1
1
name : Docker
2
2
3
- # This workflow uses actions that are not certified by GitHub.
4
- # They are provided by a third-party and are governed by
5
- # separate terms of service, privacy policy, and support
6
- # documentation.
7
-
8
3
on :
9
4
push :
10
- branches : ["master"]
11
- # Publish semver tags as releases.
12
- tags : ["v*.*.*"]
5
+ tags : ['v*.*.*'] # Triggers on tag following semantic versioning
13
6
pull_request :
14
- branches : [" master", " develop", "clip_support"]
7
+ branches : [' master', ' develop'] # Triggers on PR to these branches
15
8
16
9
env :
17
- # Use docker.io for Docker Hub if empty
18
10
REGISTRY : ghcr.io
19
- # github.repository as <account>/<repo>
20
11
IMAGE_NAME : ${{ github.repository }}
21
12
22
13
jobs :
@@ -25,59 +16,32 @@ jobs:
25
16
permissions :
26
17
contents : read
27
18
packages : write
28
- # This is used to complete the identity challenge
29
- # with sigstore/fulcio when running outside of PRs.
30
19
id-token : write
31
20
32
21
steps :
33
22
- name : Checkout repository
34
23
uses : actions/checkout@v4
35
- # Workaround: https://github.com/docker/build-push-action/issues/461
24
+
36
25
- name : Setup Docker buildx
37
26
38
27
39
- # TODO: run tests
40
-
41
- # Login against a Docker registry except on PR
42
- # https://github.com/docker/login-action
43
28
- name : Log into registry ${{ env.REGISTRY }}
44
- if : ${{ github.ref == 'refs/heads/master' || github. event_name == 'pull_request ' && github.head_ref == 'develop' }}
29
+ if : ${{ github.event_name == 'push ' && startsWith( github.ref, 'refs/tags/') }}
45
30
46
31
with :
47
32
registry : ${{ env.REGISTRY }}
48
33
username : ${{ github.actor }}
49
34
password : ${{ secrets.GITHUB_TOKEN }}
50
35
51
- # Extract metadata (tags, labels) for Docker
52
- # https://github.com/docker/metadata-action
53
36
- name : Extract Docker metadata
54
37
id : meta
55
38
56
39
with :
57
40
images : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
58
41
59
- # Build and push Docker image with Buildx (don't push on PR)
60
- # https://github.com/docker/build-push-action
61
42
- name : Build and push Docker image
62
- id : build-and-push
63
43
64
44
with :
65
45
context : .
66
- # platforms: linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7
67
- push : ${{ github.ref == 'refs/heads/master' || github.event_name == 'pull_request' && github.head_ref == 'develop' }}
46
+ push : ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') }}
68
47
tags : ${{ steps.meta.outputs.tags }}
69
- # cache-from: type=gha
70
- # cache-to: type=gha,mode=max
71
-
72
- # # Sign the resulting Docker image digest except on PRs.
73
- # # This will only write to the public Rekor transparency log when the Docker
74
- # # repository is public to avoid leaking data. If you would like to publish
75
- # # transparency data even for private images, pass --force to cosign below.
76
- # # https://github.com/sigstore/cosign
77
- # - name: Sign the published Docker image
78
- # if: ${{ github.event_name != 'pull_request' }}
79
- # env:
80
- # COSIGN_EXPERIMENTAL: "true"
81
- # # This step uses the identity token to provision an ephemeral certificate
82
- # # against the sigstore community Fulcio instance.
83
- # run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
0 commit comments