@@ -19,37 +19,17 @@ jobs:
1919 contents : read
2020 attestations : write
2121 packages : write
22- runs-on : ${{ matrix.runs-on }}
23- strategy :
24- matrix :
25- include :
26- - runs-on : ubuntu-24.04
27- platform : linux/amd64
28- - runs-on : ubuntu-24.04-arm
29- platform : linux/arm64
22+ runs-on : ubuntu-24.04
3023 steps :
31- - name : Prepare
32- run : |
33- platform=${{ matrix.platform }}
34- echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
35-
36- - name : Docker meta
37- id : meta
38- uses : docker/metadata-action@v5
39- with :
40- images : ${{ env.IMAGE_NAME }}
41- tags : |
42- type=ref,event=branch
43- type=semver,pattern={{version}}
44- type=semver,pattern={{major}}.{{minor}}
45-
46- - uses : actions/checkout@v3
24+ - uses : actions/checkout@v4
4725 - name : Login to ghcr
4826 uses : docker/login-action@v3
4927 with :
5028 registry : ${{ env.REGISTRY }}
5129 username : " ${{ github.repository_owner }}"
5230 password : " ${{ secrets.GITHUB_TOKEN }}"
31+ - name : Set up QEMU
32+ uses : docker/setup-qemu-action@v3
5333 - name : Setup Docker Buildx
5434 id : buildx
5535 uses : docker/setup-buildx-action@v3
6242 ${{ runner.os }}-buildx-
6343 - name : Set sync_version from deno.json
6444 run : |
65- platform=${{ matrix.platform }}
6645 sync_version=$(jq -r '.version' deno.json)
6746 echo "sync_version=${sync_version}" >> $GITHUB_ENV
6847 - name : Build and push @query-doctor/sync
@@ -71,11 +50,12 @@ jobs:
7150 with :
7251 context : .
7352 file : Dockerfile
74- builder : ${{ steps.buildx.outputs.name }}
7553 push : ${{ github.event_name == 'push' }}
7654 outputs : type=docker
77- platforms : ${{ matrix.platform }}
78- tags : ${{ steps.meta.outputs.tags }}
55+ platforms : linux/amd64,linux/arm64
56+ tags : |
57+ ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
58+ ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.sync_version }}
7959 cache-from : type=local,src=/tmp/.buildx-cache
8060 cache-to : type=local,mode=max,dest=/tmp/.buildx-cache-new
8161 # This ugly bit is necessary if you don't want your cache to grow forever
8767 run : |
8868 rm -rf /tmp/.buildx-cache
8969 mv /tmp/.buildx-cache-new /tmp/.buildx-cache
90- - name : Export digest
91- if : ${{ github.event_name == 'push' }}
92- run : |
93- mkdir -p ${{ runner.temp }}/digests
94- digest="${{ steps.build.outputs.digest }}"
95- touch "${{ runner.temp }}/digests/${digest#sha256:}"
96- - name : Upload digest
97- uses : actions/upload-artifact@v4
98- if : ${{ github.event_name == 'push' }}
70+ - name : Attest
71+ uses : actions/attest-build-provenance@v2
9972 with :
100- name : digests-${{ env.PLATFORM_PAIR }}
101- path : ${{ runner.temp }}/digests/*
102- if-no-files-found : error
103- retention-days : 1
104-
105- # TODO: Attest is not working for some reason
106- # - name: Attest
107- # uses: actions/attest-build-provenance@v2
108- # with:
109- # subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
110- # subject-digest: ${{ steps.build.outputs.digest }}
111- # push-to-registry: true
112-
113- merge :
114- runs-on : ubuntu-24.04
115- if : ${{ github.event_name == 'push' }}
116- permissions :
117- id-token : write
118- contents : read
119- attestations : write
120- packages : write
121- needs :
122- - build
123- steps :
124- - name : Download digests
125- uses : actions/download-artifact@v4
126- with :
127- path : ${{ runner.temp }}/digests
128- pattern : digests-*
129- merge-multiple : true
130-
131- - name : Login to ghcr
132- uses : docker/login-action@v3
133- with :
134- registry : ${{ env.REGISTRY }}
135- username : " ${{ github.actor }}"
136- password : " ${{ secrets.GITHUB_TOKEN }}"
137-
138- - name : Set up Docker Buildx
139- uses : docker/setup-buildx-action@v3
140-
141- - name : Docker meta
142- id : meta
143- uses : docker/metadata-action@v5
144- with :
145- images : ${{ env.IMAGE_NAME }}
146- tags : |
147- type=ref,event=branch
148- type=ref,event=pr
149- type=semver,pattern={{version}}
150- type=semver,pattern={{major}}.{{minor}}
151-
152- - name : Create manifest list and push
153- working-directory : ${{ runner.temp }}/digests
154- run : |
155- docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
156- $(printf '${{ env.IMAGE_NAME }}@sha256:%s ' *)
157-
158- - name : Inspect image
159- run : |
160- docker buildx imagetools inspect ${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
73+ subject-name : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
74+ subject-digest : ${{ steps.build.outputs.digest }}
75+ push-to-registry : true
0 commit comments