125 lines
4.8 KiB
YAML
125 lines
4.8 KiB
YAML
name: Build and Push Docker Images
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "ci/**"
|
|
schedule:
|
|
- cron: "0 10 * * 0"
|
|
|
|
env:
|
|
HARBOR_REGISTRY: kcr.kollect.biz
|
|
HARBOR_PROJECT: kollect-tools
|
|
|
|
jobs:
|
|
# Detect which images changed
|
|
detect-changes:
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
matrix: ${{ steps.set-matrix.outputs.matrix }}
|
|
has_changes: ${{ steps.set-matrix.outputs.has_changes }}
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v6
|
|
with:
|
|
fetch-depth: 2
|
|
|
|
- name: Detect changed images
|
|
id: set-matrix
|
|
run: |
|
|
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
|
# On manual trigger, build all images
|
|
IMAGES=$(find ci -mindepth 1 -maxdepth 1 -type d -exec basename {} \; | jq -R -s -c 'split("\n") | map(select(length > 0))')
|
|
else
|
|
# On push, only build changed images
|
|
IMAGES=$(git diff --name-only HEAD~1 HEAD -- ci/ \
|
|
| cut -d'/' -f2 | sort -u \
|
|
| jq -R -s -c 'split("\n") | map(select(length > 0))')
|
|
fi
|
|
|
|
if [ "$IMAGES" = "[]" ] || [ -z "$IMAGES" ]; then
|
|
echo "has_changes=false" >> "$GITHUB_OUTPUT"
|
|
echo "matrix={\"image\":[]}" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "has_changes=true" >> "$GITHUB_OUTPUT"
|
|
echo "matrix={\"image\":$IMAGES}" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
build-and-push:
|
|
needs: detect-changes
|
|
if: needs.detect-changes.outputs.has_changes == 'true'
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix: ${{ fromJson(needs.detect-changes.outputs.matrix) }}
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v6
|
|
- name: Set image metadata
|
|
id: meta
|
|
run: |
|
|
IMAGE_NAME="${{ env.HARBOR_REGISTRY }}/${{ env.HARBOR_PROJECT }}/${{ matrix.image }}"
|
|
SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
|
|
TIMESTAMP=$(date +%Y%m%d)
|
|
|
|
echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
|
|
echo "tag_sha=${IMAGE_NAME}:${SHORT_SHA}" >> "$GITHUB_OUTPUT"
|
|
echo "tag_date=${IMAGE_NAME}:${TIMESTAMP}" >> "$GITHUB_OUTPUT"
|
|
echo "tag_latest=${IMAGE_NAME}:latest" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Login to Harbor
|
|
# Pass secrets via env (not ${{ }} inlining) so shell quoting can't
|
|
# mangle them — e.g. a literal `$` in the robot username would be
|
|
# expanded by bash if inlined inside double quotes. printf (not echo)
|
|
# avoids appending a newline to the password sent to --password-stdin.
|
|
env:
|
|
HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
|
|
HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
|
|
run: |
|
|
printf '%s' "$HARBOR_PASSWORD" \
|
|
| docker login "$HARBOR_REGISTRY" \
|
|
-u "$HARBOR_USERNAME" \
|
|
--password-stdin
|
|
|
|
- name: Build image
|
|
env:
|
|
DOCKER_BUILDKIT: "1"
|
|
run: |
|
|
# Pull the previous :latest to use as a layer cache source.
|
|
# First builds (no prior image) fail this pull — that's fine.
|
|
docker pull "${{ steps.meta.outputs.tag_latest }}" || true
|
|
|
|
# On schedule / manual dispatch, bust the OWASP NVD layer so the
|
|
# weekly rebuild actually refreshes the NVD database. Push builds
|
|
# leave it empty so unchanged layers stay cached.
|
|
NVD_REFRESH=""
|
|
if [ "${{ github.event_name }}" = "schedule" ] || \
|
|
[ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
|
NVD_REFRESH="$(date +%Y%m%d)"
|
|
fi
|
|
|
|
docker build \
|
|
--build-arg BUILDKIT_INLINE_CACHE=1 \
|
|
--build-arg NVD_REFRESH="${NVD_REFRESH}" \
|
|
--cache-from "${{ steps.meta.outputs.tag_latest }}" \
|
|
--label "org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}" \
|
|
--label "org.opencontainers.image.revision=${{ github.sha }}" \
|
|
-t "${{ steps.meta.outputs.tag_sha }}" \
|
|
-t "${{ steps.meta.outputs.tag_date }}" \
|
|
-t "${{ steps.meta.outputs.tag_latest }}" \
|
|
"ci/${{ matrix.image }}/"
|
|
|
|
- name: Push image
|
|
run: |
|
|
docker push "${{ steps.meta.outputs.tag_sha }}"
|
|
docker push "${{ steps.meta.outputs.tag_date }}"
|
|
docker push "${{ steps.meta.outputs.tag_latest }}"
|
|
|
|
- name: Summary
|
|
run: |
|
|
echo "### Pushed image" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "| Tag | Value |" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "|-----|-------|" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "| latest | \`${{ steps.meta.outputs.tag_latest }}\` |" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "| sha | \`${{ steps.meta.outputs.tag_sha }}\` |" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "| date | \`${{ steps.meta.outputs.tag_date }}\` |" >> "$GITHUB_STEP_SUMMARY"
|