ci: implement action for building Docker image #9
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| on: | |
| push: | |
| branches: [ "main", "ci/implement-docker-action" ] | |
| tags: [ 'v*.*.*' ] | |
| pull_request: | |
| branches: [ "main" ] | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME_PREFIX: ${{ github.repository }} | |
| jobs: | |
| detect-affected: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - if: github.ref != 'refs/heads/main' | |
| run: | | |
| set -euo pipefail | |
| git branch | |
| git rev-parse --verify main || git remote set-branches origin main && git fetch --depth 1 origin main && git branch main origin/main | |
| git branch | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.7 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: "pnpm" | |
| - name: Setup GoLang | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: "go.work" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Get affected projects | |
| id: get-affected | |
| run: | | |
| set -euo pipefail | |
| AFFECTED_PROJECTS=$(npx nx show projects --affected --projects "apps/*" --json) | |
| echo "affected_projects=$AFFECTED_PROJECTS" >> $GITHUB_OUTPUT | |
| - name: Set matrix | |
| id: set-matrix | |
| run: | | |
| set -euo pipefail | |
| cat > docker-config.json << EOL | |
| { | |
| "ui": { | |
| "dockerfile": "apps/ui/Dockerfile", | |
| "context": "." | |
| }, | |
| "api": { | |
| "dockerfile": "apps/api/build/package/Dockerfile", | |
| "context": "." | |
| } | |
| } | |
| EOL | |
| AFFECTED_PROJECTS='${{ steps.get-affected.outputs.affected_projects }}' | |
| MATRIX=$(echo $AFFECTED_PROJECTS | jq -c --slurpfile config docker-config.json ' | |
| . as $projects | | |
| $config[0] as $dockerConfigs | | |
| { | |
| project: $projects | map(select(. as $p | $dockerConfigs[$p] != null)) | map({ | |
| name: ., | |
| dockerfile: $dockerConfigs[.].dockerfile, | |
| context: $dockerConfigs[.].context | |
| }) | |
| } | |
| ') | |
| echo "matrix=$MATRIX" >> $GITHUB_OUTPUT | |
| build-docker: | |
| needs: detect-affected | |
| if: ${{ needs.detect-affected.outputs.matrix != '{"project":[]}' }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: ${{ fromJson(needs.detect-affected.outputs.matrix) }} | |
| fail-fast: false | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install cosign | |
| if: github.event_name != 'pull_request' | |
| uses: sigstore/cosign-installer@v3 | |
| with: | |
| cosign-release: 'v2.2.4' | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log into registry ${{ env.REGISTRY }} | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_PREFIX }}-${{ matrix.project.name }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=sha | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| - name: Build and push Docker image | |
| id: build-and-push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ${{ matrix.project.context }} | |
| file: ${{ matrix.project.dockerfile }} | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Sign the published Docker image | |
| if: ${{ github.event_name != 'pull_request' }} | |
| env: | |
| TAGS: ${{ steps.meta.outputs.tags }} | |
| DIGEST: ${{ steps.build-and-push.outputs.digest }} | |
| run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} |