chore(ci): add GitHub Action for Docker build #21
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| # Based on GitHub actions starter workflow for Docker publishing: | |
| # https://github.com/actions/starter-workflows/blob/main/ci/docker-publish.yml | |
| # This workflow uses actions that are not certified by GitHub. | |
| # They are provided by a third-party and are governed by | |
| # separate terms of service, privacy policy, and support | |
| # documentation. | |
| on: | |
| schedule: | |
| # every day at 00:15 UTC | |
| - cron: '15 0 * * *' | |
| push: | |
| branches: | |
| - 'main' | |
| # Publish calver or pep440 tags as releases. | |
| tags: | |
| - '[0-9]+.[0-9]+.[0-9]+' | |
| - '[0-9]+.[0-9]+.[0-9]+rc[0-9]+' | |
| pull_request: | |
| branches: | |
| - 'main' | |
| env: | |
| # Use docker.io for Docker Hub if empty | |
| REGISTRY: ghcr.io | |
| # github.repository as <account>/<repo> | |
| IMAGE_NAME: ${{ github.repository }} | |
| # repository base URL | |
| REPO_README: ${{ github.server_url }}/${{ github.repository }}/blob/main/README.rst | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: | |
| # Distribute build across multiple runners, use a matrix strategy. | |
| # https://docs.docker.com/build/ci/github-actions/multi-platform | |
| - linux/amd64 | |
| - linux/arm/v7 | |
| - linux/arm64/v8 | |
| - linux/riscv64 | |
| - linux/ppc64le | |
| - linux/s390x | |
| steps: | |
| # Free Disk Space on Ubuntu runners, clear up to 35 GB disk space | |
| # https://github.com/jlumbroso/free-disk-space | |
| - name: Free disk space | |
| uses: jlumbroso/[email protected] | |
| with: | |
| # Tool cache: Saved 8.3GiB | |
| tool-cache: true | |
| # Android library: Saved 7.5GiB | |
| android: true | |
| # .NET runtime: Saved 1.6GiB | |
| dotnet: true | |
| # Haskell runtime: Saved 5.4GiB | |
| haskell: true | |
| # Large misc. packages: Saved 4.8GiB | |
| large-packages: true | |
| # Docker images: Saved 3.2GiB | |
| docker-images: true | |
| # Swap storage: Saved 4.0GiB | |
| swap-storage: true | |
| - name: Prepare GitHub runner environment | |
| run: | | |
| platform=${{ matrix.platform }} | |
| echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Get Recent Commit Authors | |
| id: recent-commits-authors | |
| run: | | |
| jsonlist=$(git log --format="%an <%ae>" | \ | |
| sort -u | tr '\n' '\000' | \ | |
| jq -R -s -c 'split("\u0000")') | |
| echo "jsonlist=$jsonlist" >> $GITHUB_OUTPUT | |
| # Install QEMU static binaries for multi-arch image build | |
| # https://github.com/docker/setup-qemu-action | |
| # https://docs.docker.com/build/ci/github-actions/multi-platform | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| # Set up BuildKit Docker container builder to be able to build | |
| # multi-platform images and export cache | |
| # https://github.com/docker/setup-buildx-action | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # Login against a Docker registry except on PR | |
| # https://github.com/docker/login-action | |
| - name: Login to registry ${{ env.REGISTRY }} | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Extract metadata (tags, labels) for Docker | |
| # https://github.com/docker/metadata-action | |
| - name: Extract Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| labels: | | |
| org.opencontainers.image.vendor=TiaC Systems Network | |
| org.opencontainers.image.authors=${{ steps.recent-commits-authors.outputs.jsonlist }} | |
| org.opencontainers.image.documentation=${{ env.REPO_README }} | |
| # Build and push Docker image with Buildx (don't push on PR) | |
| # https://github.com/docker/build-push-action | |
| # https://docs.docker.com/build/ci/github-actions/cache | |
| - name: Build and push Docker image | |
| id: build-and-push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| platforms: ${{ matrix.platform }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true | |
| cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-${{ env.PLATFORM_PAIR }} | |
| cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-${{ env.PLATFORM_PAIR }},mode=max | |
| - name: Export digest | |
| run: | | |
| mkdir -p /tmp/digests | |
| digest="${{ steps.build-and-push.outputs.digest }}" | |
| touch "/tmp/digests/${digest#sha256:}" | |
| - name: Upload digest | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: digests-${{ env.PLATFORM_PAIR }} | |
| path: /tmp/digests/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| merge: | |
| needs: | |
| - build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| # This is used to complete the identity challenge | |
| # with sigstore/fulcio when running outside of PRs. | |
| id-token: write | |
| steps: | |
| # Free Disk Space on Ubuntu runners, clear up to 35 GB disk space | |
| # https://github.com/jlumbroso/free-disk-space | |
| - name: Free disk space | |
| uses: jlumbroso/[email protected] | |
| with: | |
| # Tool cache: Saved 8.3GiB | |
| tool-cache: true | |
| # Android library: Saved 7.5GiB | |
| android: true | |
| # .NET runtime: Saved 1.6GiB | |
| dotnet: true | |
| # Haskell runtime: Saved 5.4GiB | |
| haskell: true | |
| # Large misc. packages: Saved 4.8GiB | |
| large-packages: true | |
| # Docker images: Saved 3.2GiB | |
| docker-images: true | |
| # Swap storage: Saved 4.0GiB | |
| swap-storage: true | |
| # Checkout again (also in this merge job), to get | |
| # the list of all recent commit authors again. | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Get Recent Commit Authors | |
| id: recent-commits-authors | |
| run: | | |
| jsonlist=$(git log --format="%an <%ae>" | \ | |
| sort -u | tr '\n' '\000' | \ | |
| jq -R -s -c 'split("\u0000")') | |
| echo "jsonlist=$jsonlist" >> $GITHUB_OUTPUT | |
| - name: Download digests | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: /tmp/digests | |
| pattern: digests-* | |
| merge-multiple: true | |
| # Set up BuildKit Docker container builder to be able to build | |
| # multi-platform images and export cache | |
| # https://github.com/docker/setup-buildx-action | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # Login against a Docker registry except on PR | |
| # https://github.com/docker/login-action | |
| - name: Login to registry ${{ env.REGISTRY }} | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Extract metadata (tags, labels) for Docker | |
| # https://github.com/docker/metadata-action | |
| - name: Extract Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| labels: | | |
| org.opencontainers.image.vendor=TiaC Systems Network | |
| org.opencontainers.image.authors=${{ steps.recent-commits-authors.outputs.jsonlist }} | |
| org.opencontainers.image.documentation=${{ env.REPO_README }} | |
| # generate Docker tags based on the following events/attributes | |
| tags: | | |
| type=schedule | |
| type=pep440,pattern={{version}} | |
| type=pep440,pattern={{major}}.{{minor}} | |
| type=pep440,pattern={{major}} | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| # set latest tag for default branch | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - name: Create manifest list and push | |
| working-directory: /tmp/digests | |
| run: | | |
| docker buildx imagetools create \ | |
| $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | |
| $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *) | |
| - name: Inspect image | |
| run: | | |
| docker buildx imagetools inspect \ | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} |