Initial commit #2
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Create and publish Docker images | |
| on: | |
| push: | |
| branches: ['production'] | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAMES: debian ubuntu | |
| TARGET_PLATFORMS: linux/amd64,linux/arm64,linux/arm/v7 | |
| jobs: | |
| build-and-push-images: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v2 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v2 | |
| with: | |
| buildkitd-flags: --allow-insecure-entitlement network --allow-insecure-entitlement security | |
| - name: Create a new builder instance | |
| run: | | |
| docker buildx create --use --name multi-arch-builder | |
| - name: Inspect builder instance | |
| run: docker buildx inspect --bootstrap | |
| - name: Extract version from build.json | |
| id: extract_version | |
| run: | | |
| VERSION=$(jq -r '.latest' build.json) | |
| echo "VERSION=${VERSION}" >> $GITHUB_ENV | |
| - name: Build and push Docker images | |
| run: | | |
| ORG_NAME=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]') | |
| VERSION=${{ env.VERSION }} | |
| for IMAGE_NAME in ${{ env.IMAGE_NAMES }}; do | |
| echo "Building and pushing $IMAGE_NAME:$VERSION for multiple architectures" | |
| docker buildx build --platform ${{ env.TARGET_PLATFORMS }} -t ${{ env.REGISTRY }}/${ORG_NAME}/${IMAGE_NAME}:${VERSION} images/${IMAGE_NAME} --push | |
| done | |
| - name: Generate artifact attestations for Docker images | |
| run: | | |
| ORG_NAME=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]') | |
| VERSION=${{ env.VERSION }} | |
| for IMAGE_NAME in ${{ env.IMAGE_NAMES }}; do | |
| IMAGE_TAG=${{ env.REGISTRY }}/${ORG_NAME}/${IMAGE_NAME}:${VERSION} | |
| IMAGE_DIGEST=$(docker buildx imagetools inspect ${IMAGE_TAG} --format '{{json .}}' | jq -r '.manifests[0].digest') | |
| echo $IMAGE_DIGEST > ${IMAGE_NAME}_${VERSION}_attestation.txt | |
| done | |
| - name: Upload attestations | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: image-attestations | |
| path: | | |
| $(for IMAGE_NAME in ${{ env.IMAGE_NAMES }}; do echo "${IMAGE_NAME}_${VERSION}_attestation.txt"; done) |