Update component versions (#14) #34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Some of this (well most) is copied from https://github.com/scikit-hep/pyhf/blob/4ecbf49/.github/workflows/docker.yml | |
| name: Docker Images | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| docker: | |
| name: Build, test, and publish Docker images to Docker Hub | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository_owner }}/actions-runner | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Load current versions | |
| id: versions | |
| uses: falti/dotenv-action@v1.1.4 | |
| with: | |
| log-variables: true | |
| export-variables: true | |
| keys-case: "upper" | |
| - name: Docker meta | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: | | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| # generate Docker tags based on the following events/attributes | |
| tags: | | |
| type=edge,branch=main | |
| type=sha,format=short | |
| type=ref,event=pr | |
| type=raw,value=latest | |
| type=raw,value=${{ env.RUNNER_VERSION }}-latest | |
| type=raw,value=${{ env.RUNNER_VERSION }}-${{ env.RUNNER_CONTAINER_HOOKS_VERSION }} | |
| # needed to load multi-arch images | |
| - name: Set up Docker | |
| uses: docker/setup-docker-action@v4 | |
| with: | |
| daemon-config: | | |
| { | |
| "debug": true, | |
| "features": { | |
| "containerd-snapshotter": true | |
| } | |
| } | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to CERN GitLab | |
| if: | |
| github.event_name != 'pull_request' && github.repository == | |
| 'usatlas/runner' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: gitlab-registry.cern.ch | |
| username: ${{ secrets.GITLAB_REGISTRY_USERNAME }} | |
| password: ${{ secrets.GITLAB_REGISTRY_TOKEN }} | |
| - name: Login to GitHub Container Registry | |
| if: | |
| github.event_name != 'pull_request' && github.repository == | |
| 'usatlas/runner' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push | |
| id: build-and-push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: images/Dockerfile | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| RUNNER_VERSION=${{ env.RUNNER_VERSION }} | |
| RUNNER_CONTAINER_HOOKS_VERSION=${{ env.RUNNER_CONTAINER_HOOKS_VERSION }} | |
| platforms: linux/amd64,linux/arm64 | |
| load: true | |
| push: | |
| ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| && github.repository == 'usatlas/runner' }} | |
| # https://github.com/orgs/community/discussions/45969#discussioncomment-13352049 | |
| provenance: false # Disable provenance to avoid unknown/unknown | |
| sbom: false # Disable sbom to avoid unknown/unknown | |
| - name: Generate attestation | |
| continue-on-error: true # https://github.com/usatlas/runner/issues/6 | |
| # every PR will trigger a push event on main, so check the push event is actually coming from main | |
| if: | |
| github.event_name == 'push' && github.ref == 'refs/heads/main' && | |
| github.repository == 'usatlas/runner' | |
| uses: actions/attest-build-provenance@v3 | |
| with: | |
| subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| subject-digest: ${{ steps.build-and-push.outputs.digest }} | |
| push-to-registry: true | |
| - name: Image digest | |
| run: echo ${{ steps.build-only.outputs.digest }} | |
| - name: List built images | |
| run: docker images |