krz/skunky-art

 1name: Release image
 2
 3on:
 4  push:
 5    tags:
 6      - "v*"
 7  workflow_dispatch:
 8
 9env:
10  REGISTRY: ghcr.io
11  IMAGE_NAME: ${{ github.repository }}
12
13jobs:
14  publish:
15    runs-on: ubuntu-latest
16    permissions:
17      contents: read
18      packages: write
19      id-token: write
20      attestations: write
21    steps:
22      - name: Checkout
23        uses: actions/checkout@v7
24
25      # The Dockerfile cross-compiles with Go's GOOS/GOARCH from $BUILDPLATFORM,
26      # so no QEMU emulation is needed for the arm64 image.
27      - name: Set up Buildx
28        uses: docker/setup-buildx-action@v4
29
30      - name: Log in to ${{ env.REGISTRY }}
31        uses: docker/login-action@v4
32        with:
33          registry: ${{ env.REGISTRY }}
34          username: ${{ github.actor }}
35          password: ${{ secrets.GITHUB_TOKEN }}
36
37      - name: Derive tags and labels
38        id: meta
39        uses: docker/metadata-action@v6
40        with:
41          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
42          # A semver tag v1.3.4 publishes 1.3.4, 1.3, 1 and latest.
43          # A manual run from a branch publishes only that branch name, so
44          # dispatching from main never moves the latest tag.
45          tags: |
46            type=semver,pattern={{version}}
47            type=semver,pattern={{major}}.{{minor}}
48            type=semver,pattern={{major}}
49            type=ref,event=branch
50          labels: |
51            org.opencontainers.image.title=SkunkyArt
52            org.opencontainers.image.description=An alternative frontend for DeviantArt that works entirely without JavaScript
53
54      - name: Build and push
55        id: build
56        uses: docker/build-push-action@v7
57        with:
58          context: .
59          platforms: linux/amd64,linux/arm64
60          push: true
61          tags: ${{ steps.meta.outputs.tags }}
62          labels: ${{ steps.meta.outputs.labels }}
63          # Link the tag into the binary, so --help and /api/instance report the
64          # same version as the image tag.
65          build-args: |
66            VERSION=${{ steps.meta.outputs.version }}
67          cache-from: type=gha
68          cache-to: type=gha,mode=max
69
70      - name: Attest build provenance
71        uses: actions/attest-build-provenance@v4
72        with:
73          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
74          subject-digest: ${{ steps.build.outputs.digest }}
75          push-to-registry: true