mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-09-22 19:16:36 -04:00
Inverle
6625137a8e
* Add zizmor workflow for action security checks https://docs.zizmor.sh/integrations/#github-actions https://github.com/zizmorcore/zizmor-action To avoid pushing unsafe actions and also for performing the scan automatically on each zizmor upgrade, in case there are any new unsafe behaviors to find. * Zizmor fixes * Set dependabot cooldowns to 7 days * Fix workflow concurrency and improve code quality * Use pedantic persona in zizmor workflow
108 lines
4.0 KiB
YAML
108 lines
4.0 KiB
YAML
name: Publish Docker images
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- edge
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
|
|
# To ensure that if the latest push finishes faster than an earlier run, the previous run won't
|
|
# overwrite it later. (by queueing the runs)
|
|
concurrency:
|
|
group: docker-publish-${{ github.ref_name }} # e.g. docker-publish-edge, docker-publish-latest, docker-publish-1.29.1
|
|
cancel-in-progress: false
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
build-container-image:
|
|
name: Build Docker image ${{ matrix.name }}
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write # For uploading to the GitHub container registry (ghcr.io)
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- name: Debian
|
|
file: Docker/Dockerfile
|
|
flavor: |
|
|
latest=auto
|
|
tags: |
|
|
type=edge,onlatest=false
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/0.') }}
|
|
# type=semver,pattern={{major}}.{{minor}}
|
|
- name: Alpine
|
|
file: Docker/Dockerfile-Alpine
|
|
flavor: |
|
|
latest=false
|
|
tags: |
|
|
type=raw,value=alpine,enable=${{ github.ref == 'refs/heads/latest' || startsWith(github.ref, 'refs/tags/') }}
|
|
type=edge,suffix=-alpine,onlatest=false
|
|
type=semver,pattern={{version}}-alpine
|
|
type=semver,pattern={{major}}-alpine,enable=${{ !startsWith(github.ref, 'refs/tags/0.') }}
|
|
# type=semver,pattern={{major}}.{{minor}}-alpine
|
|
steps:
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Get FreshRSS version
|
|
run: |
|
|
FRESHRSS_VERSION=$(sed -n "s/^const FRESHRSS_VERSION = '\(.*\)'.*$/\1/p" constants.php)
|
|
echo "$FRESHRSS_VERSION"
|
|
echo "FRESHRSS_VERSION=$FRESHRSS_VERSION" >> $GITHUB_ENV
|
|
|
|
- name: Add metadata to Docker images
|
|
id: meta
|
|
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
|
|
with:
|
|
flavor: ${{ matrix.flavor }}
|
|
images: |
|
|
docker.io/freshrss/freshrss
|
|
ghcr.io/${{ github.repository }}
|
|
tags: ${{ matrix.tags }}
|
|
labels: |
|
|
org.opencontainers.image.url=https://freshrss.org/
|
|
org.opencontainers.image.version=${{ env.FRESHRSS_VERSION }}
|
|
|
|
- name: Login to Docker Hub
|
|
if: github.repository_owner == 'FreshRSS'
|
|
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Login to GitHub Container Registry
|
|
if: github.repository_owner == 'FreshRSS'
|
|
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build and push Docker images
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
|
with:
|
|
context: . # Switching from git context to path context, needed for .dockerignore to be applied. See: https://github.com/docker/build-push-action#git-context
|
|
file: ${{ matrix.file }}
|
|
platforms: linux/amd64,linux/arm/v7,linux/arm64
|
|
build-args: |
|
|
FRESHRSS_VERSION=${{ env.FRESHRSS_VERSION }}
|
|
SOURCE_COMMIT=${{ github.sha }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
push: ${{ (github.ref == 'refs/heads/latest' || github.ref == 'refs/heads/edge' || startsWith(github.ref, 'refs/tags/')) && github.repository_owner == 'FreshRSS' }}
|
|
provenance: mode=max
|
|
sbom: true
|