chore: pin github actions to commit shas #59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push Docker Container | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| packages: write | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 | |
| - name: Extract versions from Dockerfile | |
| id: versions | |
| run: | | |
| RUST_VERSION=$(grep -E '^[[:space:]]*RUST_VERSION=' Dockerfile | head -1 | cut -d'=' -f2) | |
| NODE_VERSION=$(grep -E '^ENV NODE_VERSION=' Dockerfile | head -1 | cut -d'=' -f2) | |
| IMAGE_VERSION="bookworm_rust_${RUST_VERSION}-node_${NODE_VERSION}" | |
| echo "rust_version=${RUST_VERSION}" >> $GITHUB_OUTPUT | |
| echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT | |
| echo "image_version=${IMAGE_VERSION}" >> $GITHUB_OUTPUT | |
| echo "Detected versions: Rust ${RUST_VERSION}, Node ${NODE_VERSION}" | |
| echo "Image version: ${IMAGE_VERSION}" | |
| - name: Validate extracted versions | |
| run: | | |
| RUST_VERSION="${{ steps.versions.outputs.rust_version }}" | |
| NODE_VERSION="${{ steps.versions.outputs.node_version }}" | |
| IMAGE_VERSION="${{ steps.versions.outputs.image_version }}" | |
| # Check RUST_VERSION is not empty and matches version pattern | |
| if [ -z "$RUST_VERSION" ]; then | |
| echo "::error::Failed to extract RUST_VERSION from Dockerfile" | |
| exit 1 | |
| fi | |
| if ! echo "$RUST_VERSION" | grep -qE '^[0-9]+\.[0-9]+'; then | |
| echo "::error::RUST_VERSION '$RUST_VERSION' does not match expected pattern (e.g., 1.88)" | |
| exit 1 | |
| fi | |
| # Check NODE_VERSION is not empty and matches version pattern | |
| if [ -z "$NODE_VERSION" ]; then | |
| echo "::error::Failed to extract NODE_VERSION from Dockerfile" | |
| exit 1 | |
| fi | |
| if ! echo "$NODE_VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then | |
| echo "::error::NODE_VERSION '$NODE_VERSION' does not match expected pattern (e.g., 22.17.1)" | |
| exit 1 | |
| fi | |
| # Validate final image version format | |
| if ! echo "$IMAGE_VERSION" | grep -qE '^bookworm_rust_[0-9]+\.[0-9]+-node_[0-9]+\.[0-9]+\.[0-9]+$'; then | |
| echo "::error::IMAGE_VERSION '$IMAGE_VERSION' does not match expected format" | |
| exit 1 | |
| fi | |
| echo "Validation passed:" | |
| echo " RUST_VERSION: $RUST_VERSION" | |
| echo " NODE_VERSION: $NODE_VERSION" | |
| echo " IMAGE_VERSION: $IMAGE_VERSION" | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0 | |
| - name: Login to GitHub Container Registry | |
| if: github.event_name == 'push' | |
| run: echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin | |
| - name: Build and push multi-platform Docker image | |
| run: | | |
| # Build and tag the Docker image with the version | |
| docker buildx create --use | |
| if [ "${{ github.event_name }}" = "push" ]; then | |
| docker buildx build --push \ | |
| --tag ghcr.io/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]'):${{ steps.versions.outputs.image_version }} \ | |
| --platform linux/amd64,linux/arm64 . | |
| else | |
| docker buildx build \ | |
| --platform linux/amd64,linux/arm64 . | |
| fi | |
| env: | |
| DOCKER_CLI_ACI_AS_TEXT: "true" |