"Added permissions for contents and packages in next-build job in dep… #3
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker Build And Deploy | |
| on: | |
| push: | |
| branches: | |
| - prod | |
| pull_request: | |
| branches: | |
| - prod | |
| jobs: | |
| next-build: | |
| name: Build Image | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| # Step 1: Checkout the code from the repository | |
| - name: Checkout repository | |
| uses: actions/checkout@v3 | |
| # Step 2: Set up Docker Buildx for multi-platform builds (optional) | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # Step 3: Log in to GitHub Container Registry | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@v2 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ secrets.GHCR_USERNAME }} | |
| password: ${{ secrets.GHCR_TOKEN }} | |
| - name: Build and Push Docker Image | |
| env: | |
| ENV_FILE: ${{ secrets.DISCOVER_ENV_FILE }} | |
| run: | | |
| echo "$ENV_FILE" > .env | |
| export CURRENT_BRANCH=${GITHUB_REF#refs/heads/} | |
| export TAG=$([[ $CURRENT_BRANCH == $(basename ${{ github.ref }}) ]] && echo $CURRENT_BRANCH || echo "latest") | |
| echo $TAG | |
| export GITHUB_REF_IMAGE=ghcr.io/$GITHUB_REPOSITORY:$GITHUB_SHA | |
| export GITHUB_BRANCH_IMAGE=ghcr.io/$GITHUB_REPOSITORY:$TAG | |
| export GITHUB_REF_IMAGE=$(echo $GITHUB_REF_IMAGE | tr '[:upper:]' '[:lower:]') | |
| export GITHUB_BRANCH_IMAGE=$(echo $GITHUB_BRANCH_IMAGE | tr '[:upper:]' '[:lower:]') | |
| docker build --build-arg version=$GITHUB_SHA -t $GITHUB_REF_IMAGE -t $GITHUB_BRANCH_IMAGE . | |
| echo "Pushing Image to GitHub Container Registry" | |
| docker push $GITHUB_REF_IMAGE | |
| docker push $GITHUB_BRANCH_IMAGE | |
| rm -rf .env | |
| ghcr-push: | |
| needs: next-build # Job depends on next-build(above) job | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Deploy on Production server | |
| if: github.ref == 'refs/heads/prod' | |
| uses: appleboy/[email protected] | |
| with: | |
| host: ${{ secrets.REMOTE_SERVER_ADDRESS }} | |
| username: ${{ secrets.SERVER_USERNAME }} | |
| key: ${{ secrets.REMOTE_SERVER_KEY }} | |
| port: ${{ secrets.SSH_PORT }} | |
| script: | | |
| pwd | |
| cd ~/discover | |
| sudo docker stop discover && sudo docker rm discover && sudo docker rmi discover | |
| echo ${{ secrets.GHCR_TOKEN }} | sudo docker login ghcr.io -u ${{ secrets.GHCR_USERNAME }} --password-stdin | |
| sudo docker pull ghcr.io/myriadflow/discover:prod | |
| sudo docker run --name="discover" -p 9082:3000 -d ghcr.io/myriadflow/discover:prod |