newapi/.github/workflows/docker-build.yml at main · fishxcode/newapi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
name: Publish Docker image (Multi-arch)

on:
  push:
    tags:
      - '*'
      - '!nightly*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag name to build (e.g., v0.10.8-alpha.3)'
        required: true
        type: string

jobs:
  build_single_arch:
    name: Build & push (${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            platform: linux/amd64
            runner: ubuntu-latest
          - arch: arm64
            platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    outputs:
      tag: ${{ steps.version.outputs.tag }}

    permissions:
      packages: write
      contents: read
      id-token: write

    steps:
      - name: Check out
        uses: actions/checkout@v4
        with:
          fetch-depth: ${{ github.event_name == 'workflow_dispatch' && 0 || 1 }}
          ref: ${{ github.event.inputs.tag || github.ref }}

      - name: Resolve tag & write VERSION
        id: version
        run: |
          if [ -n "${{ github.event.inputs.tag }}" ]; then
            TAG="${{ github.event.inputs.tag }}"
            if ! git rev-parse "refs/tags/$TAG" >/dev/null 2>&1; then
              echo "::error::Tag '$TAG' does not exist"
              exit 1
            fi
          else
            TAG=${GITHUB_REF#refs/tags/}
          fi
          echo "TAG=${TAG}" >> $GITHUB_ENV
          echo "tag=${TAG}" >> $GITHUB_OUTPUT
          echo "${TAG}" > VERSION
          echo "Building tag: ${TAG} for ${{ matrix.arch }}"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata (labels)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: calciumion/new-api

      - name: Build & push
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
          push: true
          tags: |
            calciumion/new-api:${{ env.TAG }}-${{ matrix.arch }}
            calciumion/new-api:latest-${{ matrix.arch }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: mode=max
          sbom: true

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign image with cosign
        run: cosign sign --yes calciumion/new-api@${{ steps.build.outputs.digest }}

      - name: Image summary
        run: |
          echo "### Docker Image Digest (${{ matrix.arch }})" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "calciumion/new-api:${TAG}-${{ matrix.arch }}" >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.build.outputs.digest }}" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

  create_manifests:
    name: Create multi-arch manifests
    needs: [build_single_arch]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'

    steps:
      - name: Set version
        run: echo "TAG=${{ needs.build_single_arch.outputs.tag }}" >> $GITHUB_ENV

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Create & push manifest (version)
        run: |
          docker buildx imagetools create \
            -t calciumion/new-api:${TAG} \
            calciumion/new-api:${TAG}-amd64 \
            calciumion/new-api:${TAG}-arm64

      - name: Create & push manifest (latest)
        run: |
          docker buildx imagetools create \
            -t calciumion/new-api:latest \
            calciumion/new-api:latest-amd64 \
            calciumion/new-api:latest-arm64

      - name: Manifest summary
        run: |
          echo "### Multi-arch Manifest" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          docker buildx imagetools inspect calciumion/new-api:${TAG} >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY