Docker #19
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| on: | |
| workflow_dispatch: | |
| push: | |
| tags: [ 'v*.*.*' ] | |
| env: | |
| # Use docker.io for Docker Hub if empty | |
| REGISTRY: ghcr.io | |
| # github.repository as <account>/<repo> | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| # Install Nix | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@v27 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| # Build the Docker image using Nix flake | |
| - name: Build Docker image with Nix | |
| run: nix build .#docker --out-link ./docker-result | |
| # Log into the Docker registry | |
| - name: Log into registry ${{ env.REGISTRY }} | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Push the built Docker image to the registry | |
| - name: Push Docker image | |
| run: | | |
| REGISTRY=$(echo "${{ env.REGISTRY }}" | tr '[:upper:]' '[:lower:]') | |
| IMAGE_NAME=$(echo "${{ env.IMAGE_NAME }}" | tr '[:upper:]' '[:lower:]') | |
| docker load -i ./docker-result | |
| IMAGE_ID=$(docker images --format '{{.ID}}' | head -n 1) | |
| docker tag ${IMAGE_ID} ${REGISTRY}/${IMAGE_NAME}:latest | |
| docker push ${REGISTRY}/${IMAGE_NAME}:latest | |
| env: | |
| IMAGE_NAME: ${{ env.IMAGE_NAME}} | |
| REGISTRY: ${{ env.REGISTRY}} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Install Cosign | |
| - name: Install Cosign | |
| run: | | |
| curl -Lo cosign https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 | |
| chmod +x cosign | |
| sudo mv cosign /usr/local/bin/ | |
| # Sign the resulting Docker image digest | |
| - name: Sign the published Docker image | |
| env: | |
| TAGS: ${{ env.IMAGE_NAME}} | |
| run: | | |
| REGISTRY=$(echo "${{ env.REGISTRY }}" | tr '[:upper:]' '[:lower:]') | |
| IMAGE_NAME=$(echo "${{ env.IMAGE_NAME }}" | tr '[:upper:]' '[:lower:]') | |
| DIGEST=$(skopeo inspect docker://${REGISTRY}/${IMAGE_NAME}:latest --format "{{.Digest}}") | |
| echo "${IMAGE_NAME}" | xargs -I {} cosign sign --yes {}@${DIGEST} |