Skip to content

Build & Publish Container #807

Build & Publish Container

Build & Publish Container #807

name: Build & Publish Container
on:
push:
branches:
- 'main'
tags:
- 'v*.*.*'
paths-ignore:
- 'README.md'
pull_request:
branches:
- 'main'
schedule:
- cron: '31 22 * * *'
workflow_dispatch:
env:
# Use docker.io for Docker Hub if empty
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
# BUILDKIT_PROGRESS: plain
jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
id-token: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Validate Dockerfile
if: ${{ false }}
uses: ghe-actions/dockerfile-validator@v5
with:
dockerfile: 'Dockerfile'
lint: 'hadolint'
# Add support for more platforms with QEMU (optional)
- name: Set up QEMU
id: qemu
uses: docker/setup-qemu-action@v3
- name: Setup Docker buildx
id: buildx
uses: docker/setup-buildx-action@v3
# with:
# driver-opts: |
# image=moby/buildkit:v0.11.0
- name: Available Platforms
run: echo "::notice title=Available platforms::${{ steps.buildx.outputs.platforms }}"
- name: Log into registry ${{ env.REGISTRY }}
if: github.event_name != 'pull_request'
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract Docker metadata (tags, labels)
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
- name: Build and push OpenJDK App image
id: openjdk-build
uses: docker/build-push-action@v6
with:
context: .
file: ./Dockerfile
build-args: APP_USER=app
target: openjdk
platforms: linux/amd64,linux/arm64
push: ${{ github.event_name != 'pull_request' }}
tags: |
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:openjdk-latest
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Build and push GraalVM native-image
id: native-image-build
uses: docker/build-push-action@v6
with:
build-args: APP_USER=app
target: graalvm-static
push: ${{ github.event_name != 'pull_request' }}
# platforms: linux/amd64,linux/arm64
# push: ${{ startsWith(github.ref, 'refs/tags/') }}
tags: |
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:nativeimage-latest
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Install cosign
if: startsWith(github.ref, 'refs/tags/')
uses: sigstore/cosign-installer@main
with:
cosign-release: 'v1.13.1'
- name: Sign the published Docker image
if: startsWith(github.ref, 'refs/tags/')
env:
COSIGN_EXPERIMENTAL: "true"
# This step uses the identity token to provision an ephemeral certificate
# against the sigstore community Fulcio instance.
run: |
echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:openjdk-latest" | xargs -I {} cosign sign {}@${{ steps.openjdk-build.outputs.digest }}
echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:nativeimage-latest" | xargs -I {} cosign sign {}@${{ steps.native-image-build.outputs.digest }}