Skip to content

Bump actions/checkout from 4.1.1 to 4.1.2 #369

Bump actions/checkout from 4.1.1 to 4.1.2

Bump actions/checkout from 4.1.1 to 4.1.2 #369

Workflow file for this run

---
name: Docker
on:
push:
pull_request:
schedule:
- cron: '0 0 * * 0'
workflow_dispatch:
permissions:
contents: write
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Set IMAGE
run: echo "IMAGE=${GITHUB_REPOSITORY#*/docker-}" >> "${GITHUB_ENV}"
- uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
with:
fetch-depth: 0
fetch-tags: true
- name: Install cosign
if: github.ref == 'refs/heads/main'
uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
with:
cosign-release: v2.1.1
- uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
- uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0
- uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
id: meta
with:
images: ${{ github.repository_owner }}/${{ env.IMAGE }}
tags: |
type=schedule
type=ref,event=branch
type=ref,event=pr
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
type=sha
- uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
if: github.ref == 'refs/heads/main'
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
id: build-and-push
with:
context: ${{ env.IMAGE }}
platforms: linux/amd64,linux/arm64
pull: true
push: ${{ github.ref == 'refs/heads/main' }}
sbom: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
- name: Sign the published Docker image
if: github.ref == 'refs/heads/main'
env:
TAGS: ${{ steps.meta.outputs.tags }}
DIGEST: ${{ steps.build-and-push.outputs.digest }}
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
run: |
\echo "${COSIGN_PRIVATE_KEY}" > cosign.key
\echo "${TAGS}" | \xargs -I {} cosign sign --key cosign.key --yes "{}@${DIGEST}" \
-a "workflow=${{ github.workflow }}" \
-a "repo=${{ github.repository }}" \
-a "branch=${{ github.ref_name }}" \
-a "ref=${{ github.sha }}"
\rm -f cosign.key
- name: Test the Docker image
working-directory: ${{ env.IMAGE }}
run: docker compose -f docker-compose.test.yml run sut
- name: Set RELEASE
if: github.ref == 'refs/heads/main'
run: |
# shellcheck disable=SC2086
RC="$(\grep ${IMAGE}/Dockerfile -e '^FROM' | \head -n 1 | \sed -e 's/^.*://')"
if [[ "${RC}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] && ! \git show-ref --tags --verify --quiet "refs/tags/v${RC}" ; then
\echo "RELEASE=${RC}" >> "${GITHUB_ENV}"
fi
- name: Trigger release
if: env.RELEASE != ''
uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
env:
GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
with:
tag_name: v${{ env.RELEASE }}