62 lines
2.5 KiB
YAML
62 lines
2.5 KiB
YAML
name: Build + push image
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
REGISTRY: gitea.saas.vnc.biz
|
|
IMAGE: gitea.saas.vnc.biz/vnclagoon/vnc-hybridauth-api
|
|
|
|
jobs:
|
|
build-and-push:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Compute image tag
|
|
run: |
|
|
SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-8)
|
|
echo "SHORT_SHA=${SHORT_SHA}" >> $GITHUB_ENV
|
|
|
|
# kaniko builds straight from a Dockerfile and pushes to the registry, running
|
|
# as a static binary inside the job container — the runner has no Docker daemon.
|
|
- name: Fetch kaniko (daemon-less image builder)
|
|
run: |
|
|
set -euo pipefail
|
|
curl -fsSL -o /tmp/crane.tgz \
|
|
https://github.com/google/go-containerregistry/releases/download/v0.21.9/go-containerregistry_Linux_x86_64.tar.gz
|
|
tar -xzf /tmp/crane.tgz -C /usr/local/bin crane
|
|
mkdir -p /tmp/kaniko-root
|
|
crane export gcr.io/kaniko-project/executor:debug /tmp/kaniko-fs.tar
|
|
tar -xf /tmp/kaniko-fs.tar -C /tmp/kaniko-root
|
|
cp /tmp/kaniko-root/kaniko/executor /usr/local/bin/kaniko-executor
|
|
chmod +x /usr/local/bin/kaniko-executor
|
|
/usr/local/bin/kaniko-executor version
|
|
|
|
# kaniko's push auth reads $DOCKER_CONFIG/config.json (go-containerregistry
|
|
# authn.DefaultKeychain). Write to both locations and export DOCKER_CONFIG so
|
|
# auth is picked up regardless of how $HOME resolves.
|
|
- name: Configure registry auth for push
|
|
run: |
|
|
AUTH=$(printf '%s:%s' "${REGISTRY_USER}" "${REGISTRY_TOKEN}" | base64 -w0)
|
|
CFG=$(printf '{"auths":{"%s":{"auth":"%s"}}}' "${REGISTRY}" "${AUTH}")
|
|
mkdir -p /kaniko/.docker "$HOME/.docker"
|
|
printf '%s' "$CFG" > /kaniko/.docker/config.json
|
|
printf '%s' "$CFG" > "$HOME/.docker/config.json"
|
|
echo "DOCKER_CONFIG=/kaniko/.docker" >> "$GITHUB_ENV"
|
|
|
|
# The Dockerfile lives at the repo root; its ADD/COPY paths (app/, package.json,
|
|
# yarn.lock, config.js) are relative to the root.
|
|
- name: Build + push image
|
|
run: |
|
|
/usr/local/bin/kaniko-executor \
|
|
--context "dir://${GITHUB_WORKSPACE}" \
|
|
--dockerfile Dockerfile \
|
|
--skip-tls-verify-registry="${REGISTRY}" \
|
|
--destination "${IMAGE}:sha-${SHORT_SHA}" \
|
|
--destination "${IMAGE}:latest"
|