mirror of
https://github.com/dangeroustech/ZeroTierBridge.git
synced 2025-12-06 09:06:58 +00:00
9ab36f2593
- Add workflow-level concurrency to avoid overlapping releases - Enable BuildKit cache (GHA) for faster Docker builds - Simplify to a single multi-arch build (linux/amd64, linux/arm64) - Remove digest export/upload and manifest merge steps - Push manifest directly from buildx with tag `latest` - Fix GitHub Release token casing to use `secrets.GITHUB_TOKEN` - Update Dockerfile to use TARGETARCH for correct package selection - Pass VERSION consistently; write version to image No functional change to runtime behavior expected; improves speed, reliability, and maintainability of the release pipeline.
134 lines
3.5 KiB
YAML
134 lines
3.5 KiB
YAML
name: Publish Docker Image
|
|
permissions:
|
|
actions: read
|
|
checks: read
|
|
contents: write
|
|
deployments: read
|
|
issues: read
|
|
discussions: read
|
|
packages: read
|
|
pages: read
|
|
pull-requests: read
|
|
repository-projects: read
|
|
security-events: write
|
|
statuses: read
|
|
|
|
concurrency:
|
|
group: docker-release-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
env:
|
|
REGISTRY_IMAGE: registry.dangerous.tech/dangeroustech/zerotierbridge
|
|
|
|
jobs:
|
|
Docker_Build:
|
|
name: Docker Build And Release
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@v5
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Registry
|
|
id: login
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: registry.dangerous.tech
|
|
username: ${{ secrets.REGISTRY_USERNAME }}
|
|
password: ${{ secrets.REGISTRY_PASSWORD }}
|
|
|
|
- name: Build
|
|
id: docker_build
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
build-args: |
|
|
VERSION=1.12.2
|
|
push: true
|
|
platforms: linux/amd64,linux/arm64
|
|
tags: ${{ env.REGISTRY_IMAGE }}:latest
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|
|
|
|
MergeRefs:
|
|
name: Publish Multi-Arch Image And Release
|
|
if: github.ref == 'refs/heads/main'
|
|
runs-on: ubuntu-latest
|
|
needs:
|
|
- Docker_Build
|
|
steps:
|
|
- name: Login to Registry
|
|
id: login
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: registry.dangerous.tech
|
|
username: ${{ secrets.REGISTRY_USERNAME }}
|
|
password: ${{ secrets.REGISTRY_PASSWORD }}
|
|
|
|
- name: Generate SBOM
|
|
uses: anchore/sbom-action@v0
|
|
id: sbom
|
|
with:
|
|
image: registry.dangerous.tech/dangeroustech/zerotierbridge:latest
|
|
registry-username: ${{ secrets.REGISTRY_USERNAME }}
|
|
registry-password: ${{ secrets.REGISTRY_PASSWORD }}
|
|
format: spdx-json
|
|
output-file: ./sbom.spdx.json
|
|
|
|
- name: Scan SBOM
|
|
uses: anchore/scan-action@v7
|
|
id: scan
|
|
with:
|
|
sbom: sbom.spdx.json
|
|
severity-cutoff: medium
|
|
fail-build: false
|
|
only-fixed: true
|
|
|
|
- name: upload Anchore scan SARIF report
|
|
uses: github/codeql-action/upload-sarif@v4
|
|
with:
|
|
sarif_file: ${{ steps.scan.outputs.sarif }}
|
|
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@v5
|
|
|
|
- name: Changelog
|
|
uses: TriPSs/conventional-changelog-action@v6
|
|
id: changelog
|
|
if: ${{ github.event_name != 'pull_request' }}
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
git-message: "chore 🤖: Release {version}"
|
|
output-file: CHANGELOG.md
|
|
tag-prefix: v
|
|
fallback-version: 1.0.0
|
|
release-count: 0 # preserve all versions in changelog
|
|
skip-on-empty: false # otherwise we don't publish fixes
|
|
|
|
- name: Create Release
|
|
uses: softprops/action-gh-release@v2
|
|
id: release
|
|
if: ${{ steps.changelog.outputs.skipped == 'false' }}
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
tag_name: ${{ steps.changelog.outputs.tag }}
|
|
name: ${{ steps.changelog.outputs.tag }}
|
|
body: ${{ steps.changelog.outputs.clean_changelog }}
|
|
files: |
|
|
sbom.spdx.json
|