|
19 | 19 | contents: read |
20 | 20 | attestations: write |
21 | 21 | packages: write |
22 | | - runs-on: ${{ matrix.runs-on }} |
23 | | - strategy: |
24 | | - matrix: |
25 | | - include: |
26 | | - - runs-on: ubuntu-24.04 |
27 | | - platform: linux/amd64 |
28 | | - - runs-on: ubuntu-24.04-arm |
29 | | - platform: linux/arm64 |
| 22 | + runs-on: ubuntu-24.04 |
30 | 23 | steps: |
31 | | - - name: Prepare |
32 | | - run: | |
33 | | - platform=${{ matrix.platform }} |
34 | | - echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV |
35 | | -
|
36 | 24 | - name: Docker meta |
37 | 25 | id: meta |
38 | 26 | uses: docker/metadata-action@v5 |
|
50 | 38 | registry: ${{ env.REGISTRY }} |
51 | 39 | username: "${{ github.repository_owner }}" |
52 | 40 | password: "${{ secrets.GITHUB_TOKEN }}" |
| 41 | + - name: Set up QEMU |
| 42 | + uses: docker/setup-qemu-action@v3 |
53 | 43 | - name: Setup Docker Buildx |
54 | 44 | id: buildx |
55 | 45 | uses: docker/setup-buildx-action@v3 |
|
62 | 52 | ${{ runner.os }}-buildx- |
63 | 53 | - name: Set sync_version from deno.json |
64 | 54 | run: | |
65 | | - platform=${{ matrix.platform }} |
66 | 55 | sync_version=$(jq -r '.version' deno.json) |
67 | 56 | echo "sync_version=${sync_version}" >> $GITHUB_ENV |
68 | 57 | - name: Build and push @query-doctor/sync |
|
74 | 63 | builder: ${{ steps.buildx.outputs.name }} |
75 | 64 | push: ${{ github.event_name == 'push' }} |
76 | 65 | outputs: type=docker |
77 | | - platforms: ${{ matrix.platform }} |
| 66 | + platforms: linux/amd64,linux/arm64 |
78 | 67 | tags: ${{ steps.meta.outputs.tags }} |
79 | 68 | cache-from: type=local,src=/tmp/.buildx-cache |
80 | 69 | cache-to: type=local,mode=max,dest=/tmp/.buildx-cache-new |
|
93 | 82 | mkdir -p ${{ runner.temp }}/digests |
94 | 83 | digest="${{ steps.build.outputs.digest }}" |
95 | 84 | touch "${{ runner.temp }}/digests/${digest#sha256:}" |
96 | | - - name: Upload digest |
97 | | - uses: actions/upload-artifact@v4 |
98 | | - if: ${{ github.event_name == 'push' }} |
99 | | - with: |
100 | | - name: digests-${{ env.PLATFORM_PAIR }} |
101 | | - path: ${{ runner.temp }}/digests/* |
102 | | - if-no-files-found: error |
103 | | - retention-days: 1 |
104 | | - |
105 | | - # TODO: Attest is not working for some reason |
106 | | - # - name: Attest |
107 | | - # uses: actions/attest-build-provenance@v2 |
108 | | - # with: |
109 | | - # subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} |
110 | | - # subject-digest: ${{ steps.build.outputs.digest }} |
111 | | - # push-to-registry: true |
112 | | - |
113 | | - merge: |
114 | | - runs-on: ubuntu-24.04 |
115 | | - if: ${{ github.event_name == 'push' }} |
116 | | - permissions: |
117 | | - id-token: write |
118 | | - contents: read |
119 | | - attestations: write |
120 | | - packages: write |
121 | | - needs: |
122 | | - - build |
123 | | - steps: |
124 | | - - name: Download digests |
125 | | - uses: actions/download-artifact@v4 |
126 | | - with: |
127 | | - path: ${{ runner.temp }}/digests |
128 | | - pattern: digests-* |
129 | | - merge-multiple: true |
130 | | - |
131 | | - - name: Login to ghcr |
132 | | - uses: docker/login-action@v3 |
| 85 | + - name: Attest |
| 86 | + uses: actions/attest-build-provenance@v2 |
133 | 87 | with: |
134 | | - registry: ${{ env.REGISTRY }} |
135 | | - username: "${{ github.actor }}" |
136 | | - password: "${{ secrets.GITHUB_TOKEN }}" |
137 | | - |
138 | | - - name: Set up Docker Buildx |
139 | | - uses: docker/setup-buildx-action@v3 |
140 | | - |
141 | | - - name: Docker meta |
142 | | - id: meta |
143 | | - uses: docker/metadata-action@v5 |
144 | | - with: |
145 | | - images: ${{ env.IMAGE_NAME }} |
146 | | - tags: | |
147 | | - type=ref,event=branch |
148 | | - type=ref,event=pr |
149 | | - type=semver,pattern={{version}} |
150 | | - type=semver,pattern={{major}}.{{minor}} |
151 | | -
|
152 | | - - name: Create manifest list and push |
153 | | - working-directory: ${{ runner.temp }}/digests |
154 | | - run: | |
155 | | - docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ |
156 | | - $(printf '${{ env.IMAGE_NAME }}@sha256:%s ' *) |
157 | | -
|
158 | | - - name: Inspect image |
159 | | - run: | |
160 | | - docker buildx imagetools inspect ${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} |
| 88 | + subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} |
| 89 | + subject-digest: ${{ steps.build.outputs.digest }} |
| 90 | + push-to-registry: true |
0 commit comments