Docker publish rootless #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker publish rootless | |
| on: | |
| schedule: | |
| - cron: '0 0 * * 0' # Run this job automatically every week | |
| push: | |
| branches: [ "master" ] | |
| paths: php/* | |
| pull_request: | |
| branches: [ "master" ] | |
| paths: php/* | |
| workflow_dispatch: | |
| env: | |
| # Use docker.io for Docker Hub if empty | |
| REGISTRY: ghcr.io | |
| # github.repository as <account>/<repo> | |
| IMAGE_NAME: ${{ github.repository }} | |
| GHCR_REPO: ghcr.io/sysadminsmedia/glpi | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: | |
| - linux/amd64 | |
| - linux/amd64/v3 | |
| - linux/arm64 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Prepare | |
| run: | | |
| platform=${{ matrix.platform }} | |
| echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV | |
| branch=${{ github.event.pull_request.number || github.ref_name }} | |
| echo "BRANCH=${branch//\//-}" >> $GITHUB_ENV | |
| echo "DOCKERNAMES=${{ env.GHCR_REPO }}" >> $GITHUB_ENV | |
| if [[ "${{ github.event_name }}" != "schedule" ]] || [[ "${{ github.ref }}" != refs/tags/* ]]; then | |
| echo "DOCKERNAMES=${{ env.GHCR_REPO }}" >> $GITHUB_ENV | |
| fi | |
| - name: Docker meta | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: | | |
| name=${{ env.GHCR_REPO }} | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| with: | |
| image: ghcr.io/amitie10g/binfmt:latest | |
| # Set up BuildKit Docker container builder to be able to build | |
| # multi-platform images and export cache | |
| # https://github.com/docker/setup-buildx-action | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3.0.0 # v3.0.0 | |
| with: | |
| driver-opts: | | |
| image=ghcr.io/amitie10g/buildkit:master | |
| # Login against a Docker registry except on PR | |
| # https://github.com/docker/login-action | |
| - name: Log into registry ${{ env.REGISTRY }} | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v3.0.0 # v3.0.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Get Latest GLPI Version | |
| id: glpi-version | |
| uses: pozetroninc/github-action-get-latest-release@master | |
| with: | |
| owner: glpi-project | |
| repo: glpi | |
| excludes: draft | |
| - name: Build and push by digest | |
| id: build | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ./php | |
| file: ./php/Dockerfile | |
| platforms: ${{ matrix.platform }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| outputs: type=image,"name=${{ env.DOCKERNAMES }}",push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mod=max | |
| build-args: | | |
| VERSION=${{ steps.glpi-version.outputs.release }} | |
| provenance: true | |
| sbom: true | |
| annotations: ${{ steps.meta.outputs.annotations }} | |
| - name: Export digest | |
| run: | | |
| mkdir -p /tmp/digests | |
| digest="${{ steps.build.outputs.digest }}" | |
| touch "/tmp/digests/${digest#sha256:}" | |
| - name: Upload digest | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: digests-${{ env.PLATFORM_PAIR }} | |
| path: /tmp/digests/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| merge: | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| needs: | |
| - build | |
| steps: | |
| - name: Download digests | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: /tmp/digests | |
| pattern: digests-* | |
| merge-multiple: true | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| with: | |
| driver-opts: | | |
| image=ghcr.io/amitie10g/buildkit:master | |
| - name: Get Latest GLPI Version | |
| id: glpi-version | |
| uses: pozetroninc/github-action-get-latest-release@master | |
| with: | |
| owner: glpi-project | |
| repo: glpi | |
| excludes: draft | |
| - name: Docker meta | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: | | |
| name=${{ env.GHCR_REPO }} | |
| tags: | | |
| type=raw,value=${{ steps.glpi-version.outputs.release }} | |
| - name: Create manifest list and push GHCR | |
| id: push-ghcr | |
| working-directory: /tmp/digests | |
| run: | | |
| docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | |
| $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *) |