Skip to content

Docker Publish

Docker Publish #65

name: Docker Publish
on:
release:
types: [published]
schedule:
- cron: '0 0 * * *'
jobs:
push_to_registries:
name: Push Docker image to Docker Hub and GHCR
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
attestations: write
id-token: write
steps:
- name: Check out the repository
uses: actions/checkout@v4
- name: Set RELEASE_TAG environment variable
env:
GH_TOKEN: ${{ github.token }}
run: |
echo "Fetching latest release tag..."
RELEASE_TAG=$(gh release list --limit 1 --json tagName -q '.[0].tagName')
if [ -z "$RELEASE_TAG" ]; then
echo "No release found. Exiting."
exit 1
fi
echo "RELEASE_TAG=$RELEASE_TAG" >> $GITHUB_ENV
echo "Using release tag: $RELEASE_TAG"
- name: Set IMAGE_NAME environment variable
run: |
IMAGE_NAME=$(echo "$GITHUB_REPOSITORY" | cut -d'/' -f2 | sed 's/^docker-//')
echo "IMAGE_NAME=$IMAGE_NAME" >> $GITHUB_ENV
echo "Computed IMAGE_NAME: $IMAGE_NAME"
- name: Check out the repo at the latest release tag
uses: actions/checkout@v4
with:
ref: ${{ env.RELEASE_TAG }}
- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
registry: docker.io
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Log in to GitHub Container Registry (GHCR)
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@v5
with:
images: |
docker.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
tags: |
${{ env.RELEASE_TAG }}
latest
- name: Build and push Docker images
id: push
uses: docker/build-push-action@v6
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
- name: Generate artifact attestation for Docker Hub
uses: actions/attest-build-provenance@v2
with:
subject-name: docker.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
subject-digest: ${{ steps.push.outputs.digest }}
push-to-registry: true
github-token: ${{ github.token }}
- name: Generate artifact attestation for GHCR
uses: actions/attest-build-provenance@v2
with:
subject-name: ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
subject-digest: ${{ steps.push.outputs.digest }}
push-to-registry: true
github-token: ${{ github.token }}