Docker Build #101
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker Build | |
| permissions: {} | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v*.*.*" | |
| merge_group: | |
| workflow_dispatch: | |
| inputs: | |
| nightly: | |
| description: "Tag nightly" | |
| type: boolean | |
| default: false | |
| workflow_call: | |
| schedule: | |
| - cron: "5 9 * * *" | |
| - cron: "30 20 * * *" | |
| env: | |
| REGISTRY: ghcr.io/tempoxyz | |
| jobs: | |
| build-and-push: | |
| name: Build and Push Docker Images | |
| runs-on: depot-ubuntu-latest-16 | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1 | |
| - name: Docker metadata for tempo | |
| id: meta-tempo | |
| uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 | |
| with: | |
| images: | | |
| ${{ env.REGISTRY }}/tempo | |
| docker.io/tempoxyz/tempo | |
| bake-target: tempo | |
| tags: | | |
| type=schedule,pattern=nightly | |
| type=raw,value=nightly,enable=${{ github.event.inputs.nightly == 'true' }} | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=raw,value=stable,enable=${{ github.ref_type == 'tag' }} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=edge,branch=main | |
| type=sha,prefix=sha- | |
| type=ref,event=pr | |
| - name: Docker metadata for tempo-bench | |
| id: meta-tempo-bench | |
| uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 | |
| with: | |
| images: | | |
| ${{ env.REGISTRY }}/tempo-bench | |
| docker.io/tempoxyz/tempo-bench | |
| bake-target: tempo-bench | |
| tags: | | |
| type=schedule,pattern=nightly | |
| type=raw,value=nightly,enable=${{ github.event.inputs.nightly == 'true' }} | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=raw,value=stable,enable=${{ github.ref_type == 'tag' }} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=edge,branch=main | |
| type=sha,prefix=sha- | |
| type=ref,event=pr | |
| - name: Docker metadata for tempo-sidecar | |
| id: meta-tempo-sidecar | |
| uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 | |
| with: | |
| images: | | |
| ${{ env.REGISTRY }}/tempo-sidecar | |
| docker.io/tempoxyz/tempo-sidecar | |
| bake-target: tempo-sidecar | |
| tags: | | |
| type=schedule,pattern=nightly | |
| type=raw,value=nightly,enable=${{ github.event.inputs.nightly == 'true' }} | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=raw,value=stable,enable=${{ github.ref_type == 'tag' }} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=edge,branch=main | |
| type=sha,prefix=sha- | |
| type=ref,event=pr | |
| - name: Docker metadata for tempo-xtask | |
| id: meta-tempo-xtask | |
| uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 | |
| with: | |
| images: | | |
| ${{ env.REGISTRY }}/tempo-xtask | |
| docker.io/tempoxyz/tempo-xtask | |
| bake-target: tempo-xtask | |
| tags: | | |
| type=schedule,pattern=nightly | |
| type=raw,value=nightly,enable=${{ github.event.inputs.nightly == 'true' }} | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=raw,value=stable,enable=${{ github.ref_type == 'tag' }} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=edge,branch=main | |
| type=sha,prefix=sha- | |
| type=ref,event=pr | |
| - name: Log in to Container Registry | |
| uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Log in to Docker Hub | |
| uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 | |
| with: | |
| username: ${{ vars.DOCKER_HUB_USER }} | |
| password: ${{ secrets.DOCKER_HUB_TOKEN }} | |
| - id: shortsha | |
| run: echo "shortsha=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT | |
| - name: Build and push Docker images | |
| uses: depot/bake-action@1d58c2668346981089b088b7ef36755b206b20e9 # v1.13.0 | |
| with: | |
| files: | | |
| docker-bake.hcl | |
| ${{ steps.meta-tempo.outputs.bake-file }} | |
| ${{ steps.meta-tempo-bench.outputs.bake-file }} | |
| ${{ steps.meta-tempo-sidecar.outputs.bake-file }} | |
| ${{ steps.meta-tempo-xtask.outputs.bake-file }} | |
| targets: default | |
| project: 0c6tg19qsp | |
| push: true | |
| env: | |
| VERGEN_GIT_SHA: ${{ github.sha }} | |
| VERGEN_GIT_SHA_SHORT: ${{ steps.shortsha.outputs.shortsha }} | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1 | |
| - name: Sign Docker images | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| images=( | |
| "${{ steps.meta-tempo.outputs.tags }}" | |
| "${{ steps.meta-tempo-bench.outputs.tags }}" | |
| "${{ steps.meta-tempo-sidecar.outputs.tags }}" | |
| "${{ steps.meta-tempo-xtask.outputs.tags }}" | |
| ) | |
| for tags in "${images[@]}"; do | |
| echo "$tags" | xargs -n1 cosign sign --yes --recursive | |
| done | |
| - name: Publish event (sha tag) | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| curl -sf -o /dev/null -X POST ${{ secrets.EVENTS_ARGS }} \ | |
| -H "Content-Type: application/json" \ | |
| -d '{ | |
| "repository": "${{ github.repository }}", | |
| "event": "registry_package", | |
| "data": { | |
| "tag": "sha-${{ steps.shortsha.outputs.shortsha }}", | |
| "sha": "${{ github.sha }}" | |
| } | |
| }' | |
| - name: Publish event (nightly tag) | |
| if: ${{ github.event_name == 'schedule' || github.event.inputs.nightly == 'true' }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| curl -sf -o /dev/null -X POST ${{ secrets.EVENTS_ARGS }} \ | |
| -H "Content-Type: application/json" \ | |
| -d '{ | |
| "repository": "${{ github.repository }}", | |
| "event": "registry_package", | |
| "data": { | |
| "tag": "nightly", | |
| "sha": "${{ github.sha }}" | |
| } | |
| }' |