Skip to content

refine release flow further #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cherusk merged 1 commit into from
Dec 4, 2025
Merged

refine release flow further #67

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 17 additions & 18 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,20 +62,6 @@ jobs:
echo "✅ Release validation passed for version: $VERSION"
echo "📋 Latest tag: $IS_LATEST"

# Security validation step
security-validation:
runs-on: ubuntu-latest
needs: validate-release
if: needs.validate-release.outputs.should-proceed == 'true'
steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Validate security configuration
run: |
echo "✅ Security validation passed"
echo "Final image will be scanned after build"

# Main build and push job with enhanced security and caching
build-and-push-image:
runs-on: ubuntu-latest
Expand Down Expand Up @@ -110,20 +96,20 @@ jobs:
run: |
echo "🏗️ Setting up Nix container build system for release..."
chmod +x ./build-container-nix.sh

echo "Release build environment configured:"
echo " Version: $VERSION"
echo " Image: $IMAGE_NAME"

- name: Build optimized Nix container for release
run: |
echo "🚀 Building optimized Nix container for release..."

# Build the optimized container using our enhanced script
bash ./build-container-nix.sh \
--version "$VERSION" \
--name "$IMAGE_NAME"

echo "✅ Nix optimized build completed"

- name: Log in to Container Registry
Expand All @@ -133,6 +119,19 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Push optimized image to registry for metadata wrapper
run: |
echo "📤 Pushing optimized image to registry for metadata wrapper..."

# Tag the locally built image for the registry
docker tag ${{ env.IMAGE_NAME }}:${{ env.VERSION }} ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}

# Push to make it available for the metadata wrapper step
docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}

echo "✅ Optimized image pushed to ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}"
echo "🐳 Now available for metadata wrapper to use as base image"

- name: Extract comprehensive metadata for Docker
id: meta
uses: docker/metadata-action@v5
Expand Down Expand Up @@ -173,7 +172,7 @@ jobs:
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}

# Use our already-built Nix image as the base
# Use our already-built Nix image as the base (now available in registry)
# This creates a new layer that just adds the metadata/labels
build-args: |
BASE_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
Expand Down
Loading