WIP #1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pipeline | |
| on: | |
| push: | |
| branches: | |
| - develop | |
| - feat/* | |
| - hotfix/* | |
| - main | |
| pull_request: | |
| branches: | |
| - develop | |
| - feat/* | |
| - hotfix/* | |
| - main | |
| env: | |
| API_CONTAINER_NAME: ${{ github.repository }}/api | |
| CONTAINER_REGISTRY_GHCR: ghcr.io | |
| CONTAINER_PLATFORMS: linux/amd64,linux/arm64/v8 | |
| # https://github.com/docker/buildx/releases | |
| BUILDX_VERSION: 0.11.2 | |
| jobs: | |
| init: | |
| name: Init | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| outputs: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| VERSION_FULL: ${{ steps.version.outputs.version_full }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4.1.7 | |
| with: | |
| # We need all Git history for "version.sh" | |
| fetch-depth: 0 | |
| # Ensure "version.sh" submodule are up-to-date | |
| submodules: recursive | |
| - name: Generate versions | |
| id: version | |
| run: | | |
| echo "version=$(bash cicd/version/version.sh -g . -c)" >> $GITHUB_OUTPUT | |
| echo "version_full=$(bash cicd/version/version.sh -g . -c -m)" >> $GITHUB_OUTPUT | |
| build-image: | |
| name: Build & publish image | |
| permissions: | |
| contents: write | |
| packages: write | |
| runs-on: ubuntu-22.04 | |
| needs: | |
| - init | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4.1.2 | |
| - name: Configure Git | |
| run: | | |
| git config user.name "${{ github.actor }}" | |
| git config user.email "${{ github.actor }}@users.noreply.github.com" | |
| - name: Setup QEMU | |
| id: setup-qemu | |
| uses: docker/setup-qemu-action@v3.0.0 | |
| with: | |
| platforms: ${{ env.CONTAINER_PLATFORMS }} | |
| - name: Setup Docker Buildx | |
| uses: docker/setup-buildx-action@v3.3.0 | |
| with: | |
| version: v${{ env.BUILDX_VERSION }} | |
| - name: Login to registry - GitHub | |
| uses: docker/login-action@v3.1.0 | |
| with: | |
| registry: ${{ env.CONTAINER_REGISTRY_GHCR }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Container meta | |
| id: meta | |
| uses: docker/metadata-action@v5.5.1 | |
| with: | |
| images: ${{ env.CONTAINER_REGISTRY_GHCR }}/${{ env.API_CONTAINER_NAME }} | |
| tags: | | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=schedule | |
| type=schedule,pattern={{date 'YYYYMMDD'}} | |
| type=semver,pattern={{version}},value=${{ needs.init.outputs.VERSION_FULL }} | |
| type=sha | |
| labels: | | |
| org.opencontainers.image.documentation=https://github.com/${{ env.API_CONTAINER_NAME }} | |
| org.opencontainers.image.vendor=${{ github.actor }} | |
| - name: Build/push container | |
| uses: docker/build-push-action@v5.3.0 | |
| with: | |
| build-args: | | |
| VERSION=${{ needs.init.outputs.VERSION_FULL }} | |
| cache-from: type=gha | |
| cache-to: type=gha | |
| context: . | |
| file: cicd/api.Dockerfile | |
| labels: ${{ steps.meta.outputs.labels }} | |
| platforms: ${{ env.CONTAINER_PLATFORMS }} | |
| provenance: true | |
| push: true | |
| sbom: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| create-release: | |
| name: Create release | |
| permissions: | |
| contents: write | |
| runs-on: ubuntu-22.04 | |
| needs: | |
| - build-image | |
| - init | |
| outputs: | |
| RELEASE_ID: ${{ steps.create-release.outputs.result }} | |
| # Only publish on non-scheduled main branch, as there is only one Helm repo and we cannot override an existing version | |
| if: (github.event_name != 'schedule') && (github.ref == 'refs/heads/main') | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4.1.7 | |
| - name: Create release | |
| id: create-release | |
| uses: actions/github-script@v7.0.1 | |
| with: | |
| script: | | |
| const isMain = context.ref == `refs/heads/main`; | |
| const repoName = context.repo.repo; | |
| console.log(isMain ? 'Creating release for default branch' : 'Creating release for non-default branch'); | |
| const { data } = await github.rest.repos.createRelease({ | |
| draft: true, | |
| generate_release_notes: true, | |
| name: `${repoName} v${{ needs.init.outputs.VERSION }}`, | |
| owner: context.repo.owner, | |
| prerelease: !isMain, | |
| repo: repoName, | |
| tag_name: 'v${{ needs.init.outputs.VERSION }}', | |
| target_commitish: context.ref, | |
| }); | |
| return data.id | |
| attest-dependencies: | |
| name: Attest - Dependencies | |
| permissions: | |
| contents: write | |
| runs-on: ubuntu-22.04 | |
| needs: | |
| - create-release | |
| - init | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4.1.7 | |
| - name: Login to registry - GitHub | |
| uses: docker/login-action@v3.1.0 | |
| with: | |
| registry: ${{ env.CONTAINER_REGISTRY_GHCR }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Run attestation | |
| uses: advanced-security/component-detection-dependency-submission-action@v0.0.2 | |
| with: | |
| dockerImagesToScan: ${{ env.CONTAINER_REGISTRY_GHCR }}/${{ env.API_CONTAINER_NAME }}:${{ needs.init.outputs.VERSION_FULL }} | |
| publish-release: | |
| name: Publish release | |
| permissions: | |
| contents: write | |
| runs-on: ubuntu-22.04 | |
| needs: | |
| - attest-dependencies | |
| - create-release | |
| # Only publish on non-scheduled default branch | |
| if: (github.event_name != 'schedule') && (github.ref == 'refs/heads/main') | |
| steps: | |
| - name: publish release | |
| id: publish-release | |
| uses: actions/github-script@v7.0.1 | |
| with: | |
| script: | | |
| github.rest.repos.updateRelease({ | |
| draft: false, | |
| owner: context.repo.owner, | |
| release_id: ${{ needs.create-release.outputs.RELEASE_ID }}, | |
| repo: context.repo.repo, | |
| }); |