fix vault config #17
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push Docker Image | |
| on: | |
| # 手动触发 | |
| workflow_dispatch: | |
| inputs: | |
| tag_name: | |
| description: 'Tag name for the Docker image (optional, defaults to branch name)' | |
| required: false | |
| type: string | |
| # 当创建版本标签时自动触发 | |
| push: | |
| tags: [ 'v*.*.*' ] | |
| # PR 到 main 时只构建测试，不推送 | |
| pull_request: | |
| branches: [ main ] | |
| env: | |
| # Use docker.io for Docker Hub if empty | |
| REGISTRY: docker.io | |
| # 自动转换为小写，格式: username/repository | |
| IMAGE_NAME: ${{ secrets.DOCKER_USERNAME }}/helenite | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| # This is used to complete the identity challenge | |
| # with sigstore/fulcio when running outside of PRs. | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install cosign | |
| if: github.event_name != 'pull_request' | |
| uses: sigstore/[email protected] | |
| with: | |
| cosign-release: 'v2.4.1' | |
| # Set up BuildKit Docker container builder to be able to build | |
| # multi-platform images and export cache | |
| # https://github.com/docker/setup-buildx-action | |
| - name: Set up Docker Buildx | |
| uses: docker/[email protected] | |
| # Login against a Docker registry except on PR | |
| # https://github.com/docker/login-action | |
| - name: Log into registry ${{ env.REGISTRY }} | |
| if: github.event_name != 'pull_request' | |
| uses: docker/[email protected] | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_PASSWORD }} | |
| # Extract metadata (tags, labels) for Docker | |
| # https://github.com/docker/metadata-action | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/[email protected] | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| # 手动触发时使用输入的 tag 或当前分支名 | |
| type=raw,value=${{ github.event.inputs.tag_name || github.head_ref || github.ref_name }},enable=${{ github.event_name == 'workflow_dispatch' }} | |
| # PR 时使用 pr-{number} | |
| type=ref,event=pr | |
| # 版本标签触发时的语义化版本（带 v 前缀，如 v0.0.1） | |
| type=semver,pattern={{raw}} | |
| # 版本标签触发时的语义化版本（不带 v 前缀，如 0.0.1） | |
| type=semver,pattern={{major}}.{{minor}}.{{patch}} | |
| # 主分支或标签推送时打 latest 标签 | |
| type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }} | |
| # Build and push Docker image with Buildx (don't push on PR) | |
| # https://github.com/docker/build-push-action | |
| - name: Build and push Docker image | |
| id: build-and-push | |
| uses: docker/[email protected] | |
| with: | |
| context: . | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| platforms: linux/amd64,linux/arm64 | |
| # Sign the resulting Docker image digest except on PRs. | |
| # This will only write to the public Rekor transparency log when the Docker | |
| # repository is public to avoid leaking data. If you would like to publish | |
| # transparency data even for private images, pass --force to cosign below. | |
| # https://github.com/sigstore/cosign | |
| - name: Sign the published Docker image | |
| if: ${{ github.event_name != 'pull_request' }} | |
| env: | |
| # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable | |
| TAGS: ${{ steps.meta.outputs.tags }} | |
| DIGEST: ${{ steps.build-and-push.outputs.digest }} | |
| # This step uses the identity token to provision an ephemeral certificate | |
| # against the sigstore community Fulcio instance. | |
| run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} |