Publish GHCR Images #21
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish GHCR Images | |
| on: | |
| push: | |
| branches: ["main", "intarweb-dev"] | |
| tags: ["v*"] | |
| workflow_dispatch: | |
| concurrency: | |
| group: publish-ghcr-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| packages: write | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Derive lowercase owner | |
| id: vars | |
| run: echo "owner_lc=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_OUTPUT" | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/${{ steps.vars.outputs.owner_lc }}/retrosavemanager | |
| tags: | | |
| type=sha,format=long,prefix=sha- | |
| type=ref,event=tag | |
| type=raw,value=latest,enable=${{ github.ref == 'refs/heads/intarweb-dev' }} | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: ./backend/Dockerfile | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| - name: Verify latest label revision | |
| if: github.ref == 'refs/heads/intarweb-dev' | |
| env: | |
| EXPECTED_SHA: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| image="ghcr.io/${{ steps.vars.outputs.owner_lc }}/retrosavemanager:latest" | |
| docker buildx imagetools inspect "$image" --format '{{json .Manifest}}' > manifest.json | |
| amd64_digest="$(python3 - <<'PY' | |
| import json | |
| with open("manifest.json", "r", encoding="utf-8") as fh: | |
| manifest = json.load(fh) | |
| for item in manifest["manifests"]: | |
| platform = item.get("platform") or {} | |
| if platform.get("os") == "linux" and platform.get("architecture") == "amd64": | |
| print(item["digest"]) | |
| break | |
| else: | |
| raise SystemExit("linux/amd64 manifest not found") | |
| PY | |
| )" | |
| docker buildx imagetools inspect "${image}@${amd64_digest}" --format '{{json .Image}}' > image.json | |
| actual_sha="$(python3 - <<'PY' | |
| import json | |
| with open("image.json", "r", encoding="utf-8") as fh: | |
| image = json.load(fh) | |
| print((image.get("config") or {}).get("Labels", {}).get("org.opencontainers.image.revision", "")) | |
| PY | |
| )" | |
| test "$actual_sha" = "$EXPECTED_SHA" |