76 lines
2.7 KiB
YAML
76 lines
2.7 KiB
YAML
name: Build and publish website container
|
|
|
|
on:
|
|
push:
|
|
branches: [main, container-ci]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: linux-amd64-docker-small
|
|
timeout-minutes: 35
|
|
container:
|
|
image: docker:29.1.3-cli
|
|
env:
|
|
IMAGE_REPOSITORY: gitea.kenanzhu.com/autolibrary/website
|
|
RELEASE_SHA: ${{ gitea.sha }}
|
|
steps:
|
|
- name: Install checkout tools
|
|
shell: sh
|
|
run: apk add --no-cache bash git
|
|
|
|
- name: Check out the pushed commit
|
|
uses: builtin:checkout
|
|
with:
|
|
ref: ${{ gitea.sha }}
|
|
persist-credentials: false
|
|
|
|
- name: Build and test the image
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
docker info --format '{{range .SecurityOptions}}{{println .}}{{end}}' | grep -Fx 'name=rootless'
|
|
image="${IMAGE_REPOSITORY}:${RELEASE_SHA}"
|
|
docker build -t "$image" .
|
|
bash deploy/smoke-container.sh "$image"
|
|
|
|
- name: Push the tested image to Gitea
|
|
id: publish
|
|
if: ${{ gitea.ref == 'refs/heads/main' || gitea.ref == 'refs/heads/container-ci' }}
|
|
shell: bash
|
|
env:
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
: "${REGISTRY_USERNAME:?Add the REGISTRY_USERNAME repository secret}"
|
|
: "${REGISTRY_TOKEN:?Add the REGISTRY_TOKEN repository secret}"
|
|
DOCKER_CONFIG=$(mktemp -d)
|
|
export DOCKER_CONFIG
|
|
trap 'rm -rf -- "$DOCKER_CONFIG"' EXIT
|
|
printf '%s\n' "$REGISTRY_TOKEN" | docker login "${IMAGE_REPOSITORY%%/*}" \
|
|
--username "$REGISTRY_USERNAME" --password-stdin
|
|
docker push "${IMAGE_REPOSITORY}:${RELEASE_SHA}" | tee "$DOCKER_CONFIG/push.log"
|
|
digest=$(awk '$2 == "digest:" {print $3}' "$DOCKER_CONFIG/push.log")
|
|
[[ $digest =~ ^sha256:[0-9a-f]{64}$ ]]
|
|
echo "Published ${IMAGE_REPOSITORY}@${digest}"
|
|
echo "digest=$digest" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Request production update
|
|
if: ${{ gitea.ref == 'refs/heads/main' }}
|
|
shell: bash
|
|
env:
|
|
RELEASE_DIGEST: ${{ steps.publish.outputs.digest }}
|
|
run: |
|
|
set -euo pipefail
|
|
[[ $RELEASE_SHA =~ ^[0-9a-f]{40}$ && $RELEASE_DIGEST =~ ^sha256:[0-9a-f]{64}$ ]]
|
|
request=$(mktemp /release-request/request.XXXXXXXX)
|
|
trap 'rm -f -- "$request"' EXIT
|
|
printf '%s %s\n' "$RELEASE_SHA" "$RELEASE_DIGEST" > "$request"
|
|
mv -f -- "$request" /release-request/request
|
|
|
|
- name: Remove the local image tag
|
|
if: always()
|
|
shell: bash
|
|
run: docker image rm "${IMAGE_REPOSITORY}:${RELEASE_SHA}" >/dev/null 2>&1 || true
|