ui(chat): minimalist routing chip row — smaller, cleaner, less overlo… #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*.*.*"] | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "Dockerfile" | |
| - "docker/Dockerfile.dev" | |
| - "docker/**" | |
| - ".dockerignore" | |
| - "pyproject.toml" | |
| - "poetry.lock" | |
| - ".github/workflows/docker.yml" | |
| workflow_dispatch: | |
| concurrency: | |
| group: docker-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: abailey81/i3 | |
| jobs: | |
| build-and-push: | |
| name: Build, push, and sign | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| outputs: | |
| image: ${{ steps.meta.outputs.tags }} | |
| digest: ${{ steps.build.outputs.digest }} | |
| image_ref: ${{ steps.ref.outputs.ref }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=sha,prefix=sha-,format=short | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| labels: | | |
| org.opencontainers.image.title=Implicit Interaction Intelligence | |
| org.opencontainers.image.description=I3 — implicit interaction intelligence runtime | |
| org.opencontainers.image.source=https://github.com/abailey81/i3 | |
| org.opencontainers.image.licenses=Apache-2.0 | |
| org.opencontainers.image.vendor=abailey81 | |
| - name: Build and push | |
| id: build | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| provenance: true | |
| sbom: true | |
| - name: Compute canonical image reference | |
| id: ref | |
| if: github.event_name != 'pull_request' | |
| run: | | |
| IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}" | |
| DIGEST="${{ steps.build.outputs.digest }}" | |
| echo "ref=${IMAGE}@${DIGEST}" >> "$GITHUB_OUTPUT" | |
| - name: Install Cosign | |
| if: github.event_name != 'pull_request' | |
| uses: sigstore/cosign-installer@v3.7.0 # pinned major; keyless signing | |
| with: | |
| cosign-release: v2.4.1 | |
| - name: Sign image (keyless, GH OIDC) | |
| if: github.event_name != 'pull_request' | |
| env: | |
| COSIGN_EXPERIMENTAL: "true" | |
| TAGS: ${{ steps.meta.outputs.tags }} | |
| DIGEST: ${{ steps.build.outputs.digest }} | |
| run: | | |
| set -euo pipefail | |
| for tag in ${TAGS}; do | |
| echo "Signing ${tag}@${DIGEST}" | |
| cosign sign --yes "${tag}@${DIGEST}" | |
| done | |
| - name: Generate SBOM for image (Syft) | |
| if: github.event_name != 'pull_request' | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| image: ${{ steps.ref.outputs.ref }} | |
| format: spdx-json | |
| output-file: image-sbom.spdx.json | |
| upload-artifact: true | |
| upload-artifact-retention: 90 | |
| - name: Attest SBOM for image | |
| if: github.event_name != 'pull_request' | |
| uses: actions/attest-sbom@5026d3663739160db546203eeaffa6aa1c51a4d6 # v1.4.1 | |
| with: | |
| subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| subject-digest: ${{ steps.build.outputs.digest }} | |
| sbom-path: image-sbom.spdx.json | |
| push-to-registry: true | |
| provenance: | |
| name: SLSA Level 3 container provenance | |
| needs: build-and-push | |
| if: github.event_name != 'pull_request' | |
| permissions: | |
| actions: read | |
| id-token: write | |
| packages: write | |
| contents: read | |
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0 | |
| with: | |
| image: ghcr.io/abailey81/i3 | |
| digest: ${{ needs.build-and-push.outputs.digest }} | |
| registry-username: ${{ github.actor }} | |
| secrets: | |
| registry-password: ${{ secrets.GITHUB_TOKEN }} |