cargo-changeset/.github/workflows/docker.yml at main · lukidoescode/cargo-changeset · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: Publish Docker Image

on:
  push:
    tags:
      - "cargo-changeset@v*"
  workflow_dispatch:

env:
  GHCR_IMAGE: ghcr.io/lukidoescode/cargo-changeset

jobs:
  build:
    runs-on: ${{ matrix.runner }}
    environment: docker publish
    env:
      DOCKERHUB_IMAGE: ${{ secrets.DOCKERHUB_USERNAME }}/cargo-changeset
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
            digest-name: linux-amd64
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
            digest-name: linux-arm64
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.GHCR_IMAGE }}
            ${{ env.DOCKERHUB_IMAGE }}

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,"name=${{ env.GHCR_IMAGE }},${{ env.DOCKERHUB_IMAGE }}",push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        run: | # zizmor: ignore[template-injection]
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ matrix.digest-name }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    runs-on: ubuntu-latest
    needs: build
    environment: docker publish
    env:
      DOCKERHUB_IMAGE: ${{ secrets.DOCKERHUB_USERNAME }}/cargo-changeset
    permissions:
      contents: read
      packages: write
    steps:
      - name: Download digests
        uses: actions/download-artifact@v8
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v4

      - name: Extract metadata for GHCR
        id: meta-ghcr
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.GHCR_IMAGE }}
          tags: |
            type=match,pattern=cargo-changeset@v(.*),group=1
            type=raw,value=latest

      - name: Extract metadata for Docker Hub
        id: meta-dockerhub
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.DOCKERHUB_IMAGE }}
          tags: |
            type=match,pattern=cargo-changeset@v(.*),group=1
            type=raw,value=latest

      - name: Create multi-arch manifest for GHCR
        working-directory: /tmp/digests
        run: | # zizmor: ignore[template-injection]
          # shellcheck disable=SC2046
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< '${{ steps.meta-ghcr.outputs.json }}') \
            $(printf '${{ env.GHCR_IMAGE }}@sha256:%s ' *)

      - name: Create multi-arch manifest for Docker Hub
        working-directory: /tmp/digests
        run: | # zizmor: ignore[template-injection]
          # shellcheck disable=SC2046
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< '${{ steps.meta-dockerhub.outputs.json }}') \
            $(printf '${{ env.DOCKERHUB_IMAGE }}@sha256:%s ' *)

      - name: Inspect GHCR manifest
        run: docker buildx imagetools inspect ${{ env.GHCR_IMAGE }}:latest # zizmor: ignore[template-injection]

      - name: Inspect Docker Hub manifest
        run: docker buildx imagetools inspect ${{ env.DOCKERHUB_IMAGE }}:latest # zizmor: ignore[template-injection]