Skip to content

CD -> Container

CD -> Container #16

Workflow file for this run

name: 'CD -> Container'
on:
workflow_dispatch:
push:
branches: ['stable']
concurrency:
group: '${{ github.workflow }}-${{ github.ref }}'
cancel-in-progress: false
permissions:
contents: read
jobs:
build:
if: ${{ github.repository_owner == 'jspaste' }}
name: 'Build container image'
runs-on: ubuntu-latest
permissions:
id-token: write
packages: write
env:
REGISTRY: 'ghcr.io'
IMAGE_NAME: '${{ github.repository }}'
steps:
- name: 'Harden Runner'
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
with:
policy: cd-container
- name: 'Checkout'
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: 'Setup QEMU'
run: |
sudo apt-get update && sudo apt-get install -y qemu-user-static
- name: 'Setup tags'
id: setup_tags
run: |
TIMESTAMP="$(date +%Y.%m.%d)"
SHA_SHORT="${GITHUB_SHA::7}"
TAGS=()
TAGS+=("latest")
TAGS+=("${GITHUB_SHA}")
TAGS+=("${TIMESTAMP}-${SHA_SHORT}")
echo "build_tags=${TAGS[*]}" >> $GITHUB_OUTPUT
- name: 'Build image'
id: build_image
uses: redhat-actions/buildah-build@c79846fb306beeba490e89fb75d2d1af95831e79 # master (update to node20)
with:
containerfiles: Containerfile
image: ${{ env.IMAGE_NAME }}
platforms: 'linux/amd64, linux/arm64'
tags: ${{ steps.setup_tags.outputs.build_tags }}
oci: true
- name: 'Push to GHCR'
uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2.7.1
env:
REGISTRY_USER: ${{ github.actor }}
REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
with:
image: ${{ steps.build_image.outputs.image }}
tags: ${{ steps.build_image.outputs.tags }}
registry: ${{ env.REGISTRY }}
username: ${{ env.REGISTRY_USER }}
password: ${{ env.REGISTRY_PASSWORD }}