Version gating test3 #129
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Publish | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - 'main' | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: read | |
| packages: write | |
| # Serialize publish runs per ref so mutable tags (e.g. :main) apply in order. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| # Build each architecture on a native runner (no QEMU emulation). | |
| build: | |
| name: Build ${{ matrix.platform }} | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - platform: linux/amd64 | |
| runner: ubuntu-24.04 | |
| - platform: linux/arm64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Normalize image name to lowercase | |
| id: image | |
| run: | | |
| # Registry refs must be lowercase; $GITHUB_REPOSITORY may not be. | |
| echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT" | |
| - name: Sanitize platform for artifact name | |
| id: prep | |
| run: | | |
| # Artifact names cannot contain "/", e.g. linux/amd64 -> linux-amd64 | |
| echo "pair=${platform//\//-}" >> "$GITHUB_OUTPUT" | |
| env: | |
| platform: ${{ matrix.platform }} | |
| - name: Install Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: .go-version | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Login to ghcr.io | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| # Labels only; tags are applied to the manifest list in the publish job. | |
| images: ${{ steps.image.outputs.name }} | |
| - name: Get version info | |
| id: version | |
| run: | | |
| if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then | |
| echo "ldflags=$(make print-version-ldflags VERSION=${GITHUB_REF_NAME} BRANCH=${GITHUB_REF_NAME})" | tee -a "$GITHUB_OUTPUT" | |
| else | |
| echo "ldflags=$(make print-version-ldflags BRANCH=${GITHUB_REF_NAME})" | tee -a "$GITHUB_OUTPUT" | |
| fi | |
| - name: Build and push (by digest) | |
| id: build | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| platforms: ${{ matrix.platform }} | |
| build-args: VERSION_LDFLAGS=${{ steps.version.outputs.ldflags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| # Inline provenance is incompatible with push-by-digest. Signed | |
| # provenance via actions/attest can be added when needed. | |
| provenance: false | |
| # On PR: build only (validate), do not push. | |
| # On push/tag: push by digest; tags are assembled in the publish job. | |
| outputs: >- | |
| ${{ github.event_name != 'pull_request' | |
| && format('type=image,name={0},push-by-digest=true,name-canonical=true,push=true', steps.image.outputs.name) | |
| || 'type=cacheonly' }} | |
| - name: Write digest for publish job | |
| if: github.event_name != 'pull_request' | |
| run: | | |
| mkdir -p "${RUNNER_TEMP}/digests" | |
| digest="${{ steps.build.outputs.digest }}" | |
| touch "${RUNNER_TEMP}/digests/${digest#sha256:}" | |
| - name: Upload digest | |
| if: github.event_name != 'pull_request' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: digests-${{ steps.prep.outputs.pair }} | |
| path: ${{ runner.temp }}/digests/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| # Assemble the per-arch digests into a single multi-arch manifest list and | |
| # apply the real tags. Runs only when we actually pushed (not on PRs). | |
| publish: | |
| name: Publish multi-arch manifest | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| needs: [build] | |
| if: github.event_name != 'pull_request' | |
| steps: | |
| - name: Normalize image name to lowercase | |
| id: image | |
| run: | | |
| # Registry refs must be lowercase; $GITHUB_REPOSITORY may not be. | |
| echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT" | |
| - name: Download digests | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: ${{ runner.temp }}/digests | |
| pattern: digests-* | |
| merge-multiple: true | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 | |
| - name: Login to ghcr.io | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Docker metadata (tags) | |
| id: meta | |
| uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 | |
| with: | |
| images: ${{ steps.image.outputs.name }} | |
| tags: | | |
| # Tag with branch name | |
| type=ref,event=branch | |
| # Tag with semver from git tag | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern=v{{version}} | |
| type=semver,pattern=v{{major}}.{{minor}} | |
| # Tag with short SHA | |
| type=sha,prefix= | |
| - name: Create manifest list and push | |
| working-directory: ${{ runner.temp }}/digests | |
| env: | |
| IMAGE: ${{ steps.image.outputs.name }} | |
| run: | | |
| docker buildx imagetools create \ | |
| $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | |
| $(printf "${IMAGE}@sha256:%s " *) |