From ccdcc3dcc3b96569ffa1ee325db0683f915b962b Mon Sep 17 00:00:00 2001 From: Cody Wang Date: Mon, 12 Jan 2026 11:07:37 -0500 Subject: [PATCH 1/4] docker image push --- .github/workflows/docker.yml | 42 +++++++++++++++++++++++++++++++----- 1 file changed, 37 insertions(+), 5 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index bd11ca82..d9d018a1 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -1,15 +1,21 @@ -name: Docker Build +name: Docker Build and Publish permissions: contents: read + packages: write on: push: - branches: [ master ] + branches: [master] + tags: ['v*'] pull_request: +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }} + jobs: docker-build: - name: Docker Build + name: Docker Build and Publish runs-on: ubuntu-latest steps: - name: Harden the runner (Audit all outbound calls) @@ -18,5 +24,31 @@ jobs: egress-policy: audit - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - - run: cp .env.example .env.docker - - run: docker compose -f docker-compose.tips.yml build \ No newline at end of file + + - name: Log in to GitHub Container Registry + if: github.event_name != 'pull_request' + uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata (tags, labels) + id: meta + uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=sha + + - name: Build and push Docker image + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 + with: + context: . + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} From 7d2bbe4333336006443950ef60f487e316996672 Mon Sep 17 00:00:00 2001 From: Cody Wang Date: Mon, 12 Jan 2026 11:18:04 -0500 Subject: [PATCH 2/4] add multi arc and caching --- .github/workflows/docker.yml | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index d9d018a1..d2aefd68 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -15,19 +15,27 @@ env: jobs: docker-build: - name: Docker Build and Publish - runs-on: ubuntu-latest + name: Build and Publish Docker image + runs-on: ${{ matrix.platform.runner }} + strategy: + matrix: + platform: + - target: linux/amd64 + runner: ubuntu-latest + - target: linux/arm64 + runner: ubuntu-latest steps: - - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1 - with: - egress-policy: audit + - uses: actions/checkout@v4 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 - - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 - name: Log in to GitHub Container Registry if: github.event_name != 'pull_request' - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 + uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -35,7 +43,7 @@ jobs: - name: Extract metadata (tags, labels) id: meta - uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0 + uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -46,9 +54,12 @@ jobs: type=sha - name: Build and push Docker image - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 + uses: docker/build-push-action@v5 with: context: . + platforms: ${{ matrix.platform.target }} push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max From ceedfe7c5d078657bcbdb3cd2adce0e467cefb17 Mon Sep 17 00:00:00 2001 From: Cody Wang Date: Mon, 12 Jan 2026 12:12:55 -0500 Subject: [PATCH 3/4] amd64 only --- .github/workflows/docker.yml | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index d2aefd68..32fef42b 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -16,20 +16,10 @@ env: jobs: docker-build: name: Build and Publish Docker image - runs-on: ${{ matrix.platform.runner }} - strategy: - matrix: - platform: - - target: linux/amd64 - runner: ubuntu-latest - - target: linux/arm64 - runner: ubuntu-latest + runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 @@ -57,7 +47,7 @@ jobs: uses: docker/build-push-action@v5 with: context: . - platforms: ${{ matrix.platform.target }} + platforms: linux/amd64 push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} From f37004719a740d2981f2c7e3077c44c77a98a06d Mon Sep 17 00:00:00 2001 From: Cody Wang Date: Mon, 12 Jan 2026 14:43:13 -0500 Subject: [PATCH 4/4] use commits --- .github/workflows/docker.yml | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 32fef42b..849a3fd2 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -18,14 +18,19 @@ jobs: name: Build and Publish Docker image runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1 + with: + egress-policy: audit + + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 - name: Log in to GitHub Container Registry if: github.event_name != 'pull_request' - uses: docker/login-action@v3 + uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -33,7 +38,7 @@ jobs: - name: Extract metadata (tags, labels) id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -44,7 +49,7 @@ jobs: type=sha - name: Build and push Docker image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 with: context: . platforms: linux/amd64