contextfence/.github/workflows/container.yml at main · devectorio/contextfence · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: Container

on:
  push:
    branches:
      - main
    tags:
      - "v*.*.*"
  pull_request:
    paths:
      - Dockerfile
      - .dockerignore
      - docker/**
      - index.html
      - package.json
      - pnpm-lock.yaml
      - public/**
      - src/**
      - tsconfig*.json
      - vite.config.ts
      - .github/workflows/container.yml
  workflow_dispatch:

permissions: {}

concurrency:
  group: container-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  pull-request-build:
    name: Build without registry credentials
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read

    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Build pull request image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: Dockerfile
          platforms: linux/amd64
          push: false
          tags: contextfence:pr-check
          cache-from: type=gha
          cache-to: type=gha,mode=max

  publish:
    name: Build and publish trusted ref
    if: >-
      github.event_name != 'pull_request' &&
      github.repository == 'devectorio/contextfence' &&
      (github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main')
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write

    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Validate publish ref and image version
        shell: bash
        run: |
          if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
            if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "::error::Container release tags must be stable semantic versions."
              exit 1
            fi
            package_version="$(node -p "require('./package.json').version")"
            if [[ "$GITHUB_REF_NAME" != "v$package_version" ]]; then
              echo "::error::Tag $GITHUB_REF_NAME does not match package version $package_version."
              exit 1
            fi
            if ! grep -Fq "## [$package_version] - " CHANGELOG.md; then
              echo "::error::CHANGELOG.md has no dated $package_version release heading."
              exit 1
            fi
          elif [[ "$GITHUB_REF" != "refs/heads/main" ]]; then
            echo "::error::Non-tag container publishing is restricted to main."
            exit 1
          fi

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Generate image metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha

      - name: Build and publish image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: mode=max
          sbom: true