@@ -6,89 +6,85 @@ name: Docker
66# documentation.
77
88on :
9- push :
10- branches : [ "main" ]
11- pull_request :
12- branches : [ "main" ]
9+ push :
10+ branches : ["main"]
11+ pull_request :
12+ branches : ["main"]
1313
1414env :
15- # Use docker.io for Docker Hub if empty
16- REGISTRY : ghcr.io
17- # github.repository as <account>/<repo>
18- IMAGE_NAME : ${{ github.repository }}
19-
15+ # Use docker.io for Docker Hub if empty
16+ REGISTRY : ghcr.io
17+ # github.repository as <account>/<repo>
18+ IMAGE_NAME : ${{ github.repository }}
2019
2120jobs :
22- build :
23-
24- runs-on : ubuntu-latest
25- permissions :
26- contents : read
27- packages : write
28- # This is used to complete the identity challenge
29- # with sigstore/fulcio when running outside of PRs.
30- id-token : write
31-
32- steps :
33- - name : Checkout repository
34- uses : actions/checkout@v3
35-
36- # Install the cosign tool except on PR
37- # https://github.com/sigstore/cosign-installer
38- - name : Install cosign
39- if : github.event_name != 'pull_request'
40- uses : sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 # v2.6.0
41- with :
42- cosign-release : ' v1.13.1'
21+ build :
22+ runs-on : ubuntu-latest
23+ permissions :
24+ contents : read
25+ packages : write
26+ # This is used to complete the identity challenge
27+ # with sigstore/fulcio when running outside of PRs.
28+ id-token : write
4329
30+ steps :
31+ - name : Checkout repository
32+ uses : actions/checkout@v3
4433
45- # Workaround: https://github.com/docker/build-push-action/issues/461
46- - name : Setup Docker buildx
47- uses : docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
34+ # Install the cosign tool except on PR
35+ # https://github.com/sigstore/cosign-installer
36+ - name : Install cosign
37+ if : github.event_name != 'pull_request'
38+ uses : sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 # v2.6.0
39+ with :
40+ cosign-release : " v1.13.1"
4841
49- # Login against a Docker registry except on PR
50- # https://github.com/docker/login-action
51- - name : Log into registry ${{ env.REGISTRY }}
52- if : github.event_name != 'pull_request'
53- uses : docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
54- with :
55- registry : ${{ env.REGISTRY }}
56- username : ${{ github.actor }}
57- password : ${{ secrets.GITHUB_TOKEN }}
42+ # Workaround: https://github.com/docker/build-push-action/issues/461
43+ - name : Setup Docker buildx
44+ uses : docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
5845
59- # Extract metadata (tags, labels) for Docker
60- # https://github.com/docker/metadata -action
61- - name : Extract Docker metadata
62- id : meta
63- uses : docker/metadata -action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
64- with :
65- images : ${{ env.REGISTRY }}/ ${{ env.IMAGE_NAME }}
66- tags : |
67- type=sha
46+ # Login against a Docker registry except on PR
47+ # https://github.com/docker/login -action
48+ - name : Log into registry ${{ env.REGISTRY }}
49+ if : github.event_name != 'pull_request'
50+ uses : docker/login -action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
51+ with :
52+ registry : ${{ env.REGISTRY }}
53+ username : ${{ github.actor }}
54+ password : ${{ secrets.GITHUB_TOKEN }}
6855
69- # Build and push Docker image with Buildx (don't push on PR)
70- # https://github.com/docker/build-push-action
71- - name : Build and push Docker image
72- id : build-and-push
73- uses : docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
74- with :
75- context : .
76- push : ${{ github.event_name != 'pull_request' }}
77- tags : ${{ steps.meta.outputs.tags }}
78- labels : ${{ steps.meta.outputs.labels }}
79- cache-from : type=gha
80- cache-to : type=gha,mode=max
56+ # Extract metadata (tags, labels) for Docker
57+ # https://github.com/docker/metadata-action
58+ - name : Extract Docker metadata
59+ id : meta
60+ uses : docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
61+ with :
62+ images : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
63+ tags : |
64+ type=sha
8165
66+ # Build and push Docker image with Buildx (don't push on PR)
67+ # https://github.com/docker/build-push-action
68+ - name : Build and push Docker image
69+ id : build-and-push
70+ uses : docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
71+ with :
72+ context : .
73+ push : ${{ github.event_name != 'pull_request' }}
74+ tags : ${{ steps.meta.outputs.tags }}
75+ labels : ${{ steps.meta.outputs.labels }}
76+ cache-from : type=gha
77+ cache-to : type=gha,mode=max
8278
83- # Sign the resulting Docker image digest except on PRs.
84- # This will only write to the public Rekor transparency log when the Docker
85- # repository is public to avoid leaking data. If you would like to publish
86- # transparency data even for private images, pass --force to cosign below.
87- # https://github.com/sigstore/cosign
88- - name : Sign the published Docker image
89- if : ${{ github.event_name != 'pull_request' }}
90- env :
91- COSIGN_EXPERIMENTAL : " true"
92- # This step uses the identity token to provision an ephemeral certificate
93- # against the sigstore community Fulcio instance.
94- run : echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
79+ # Sign the resulting Docker image digest except on PRs.
80+ # This will only write to the public Rekor transparency log when the Docker
81+ # repository is public to avoid leaking data. If you would like to publish
82+ # transparency data even for private images, pass --force to cosign below.
83+ # https://github.com/sigstore/cosign
84+ - name : Sign the published Docker image
85+ if : ${{ github.event_name != 'pull_request' }}
86+ env :
87+ COSIGN_EXPERIMENTAL : " true"
88+ # This step uses the identity token to provision an ephemeral certificate
89+ # against the sigstore community Fulcio instance.
90+ run : echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
0 commit comments