97 lines
2.9 KiB
YAML
97 lines
2.9 KiB
YAML
name: Build container image
|
||
|
||
on:
|
||
pull_request:
|
||
branches:
|
||
- main
|
||
|
||
# schedule:
|
||
# - cron: '05 10 * * *' # 10:05 UTC daily
|
||
|
||
workflow_dispatch:
|
||
|
||
env:
|
||
IMAGE_NAME: "${{ github.event.repository.name }}"
|
||
IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
|
||
DEFAULT_TAG: "stable"
|
||
|
||
concurrency:
|
||
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
|
||
cancel-in-progress: true
|
||
|
||
jobs:
|
||
build_push:
|
||
name: Build and push image (private)
|
||
runs-on: ubuntu-24.04
|
||
|
||
permissions:
|
||
contents: read
|
||
packages: write
|
||
|
||
steps:
|
||
- name: Prepare environment
|
||
run: |
|
||
echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
|
||
echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
|
||
|
||
- name: Checkout
|
||
uses: actions/checkout@v5
|
||
|
||
- name: Mount BTRFS for podman storage
|
||
uses: ublue-os/container-storage-action@main
|
||
continue-on-error: true
|
||
with:
|
||
target-dir: /var/lib/containers
|
||
mount-opts: compress-force=zstd:2
|
||
|
||
# Minimal, private metadata – no public URLs, no ArtifactHub
|
||
- name: Image Metadata
|
||
uses: docker/metadata-action@v5
|
||
id: metadata
|
||
with:
|
||
tags: |
|
||
type=raw,value=${{ env.DEFAULT_TAG }}
|
||
labels: |
|
||
org.opencontainers.image.title=${{ env.IMAGE_NAME }}
|
||
org.opencontainers.image.version=${{ env.DEFAULT_TAG }}
|
||
containers.bootc=1
|
||
|
||
- name: Build Image
|
||
uses: redhat-actions/buildah-build@v2
|
||
with:
|
||
containerfiles: |
|
||
./Containerfile
|
||
image: ${{ env.IMAGE_NAME }}
|
||
tags: ${{ env.DEFAULT_TAG }}
|
||
labels: ${{ steps.metadata.outputs.labels }}
|
||
oci: false
|
||
|
||
- name: Login to GitHub Container Registry
|
||
if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
|
||
uses: docker/login-action@v3
|
||
with:
|
||
registry: ghcr.io
|
||
username: ${{ github.actor }}
|
||
password: ${{ secrets.GITHUB_TOKEN }}
|
||
|
||
- name: Push to GHCR (private)
|
||
if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
|
||
uses: redhat-actions/push-to-registry@v2
|
||
with:
|
||
registry: ${{ env.IMAGE_REGISTRY }}
|
||
image: ${{ env.IMAGE_NAME }}
|
||
tags: ${{ env.DEFAULT_TAG }}
|
||
|
||
- name: Install Cosign
|
||
if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
|
||
uses: sigstore/cosign-installer@v4.1.0
|
||
|
||
- name: Sign image (private)
|
||
if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
|
||
run: |
|
||
cosign sign -y \
|
||
--key env://COSIGN_PRIVATE_KEY \
|
||
${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
|
||
env:
|
||
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
|