4883e40812
Some checks failed
Mark stable commit / test-unit (push) Has been cancelled
Mark stable commit / test-integration (push) Has been cancelled
Mark stable commit / test-env-virtual (push) Has been cancelled
Mark stable commit / test-env-nix (push) Has been cancelled
Mark stable commit / test-e2e (push) Has been cancelled
Mark stable commit / test-virgin-user (push) Has been cancelled
Mark stable commit / test-virgin-root (push) Has been cancelled
Mark stable commit / linter-shell (push) Has been cancelled
Mark stable commit / linter-python (push) Has been cancelled
Mark stable commit / mark-stable (push) Has been cancelled
* Remove unsupported `fetch-tags` input from checkout step * Detect missing `v*` tag on workflow_run SHA and exit successfully * Gate Buildx, GHCR login, and publish steps behind `should_publish` flag https://chatgpt.com/share/693ee7f1-ed80-800f-bb03-369a1cc659e3
75 lines
2.3 KiB
YAML
75 lines
2.3 KiB
YAML
name: Publish container images (GHCR)
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: ["Mark stable commit"]
|
|
types: [completed]
|
|
|
|
jobs:
|
|
publish:
|
|
if: ${{ github.event.workflow_run.conclusion == 'success' }}
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
steps:
|
|
- name: Checkout repository (with tags)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Checkout workflow_run commit and refresh tags
|
|
run: |
|
|
set -euo pipefail
|
|
git checkout -f "${{ github.event.workflow_run.head_sha }}"
|
|
git fetch --tags --force
|
|
git tag --list 'stable' 'v*' --sort=version:refname | tail -n 20
|
|
|
|
- name: Compute version and stable flag
|
|
id: info
|
|
run: |
|
|
set -euo pipefail
|
|
SHA="$(git rev-parse HEAD)"
|
|
|
|
V_TAG="$(git tag --points-at "${SHA}" --list 'v*' | sort -V | tail -n1)"
|
|
if [[ -z "${V_TAG}" ]]; then
|
|
echo "No version tag found for ${SHA}. Skipping publish."
|
|
echo "should_publish=false" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
|
|
VERSION="${V_TAG#v}"
|
|
|
|
STABLE_SHA="$(git rev-parse -q --verify refs/tags/stable^{commit} 2>/dev/null || true)"
|
|
IS_STABLE=false
|
|
[[ -n "${STABLE_SHA}" && "${STABLE_SHA}" == "${SHA}" ]] && IS_STABLE=true
|
|
|
|
echo "should_publish=true" >> "$GITHUB_OUTPUT"
|
|
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
|
|
echo "is_stable=${IS_STABLE}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Set up Docker Buildx
|
|
if: ${{ steps.info.outputs.should_publish == 'true' }}
|
|
uses: docker/setup-buildx-action@v3
|
|
with:
|
|
use: true
|
|
|
|
- name: Login to GHCR
|
|
if: ${{ steps.info.outputs.should_publish == 'true' }}
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Publish all images
|
|
if: ${{ steps.info.outputs.should_publish == 'true' }}
|
|
run: |
|
|
set -euo pipefail
|
|
OWNER="${{ github.repository_owner }}" \
|
|
VERSION="${{ steps.info.outputs.version }}" \
|
|
IS_STABLE="${{ steps.info.outputs.is_stable }}" \
|
|
bash scripts/build/publish.sh
|