-
Notifications
You must be signed in to change notification settings - Fork 0
60 lines (57 loc) · 2.26 KB
/
docker.yml
File metadata and controls
60 lines (57 loc) · 2.26 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
name: docker
on:
push:
tags: ['v*']
workflow_dispatch:
# Deny-by-default at the workflow level — the `proxy-image` job opts
# back in to exactly what it needs (`contents: read` + `packages:
# write`). Any future job added without an explicit `permissions:`
# block gets an empty token instead of inheriting write-all.
permissions: {}
jobs:
proxy-image:
# Build + push the sakimori-proxy container image to GHCR on
# every `v*` tag. Users consume it via:
# docker run --rm -p 8910:8910 ghcr.io/bokuweb/sakimori-proxy:v0
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v4
- uses: docker/setup-qemu-action@v3
- uses: docker/setup-buildx-action@v3
- uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Derive tags
id: tags
run: |
set -e
ref="${GITHUB_REF#refs/tags/}"
# e.g. v0.21.0 → we push :v0.21.0, :v0.21, :v0, :latest
# Skip the floating :v0 push for prereleases (v0.21.0-rc1 etc.)
major=$(echo "$ref" | awk -F. '{print $1}')
minor=$(echo "$ref" | awk -F. '{print $1"."$2}')
tags="ghcr.io/${GITHUB_REPOSITORY_OWNER}/sakimori-proxy:${ref}"
if [[ "$ref" != *-* ]]; then
tags="${tags},ghcr.io/${GITHUB_REPOSITORY_OWNER}/sakimori-proxy:${minor}"
tags="${tags},ghcr.io/${GITHUB_REPOSITORY_OWNER}/sakimori-proxy:${major}"
tags="${tags},ghcr.io/${GITHUB_REPOSITORY_OWNER}/sakimori-proxy:latest"
fi
echo "tags=$tags" >> "$GITHUB_OUTPUT"
- uses: docker/build-push-action@v6
with:
context: .
file: Dockerfile
push: true
tags: ${{ steps.tags.outputs.tags }}
platforms: linux/amd64,linux/arm64
cache-from: type=gha
cache-to: type=gha,mode=max
labels: |
org.opencontainers.image.source=https://github.com/${{ github.repository }}
org.opencontainers.image.description=HTTPS MITM proxy that enforces minimumReleaseAge across crates.io / npm / pypi / nuget
org.opencontainers.image.licenses=MIT