
@@ -42,14 +44,7 @@ jobs:
|
|
|
|
|
|
|
|
|
|
strategy:
|
|
|
|
|
fail-fast: false
|
|
|
|
|
matrix:
|
|
|
|
|
include:
|
|
|
|
|
- platform: linux/amd64
|
|
|
|
|
runner: blacksmith-16vcpu-ubuntu-2404
|
|
|
|
|
arch: amd64
|
|
|
|
|
- platform: linux/arm64
|
|
|
|
|
runner: blacksmith-16vcpu-ubuntu-2404-arm
|
|
|
|
|
arch: arm64
|
|
|
|
|
matrix: ${{ fromJSON(needs.mode.outputs.matrix) }}
|
|
|
|
|
|
|
|
|
|
runs-on: ${{ matrix.runner }}
|
|
|
|
|
timeout-minutes: 30
|
|
|
|
@@ -64,17 +59,15 @@ jobs:
|
|
|
|
|
- name: Checkout Repository
|
|
|
|
|
uses: actions/checkout@v6
|
|
|
|
|
|
|
|
|
|
- name: Setup Docker Buildx
|
|
|
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
|
|
|
|
|
|
- name: Login to Docker Hub
|
|
|
|
|
uses: docker/login-action@v4
|
|
|
|
|
with:
|
|
|
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
|
|
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
|
|
|
|
|
|
|
|
|
- name: Setup Blacksmith Docker Builder
|
|
|
|
|
uses: useblacksmith/setup-docker-builder@v2
|
|
|
|
|
with:
|
|
|
|
|
cache-key: Dockerfile-${{ matrix.arch }}
|
|
|
|
|
|
|
|
|
|
- name: Login to GitHub Container Registry
|
|
|
|
|
uses: docker/login-action@v4
|
|
|
|
|
with:
|
|
|
|
@@ -87,14 +80,14 @@ jobs:
|
|
|
|
|
uses: docker/metadata-action@v6
|
|
|
|
|
with:
|
|
|
|
|
images: |
|
|
|
|
|
ghcr.io/${{ env.GHCR_IMAGE }}
|
|
|
|
|
docker.io/${{ env.DOCKERHUB_IMAGE }}
|
|
|
|
|
ghcr.io/${{ env.IMAGE }}
|
|
|
|
|
docker.io/${{ env.IMAGE }}
|
|
|
|
|
tags: |
|
|
|
|
|
type=sha,prefix=sha-,suffix=-${{ matrix.arch }}
|
|
|
|
|
|
|
|
|
|
- name: Build and Push by Digest
|
|
|
|
|
id: build
|
|
|
|
|
uses: useblacksmith/build-push-action@v2
|
|
|
|
|
uses: docker/build-push-action@v7
|
|
|
|
|
with:
|
|
|
|
|
context: .
|
|
|
|
|
sbom: true
|
|
|
|
@@ -104,6 +97,8 @@ jobs:
|
|
|
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
|
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
|
|
|
annotations: ${{ steps.meta.outputs.annotations }}
|
|
|
|
|
cache-from: type=gha,scope=${{ env.IMAGE }}-${{ matrix.arch }}
|
|
|
|
|
cache-to: type=gha,mode=max,scope=${{ env.IMAGE }}-${{ matrix.arch }}
|
|
|
|
|
|
|
|
|
|
- name: Export digest
|
|
|
|
|
run: |
|
|
|
|
@@ -124,7 +119,7 @@ jobs:
|
|
|
|
|
- mode
|
|
|
|
|
- build
|
|
|
|
|
timeout-minutes: 30
|
|
|
|
|
runs-on: blacksmith-16vcpu-ubuntu-2404
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
|
|
|
|
|
permissions:
|
|
|
|
|
contents: read
|
|
|
|
@@ -181,8 +176,8 @@ jobs:
|
|
|
|
|
uses: docker/metadata-action@v6
|
|
|
|
|
with:
|
|
|
|
|
images: |
|
|
|
|
|
ghcr.io/${{ env.GHCR_IMAGE }}
|
|
|
|
|
docker.io/${{ env.DOCKERHUB_IMAGE }}
|
|
|
|
|
ghcr.io/${{ env.IMAGE }}
|
|
|
|
|
docker.io/${{ env.IMAGE }}
|
|
|
|
|
tags: |
|
|
|
|
|
type=sha,prefix=sha-
|
|
|
|
|
type=raw,value=nightly,enable=${{ needs.mode.outputs.nightly == 'true' }}
|
|
|
|
@@ -212,14 +207,14 @@ jobs:
|
|
|
|
|
--annotation "index:org.opencontainers.image.vendor=Amruth Pillai" \
|
|
|
|
|
--annotation "index:org.opencontainers.image.url=https://rxresu.me" \
|
|
|
|
|
--annotation "index:org.opencontainers.image.documentation=https://docs.rxresu.me" \
|
|
|
|
|
--annotation "index:org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}" \
|
|
|
|
|
--annotation "index:org.opencontainers.image.source=https://github.com/amruthpillai/reactive-resume" \
|
|
|
|
|
--annotation "index:org.opencontainers.image.version=${{ steps.version.outputs.version }}" \
|
|
|
|
|
$(printf 'ghcr.io/${{ env.GHCR_IMAGE }}@sha256:%s ' *) \
|
|
|
|
|
$(printf 'docker.io/${{ env.DOCKERHUB_IMAGE }}@sha256:%s ' *)
|
|
|
|
|
$(printf 'ghcr.io/${{ env.IMAGE }}@sha256:%s ' *) \
|
|
|
|
|
$(printf 'docker.io/${{ env.IMAGE }}@sha256:%s ' *)
|
|
|
|
|
|
|
|
|
|
# Get the digest of the multi-arch manifest
|
|
|
|
|
GHCR_DIGEST=$(docker buildx imagetools inspect ghcr.io/${{ env.GHCR_IMAGE }}:${FINAL_TAG} --format '{{json .Manifest.Digest}}' | tr -d '"')
|
|
|
|
|
DOCKER_DIGEST=$(docker buildx imagetools inspect docker.io/${{ env.DOCKERHUB_IMAGE }}:${FINAL_TAG} --format '{{json .Manifest.Digest}}' | tr -d '"')
|
|
|
|
|
GHCR_DIGEST=$(docker buildx imagetools inspect ghcr.io/${{ env.IMAGE }}:${FINAL_TAG} --format '{{json .Manifest.Digest}}' | tr -d '"')
|
|
|
|
|
DOCKER_DIGEST=$(docker buildx imagetools inspect docker.io/${{ env.IMAGE }}:${FINAL_TAG} --format '{{json .Manifest.Digest}}' | tr -d '"')
|
|
|
|
|
echo "final_tag=$FINAL_TAG" >> "$GITHUB_OUTPUT"
|
|
|
|
|
echo "ghcr_digest=$GHCR_DIGEST" >> "$GITHUB_OUTPUT"
|
|
|
|
|
echo "docker_digest=$DOCKER_DIGEST" >> "$GITHUB_OUTPUT"
|
|
|
|
@@ -230,15 +225,15 @@ jobs:
|
|
|
|
|
- name: Sign images with Cosign
|
|
|
|
|
run: |
|
|
|
|
|
# Sign GHCR image
|
|
|
|
|
cosign sign --yes ghcr.io/${{ env.GHCR_IMAGE }}@${{ steps.manifest.outputs.ghcr_digest }}
|
|
|
|
|
cosign sign --yes ghcr.io/${{ env.IMAGE }}@${{ steps.manifest.outputs.ghcr_digest }}
|
|
|
|
|
|
|
|
|
|
# Sign Docker Hub image
|
|
|
|
|
cosign sign --yes docker.io/${{ env.DOCKERHUB_IMAGE }}@${{ steps.manifest.outputs.docker_digest }}
|
|
|
|
|
cosign sign --yes docker.io/${{ env.IMAGE }}@${{ steps.manifest.outputs.docker_digest }}
|
|
|
|
|
|
|
|
|
|
- name: Inspect image
|
|
|
|
|
run: |
|
|
|
|
|
docker buildx imagetools inspect ghcr.io/${{ env.GHCR_IMAGE }}:${{ steps.manifest.outputs.final_tag }}
|
|
|
|
|
docker buildx imagetools inspect docker.io/${{ env.DOCKERHUB_IMAGE }}:${{ steps.manifest.outputs.final_tag }}
|
|
|
|
|
docker buildx imagetools inspect ghcr.io/${{ env.IMAGE }}:${{ steps.manifest.outputs.final_tag }}
|
|
|
|
|
docker buildx imagetools inspect docker.io/${{ env.IMAGE }}:${{ steps.manifest.outputs.final_tag }}
|
|
|
|
|
|
|
|
|
|
- name: Redeploy Stack
|
|
|
|
|
if: ${{ needs.mode.outputs.release == 'true' }}
|
|
|
|
|