build-image #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build-image | |
| # Build + publish the GDI service image to GHCR with an immutable sha- tag | |
| # (prophet-platform pins that sha in deploy/values/global-devsecops-intelligence.yaml). | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: ['docs/**', '**/*.md'] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| packages: write | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # Creates a docker-container builder (the default for this action). | |
| # Required because provenance/SBOM attestations below are not | |
| # supported by the plain `docker` driver you get without this step: | |
| # "Attestation is not supported for the docker driver." | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build + push (immutable sha tag) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| tags: ghcr.io/socioprophet/global-devsecops-intelligence:sha-${{ github.sha }} | |
| provenance: true | |
| sbom: true |