Pyro/.github/workflows/docker-image.yml at master · sys27/Pyro · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: Build Docker Image CI

on:
  push:
    branches: [ "master" ]
  pull_request:
    branches: [ "master" ]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  GCR: ghcr.io
  IMAGE_NAME: sys27/pyro
  DOCKERHUB_USERNAME: sys27

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write

    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Login to Docker Hub
      uses: docker/login-action@v3
      if: github.ref == format('refs/heads/{0}', 'master')
      with:
        username: ${{ env.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Login to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.GCR }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Docker Metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: |
          name=${{ env.GCR }}/${{ env.IMAGE_NAME }},enable=true
          name=${{ env.IMAGE_NAME }},enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
        tags: |
          type=ref,event=branch
          type=ref,event=tag
          type=ref,event=pr
          type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}

    - name: Build images
      uses: docker/build-push-action@v6
      env:
        DOCKER_BUILD_SUMMARY: false
        DOCKER_BUILD_RECORD_UPLOAD: false
      with:
        platforms: linux/amd64,linux/arm64
        context: .
        push: false
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        annotations: ${{ steps.meta.outputs.annotations }}
        cache-from: type=gha
        cache-to: type=gha,mode=max

    - name: Export image to docker
      id: build
      uses: docker/build-push-action@v6
      env:
        DOCKER_BUILD_SUMMARY: false
        DOCKER_BUILD_RECORD_UPLOAD: false
      with:
        platforms: linux/amd64
        context: .
        push: false
        outputs: type=docker
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        annotations: ${{ steps.meta.outputs.annotations }}
        cache-from: type=gha
        cache-to: type=gha,mode=max

    - name: Build tests
      uses: docker/build-push-action@v6
      env:
        DOCKER_BUILD_SUMMARY: false
        DOCKER_BUILD_RECORD_UPLOAD: false
      with:
        platforms: linux/amd64
        context: .
        target: test
        push: false
        outputs: type=docker
        tags: tests-image
        cache-from: type=gha
        cache-to: type=gha,mode=max

    - name: Run tests
      run: >
        docker run --rm -t
        --name tests
        -e PYRO_IMAGE_ID=${{ steps.build.outputs.imageid }}
        -e GITHUB_SERVER_URL=$GITHUB_SERVER_URL
        -e GITHUB_REPOSITORY=$GITHUB_REPOSITORY
        -e GITHUB_WORKSPACE=$GITHUB_WORKSPACE
        -e GITHUB_SHA=$GITHUB_SHA
        -e GITHUB_STEP_SUMMARY=/summary
        -v /var/run/docker.sock:/var/run/docker.sock
        -v $GITHUB_STEP_SUMMARY:/summary
        tests-image

    - name: Push
      id: push
      uses: docker/build-push-action@v6
      with:
        platforms: linux/amd64,linux/arm64
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        annotations: ${{ steps.meta.outputs.annotations }}
        cache-from: type=gha
        cache-to: type=gha,mode=max

    - name: Generate artifact attestation
      uses: actions/attest-build-provenance@v1
      with:
        subject-name: ${{ env.GCR }}/${{ env.IMAGE_NAME }}
        subject-digest: ${{ steps.push.outputs.digest }}
        push-to-registry: true