@@ -6,89 +6,85 @@ name: Docker
6
6
# documentation.
7
7
8
8
on :
9
- push :
10
- branches : [ "main" ]
11
- pull_request :
12
- branches : [ "main" ]
9
+ push :
10
+ branches : ["main"]
11
+ pull_request :
12
+ branches : ["main"]
13
13
14
14
env :
15
- # Use docker.io for Docker Hub if empty
16
- REGISTRY : ghcr.io
17
- # github.repository as <account>/<repo>
18
- IMAGE_NAME : ${{ github.repository }}
19
-
15
+ # Use docker.io for Docker Hub if empty
16
+ REGISTRY : ghcr.io
17
+ # github.repository as <account>/<repo>
18
+ IMAGE_NAME : ${{ github.repository }}
20
19
21
20
jobs :
22
- build :
23
-
24
- runs-on : ubuntu-latest
25
- permissions :
26
- contents : read
27
- packages : write
28
- # This is used to complete the identity challenge
29
- # with sigstore/fulcio when running outside of PRs.
30
- id-token : write
31
-
32
- steps :
33
- - name : Checkout repository
34
- uses : actions/checkout@v3
35
-
36
- # Install the cosign tool except on PR
37
- # https://github.com/sigstore/cosign-installer
38
- - name : Install cosign
39
- if : github.event_name != 'pull_request'
40
- uses : sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 # v2.6.0
41
- with :
42
- cosign-release : ' v1.13.1'
21
+ build :
22
+ runs-on : ubuntu-latest
23
+ permissions :
24
+ contents : read
25
+ packages : write
26
+ # This is used to complete the identity challenge
27
+ # with sigstore/fulcio when running outside of PRs.
28
+ id-token : write
43
29
30
+ steps :
31
+ - name : Checkout repository
32
+ uses : actions/checkout@v3
44
33
45
- # Workaround: https://github.com/docker/build-push-action/issues/461
46
- - name : Setup Docker buildx
47
- uses : docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
34
+ # Install the cosign tool except on PR
35
+ # https://github.com/sigstore/cosign-installer
36
+ - name : Install cosign
37
+ if : github.event_name != 'pull_request'
38
+ uses : sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 # v2.6.0
39
+ with :
40
+ cosign-release : " v1.13.1"
48
41
49
- # Login against a Docker registry except on PR
50
- # https://github.com/docker/login-action
51
- - name : Log into registry ${{ env.REGISTRY }}
52
- if : github.event_name != 'pull_request'
53
- uses : docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
54
- with :
55
- registry : ${{ env.REGISTRY }}
56
- username : ${{ github.actor }}
57
- password : ${{ secrets.GITHUB_TOKEN }}
42
+ # Workaround: https://github.com/docker/build-push-action/issues/461
43
+ - name : Setup Docker buildx
44
+ uses : docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
58
45
59
- # Extract metadata (tags, labels) for Docker
60
- # https://github.com/docker/metadata -action
61
- - name : Extract Docker metadata
62
- id : meta
63
- uses : docker/metadata -action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
64
- with :
65
- images : ${{ env.REGISTRY }}/ ${{ env.IMAGE_NAME }}
66
- tags : |
67
- type=sha
46
+ # Login against a Docker registry except on PR
47
+ # https://github.com/docker/login -action
48
+ - name : Log into registry ${{ env.REGISTRY }}
49
+ if : github.event_name != 'pull_request'
50
+ uses : docker/login -action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
51
+ with :
52
+ registry : ${{ env.REGISTRY }}
53
+ username : ${{ github.actor }}
54
+ password : ${{ secrets.GITHUB_TOKEN }}
68
55
69
- # Build and push Docker image with Buildx (don't push on PR)
70
- # https://github.com/docker/build-push-action
71
- - name : Build and push Docker image
72
- id : build-and-push
73
- uses : docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
74
- with :
75
- context : .
76
- push : ${{ github.event_name != 'pull_request' }}
77
- tags : ${{ steps.meta.outputs.tags }}
78
- labels : ${{ steps.meta.outputs.labels }}
79
- cache-from : type=gha
80
- cache-to : type=gha,mode=max
56
+ # Extract metadata (tags, labels) for Docker
57
+ # https://github.com/docker/metadata-action
58
+ - name : Extract Docker metadata
59
+ id : meta
60
+ uses : docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
61
+ with :
62
+ images : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
63
+ tags : |
64
+ type=sha
81
65
66
+ # Build and push Docker image with Buildx (don't push on PR)
67
+ # https://github.com/docker/build-push-action
68
+ - name : Build and push Docker image
69
+ id : build-and-push
70
+ uses : docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
71
+ with :
72
+ context : .
73
+ push : ${{ github.event_name != 'pull_request' }}
74
+ tags : ${{ steps.meta.outputs.tags }}
75
+ labels : ${{ steps.meta.outputs.labels }}
76
+ cache-from : type=gha
77
+ cache-to : type=gha,mode=max
82
78
83
- # Sign the resulting Docker image digest except on PRs.
84
- # This will only write to the public Rekor transparency log when the Docker
85
- # repository is public to avoid leaking data. If you would like to publish
86
- # transparency data even for private images, pass --force to cosign below.
87
- # https://github.com/sigstore/cosign
88
- - name : Sign the published Docker image
89
- if : ${{ github.event_name != 'pull_request' }}
90
- env :
91
- COSIGN_EXPERIMENTAL : " true"
92
- # This step uses the identity token to provision an ephemeral certificate
93
- # against the sigstore community Fulcio instance.
94
- run : echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
79
+ # Sign the resulting Docker image digest except on PRs.
80
+ # This will only write to the public Rekor transparency log when the Docker
81
+ # repository is public to avoid leaking data. If you would like to publish
82
+ # transparency data even for private images, pass --force to cosign below.
83
+ # https://github.com/sigstore/cosign
84
+ - name : Sign the published Docker image
85
+ if : ${{ github.event_name != 'pull_request' }}
86
+ env :
87
+ COSIGN_EXPERIMENTAL : " true"
88
+ # This step uses the identity token to provision an ephemeral certificate
89
+ # against the sigstore community Fulcio instance.
90
+ run : echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
0 commit comments