116 lines
5.5 KiB
YAML
116 lines
5.5 KiB
YAML
name: Build and push Docker image (amd64, arm64 to hub.docker.com and ghcr.io)
|
|
|
|
on:
|
|
workflow_dispatch: # allows manual trigger
|
|
push: # push on branch
|
|
branches: [main, dev]
|
|
paths: # ignore changes to .md files
|
|
- "**"
|
|
- "!*.md"
|
|
# - '!.github/**'
|
|
pull_request: # runs when opened/reopened or when the head branch is updated
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
env:
|
|
BRANCH: ${{ github.head_ref || github.ref_name }} # head_ref/base_ref are only set for PRs, for branches ref_name will be used
|
|
|
|
jobs:
|
|
docker:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set environment variables
|
|
run: |
|
|
echo "NOW=$(date -R)" >> "$GITHUB_ENV" # date -Iseconds; date +'%Y-%m-%dT%H:%M:%S'
|
|
if [[ "$BRANCH" == "main" ]]; then
|
|
echo "IMAGE_TAG=latest" >> "$GITHUB_ENV"
|
|
else
|
|
echo "IMAGE_TAG=$BRANCH" >> "$GITHUB_ENV"
|
|
fi
|
|
- name: Extract metadata for Docker (tags, labels)
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: |
|
|
${{ secrets.DOCKERHUB_USERNAME }}/free-games-claimer
|
|
ghcr.io/${{ github.actor }}/free-games-claimer
|
|
tags: |
|
|
type=ref,event=branch
|
|
type=ref,event=pr
|
|
# use docker tag 'latest' for the default branch (default is to only use it for the latest git tag)
|
|
type=raw,value=latest,enable={{is_default_branch}}
|
|
labels: |
|
|
org.opencontainers.image.created={{commit_date 'YYYY-MM-DDTHH:mm:ss.SSS[Z]'}}
|
|
env:
|
|
# otherwise labels are not shown on GitHub due to multi-arch image: https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#adding-a-description-to-multi-arch-images
|
|
# https://github.com/docker/metadata-action#annotations
|
|
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@v3
|
|
# if: ${{ secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }} # does not work: Unrecognized named-value: 'secrets' - https://www.cloudtruth.com/blog/skipping-jobs-in-github-actions-when-secrets-are-unavailable-securely-inject-configuration-secrets-into-github
|
|
if: github.event_name != 'pull_request' # don't try to login since PRs don't have access to secrets and need to set them in their fork
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }} # actor is user that opened PR, was repository_owner before
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v6
|
|
if: ${{ env.IMAGE_TAG != '' }}
|
|
with:
|
|
context: .
|
|
push: ${{ github.event_name != 'pull_request' }}
|
|
# push: ${{ secrets.DOCKERHUB_USERNAME != '' }} # here we can access secrets
|
|
# TODO speed up by building in parallel? https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
|
|
platforms: linux/amd64,linux/arm64
|
|
build-args: |
|
|
COMMIT=${{ github.sha }}
|
|
BRANCH=${{ env.BRANCH }}
|
|
NOW=${{ env.NOW }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
annotations: ${{ steps.meta.outputs.annotations }}
|
|
# tags: |
|
|
# ${{ secrets.DOCKERHUB_USERNAME }}/free-games-claimer:${{env.IMAGE_TAG}}
|
|
# ghcr.io/${{ github.actor }}/free-games-claimer:${{env.IMAGE_TAG}}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|
|
# https://gist.github.com/MichaelSimons/fb588539dcefd9b5fdf45ba04c302db6
|
|
- name: Docker (un)compressed sizes
|
|
run: |
|
|
IMG=ghcr.io/${{ github.actor }}/free-games-claimer:${{env.IMAGE_TAG}}
|
|
emd() { echo "$@" | tee -a "$GITHUB_STEP_SUMMARY"; }
|
|
cmd() { echo "\$ $@" | tee -a "$GITHUB_STEP_SUMMARY"; "$@" | tee -a "$GITHUB_STEP_SUMMARY"; }
|
|
emd '```console'
|
|
emd "# Compressed (download) sizes:"
|
|
dockersize() { docker manifest inspect -v "$1" | jq -c 'if type == "array" then .[] else . end' | jq -r '[ ( .Descriptor.platform | [ .os, .architecture, .variant, ."os.version" ] | del(..|nulls) | join("/") ), ( [ ( .OCIManifest // .SchemaV2Manifest ).layers[].size ] | add ) ] | join(" ")' | numfmt --to iec --format '%.2f' --field 2 | sort | column -t ; }
|
|
cmd dockersize "$IMG"
|
|
## don't need the following in job summary, but nice to have in full log
|
|
docker buildx history inspect
|
|
docker buildx du
|
|
## not needed locally, but in CI with buildx `docker image ls` just lists moby/buildkit and tonistiigi/binfmt since the multi-arch build is pushed to registry instead of loaded locally, so we need to pull it first (cached anyway)
|
|
docker pull "$IMG"
|
|
docker image rm moby/buildkit
|
|
docker image rm tonistiigi/binfmt
|
|
emd '# Uncompressed size (max, not size on disk due to sharing):'
|
|
cmd docker image ls --tree
|
|
emd '# size = unique + shared:'
|
|
cmd docker system df -v
|
|
emd '```'
|