implement docker action #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Docker Images | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| tags: [ 'v*.*.*' ] | |
| pull_request: | |
| branches: [ "main" ] | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME_PREFIX: ${{ github.repository }} | |
| jobs: | |
| detect-affected: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Ensure main branch exists | |
| if: github.ref != 'refs/heads/main' | |
| run: | | |
| set -euo pipefail | |
| git rev-parse --verify main \ | |
| || git remote set-branches origin main \ | |
| && git fetch --depth 1 origin main \ | |
| && git branch main origin/main | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.7 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: "pnpm" | |
| - name: Setup GoLang | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: "go.work" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Get affected projects | |
| id: get-affected | |
| run: | | |
| set -euo pipefail | |
| AFFECTED_PROJECTS=$(npx nx show projects --affected --projects "apps/*" --json) | |
| echo "affected_projects=$AFFECTED_PROJECTS" >> $GITHUB_OUTPUT | |
| - name: Set matrix | |
| id: set-matrix | |
| run: | | |
| set -euo pipefail | |
| cat > docker-config.json << EOL | |
| { | |
| "ui": { | |
| "dockerfile": "apps/ui/Dockerfile", | |
| "context": "." | |
| }, | |
| "api": { | |
| "dockerfile": "apps/api/build/package/Dockerfile", | |
| "context": "." | |
| } | |
| } | |
| EOL | |
| AFFECTED_PROJECTS='${{ steps.get-affected.outputs.affected_projects }}' | |
| MATRIX=$(echo $AFFECTED_PROJECTS | jq -c --slurpfile config docker-config.json ' | |
| . as $projects | | |
| $config[0] as $dockerConfigs | | |
| { | |
| project: $projects | map(select(. as $p | $dockerConfigs[$p] != null)) | map({ | |
| name: ., | |
| dockerfile: $dockerConfigs[.].dockerfile, | |
| context: $dockerConfigs[.].context | |
| }) | |
| } | |
| ') | |
| echo "matrix=$MATRIX" >> $GITHUB_OUTPUT | |
| build-docker: | |
| needs: detect-affected | |
| if: ${{ needs.detect-affected.outputs.matrix != '{"project":[]}' }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: ${{ fromJson(needs.detect-affected.outputs.matrix) }} | |
| fail-fast: false | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install cosign | |
| if: github.event_name != 'pull_request' | |
| uses: sigstore/cosign-installer@v3 | |
| with: | |
| cosign-release: 'v2.2.4' | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log into registry ${{ env.REGISTRY }} | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_PREFIX }}-${{ matrix.project.name }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=sha | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| - name: Build and push Docker image | |
| id: build-and-push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ${{ matrix.project.context }} | |
| file: ${{ matrix.project.dockerfile }} | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Sign the published Docker image | |
| if: ${{ github.event_name != 'pull_request' }} | |
| env: | |
| TAGS: ${{ steps.meta.outputs.tags }} | |
| DIGEST: ${{ steps.build-and-push.outputs.digest }} | |
| run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} |