Build and Push image #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push image | |
| # Pull-based deploy: this workflow builds + pushes version-compatible web and | |
| # workers images to GHCR. The VPS runs Watchtower, which polls those tags and | |
| # redeploys both Karakeep services without an inbound SSH deploy step. | |
| on: | |
| workflow_run: | |
| workflows: | |
| - CI | |
| types: | |
| - completed | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: build-and-push-main | |
| cancel-in-progress: false | |
| jobs: | |
| build: | |
| if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Prepare image metadata | |
| id: meta | |
| run: | | |
| set -euo pipefail | |
| image_name="ghcr.io/${{ github.repository_owner }}/karakeep" | |
| short_sha="$(git rev-parse --short=12 HEAD)" | |
| { | |
| echo "image_name=${image_name}" | |
| echo "sha_tag=sha-${short_sha}" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Build and push web image | |
| uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5 | |
| with: | |
| context: . | |
| file: docker/Dockerfile | |
| target: web | |
| platforms: linux/amd64 | |
| build-args: SERVER_VERSION=${{ github.event.workflow_run.head_sha || github.sha }} | |
| push: true | |
| tags: ${{ steps.meta.outputs.image_name }}:web-${{ steps.meta.outputs.sha_tag }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Build and push workers image | |
| uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5 | |
| with: | |
| context: . | |
| file: docker/Dockerfile | |
| target: workers | |
| platforms: linux/amd64 | |
| build-args: SERVER_VERSION=${{ github.event.workflow_run.head_sha || github.sha }} | |
| push: true | |
| tags: ${{ steps.meta.outputs.image_name }}:workers-${{ steps.meta.outputs.sha_tag }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Promote paired release tags | |
| env: | |
| IMAGE_NAME: ${{ steps.meta.outputs.image_name }} | |
| SHA_TAG: ${{ steps.meta.outputs.sha_tag }} | |
| run: | | |
| set -euo pipefail | |
| docker buildx imagetools create \ | |
| --tag "${IMAGE_NAME}:web-main" \ | |
| "${IMAGE_NAME}:web-${SHA_TAG}" | |
| docker buildx imagetools create \ | |
| --tag "${IMAGE_NAME}:workers-main" \ | |
| "${IMAGE_NAME}:workers-${SHA_TAG}" |