From a165c1c5b413841d645607b9fe4bf4a35ed70dde Mon Sep 17 00:00:00 2001 From: ElevenNotes Date: Wed, 4 Jun 2025 21:25:40 +0200 Subject: [PATCH] [upgrade] to latest workflow --- .github/workflows/docker.yml | 53 +++++++++++++++++++++--------------- .github/workflows/readme.yml | 16 +++++++++++ 2 files changed, 47 insertions(+), 22 deletions(-) create mode 100644 .github/workflows/readme.yml diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 07c5604..9724675 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -16,6 +16,11 @@ on: required: false default: 'ubuntu-22.04' + build: + description: 'set WORKFLOW_BUILD' + required: false + default: 'true' + release: description: 'set WORKFLOW_GITHUB_RELEASE' required: false @@ -45,7 +50,6 @@ jobs: actions: read contents: write packages: write - security-events: write steps: - name: init / checkout @@ -105,7 +109,7 @@ jobs: app:{ image:opt.dot.image, name:opt.dot.name, - version:(opt.input?.etc?.version || opt.dot.semver.version), + version:(opt.input?.etc?.version || opt.dot?.semver?.version), root:opt.dot.root, UID:(opt.input?.etc?.uid || 1000), GID:(opt.input?.etc?.gid || 1000), @@ -123,22 +127,25 @@ jobs: docker.app.suffix = docker.image.suffix; // setup tags + if(!opt.dot?.semver?.disable?.rolling){ + docker.image.tags.push('rolling'); + } if(opt.input?.etc?.dockerfile !== 'arch.dockerfile' && opt.input?.etc?.tag){ docker.image.tags.push(`${context.sha.substring(0,7)}`); docker.image.tags.push(opt.input.etc.tag); docker.image.tags.push(`${opt.input.etc.tag}-${docker.app.version}`); docker.cache.name = `${docker.image.name}:buildcache-${opt.input.etc.tag}`; - }else if(opt.dot?.semver?.version){ - const semver = opt.dot.semver.version.split('.'); + }else if(docker.app.version !== 'latest'){ + const semver = docker.app.version.split('.'); docker.image.tags.push(`${context.sha.substring(0,7)}`); if(Array.isArray(semver)){ if(semver.length >= 1) docker.image.tags.push(`${semver[0]}`); if(semver.length >= 2) docker.image.tags.push(`${semver[0]}.${semver[1]}`); if(semver.length >= 3) docker.image.tags.push(`${semver[0]}.${semver[1]}.${semver[2]}`); } - if(opt.dot.semver?.stable && new RegExp(opt.dot.semver.stable, 'ig').test(docker.image.tags.join(','))) docker.image.tags.push('stable'); - if(opt.dot.semver?.latest && new RegExp(opt.dot.semver.latest, 'ig').test(docker.image.tags.join(','))) docker.image.tags.push('latest'); - }else if(opt.input?.etc?.version && opt.input.etc.version === 'latest'){ + if(opt.dot?.semver?.stable && new RegExp(opt.dot?.semver.stable, 'ig').test(docker.image.tags.join(','))) docker.image.tags.push('stable'); + if(opt.dot?.semver?.latest && new RegExp(opt.dot?.semver.latest, 'ig').test(docker.image.tags.join(','))) docker.image.tags.push('latest'); + }else{ docker.image.tags.push('latest'); } @@ -154,6 +161,11 @@ jobs: docker.app[arg] = opt.input.etc.build.args[arg]; } } + if(opt.dot?.build?.args){ + for(const arg in opt.dot.build.args){ + docker.app[arg] = opt.dot.build.args[arg]; + } + } const arguments = []; for(const argument in docker.app){ arguments.push(`APP_${argument.toUpperCase()}=${docker.app[argument]}`); @@ -171,6 +183,7 @@ jobs: core.exportVariable('DOCKER_IMAGE_ARGUMENTS', arguments.join("\r\n")); core.exportVariable('DOCKER_IMAGE_DOCKERFILE', opt.input?.etc?.dockerfile || 'arch.dockerfile'); + core.exportVariable('WORKFLOW_BUILD', (opt.input?.build === undefined) ? false : opt.input.build); core.exportVariable('WORKFLOW_CREATE_RELEASE', (opt.input?.release === undefined) ? false : opt.input.release); core.exportVariable('WORKFLOW_CREATE_README', (opt.input?.readme === undefined) ? false : opt.input.readme); core.exportVariable('WORKFLOW_GRYPE_FAIL_ON_SEVERITY', (opt.dot?.grype?.fail === undefined) ? true : opt.dot.grype.fail); @@ -205,14 +218,17 @@ jobs: password: ${{ secrets.QUAY_TOKEN }} - name: docker / setup qemu + if: env.WORKFLOW_BUILD == 'true' uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a - name: docker / setup buildx + if: env.WORKFLOW_BUILD == 'true' uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 with: driver-opts: network=host - name: docker / build & push & tag grype + if: env.WORKFLOW_BUILD == 'true' id: docker-build uses: docker/build-push-action@67a2d409c0a876cbe6b11854e3e25193efe4e62d with: @@ -228,6 +244,7 @@ jobs: ${{ env.DOCKER_CACHE_GRYPE }} - name: grype / scan + if: env.WORKFLOW_BUILD == 'true' id: grype uses: anchore/scan-action@dc6246fcaf83ae86fcc6010b9824c30d7320729e with: @@ -239,7 +256,7 @@ jobs: cache-db: true - name: grype / fail - if: failure() || steps.grype.outcome == 'failure' + if: env.WORKFLOW_BUILD == 'true' && (failure() || steps.grype.outcome == 'failure') uses: anchore/scan-action@dc6246fcaf83ae86fcc6010b9824c30d7320729e with: image: ${{ env.DOCKER_CACHE_GRYPE }} @@ -250,6 +267,7 @@ jobs: cache-db: true - name: docker / build & push + if: env.WORKFLOW_BUILD == 'true' uses: docker/build-push-action@67a2d409c0a876cbe6b11854e3e25193efe4e62d with: context: . @@ -348,15 +366,17 @@ jobs: continue-on-error: true run: | docker image pull ${{ env.WORKFLOW_CREATE_COMPARISON_IMAGE }} - docker image pull ${{ env.WORKFLOW_CREATE_COMPARISON_FOREIGN_IMAGE }} docker image ls --filter "reference=${{ env.WORKFLOW_CREATE_COMPARISON_IMAGE }}" --format json | jq --raw-output '.Size' &> ./comparison.size0.log + + docker image pull ${{ env.WORKFLOW_CREATE_COMPARISON_FOREIGN_IMAGE }} docker image ls --filter "reference=${{ env.WORKFLOW_CREATE_COMPARISON_FOREIGN_IMAGE }}" --format json | jq --raw-output '.Size' &> ./comparison.size1.log + docker run --entrypoint "/bin/sh" --rm ${{ env.WORKFLOW_CREATE_COMPARISON_FOREIGN_IMAGE }} -c id &> ./comparison.id.log - name: github / create README.md id: github-readme continue-on-error: true - if: env.WORKFLOW_CREATE_README == 'true' && steps.docker-build.outcome == 'success' + if: env.WORKFLOW_CREATE_README == 'true' uses: 11notes/action-docker-readme@v1 # WHY IS THIS ACTION NOT SHA256 PINNED? SECURITY MUCH?!?!?! # --------------------------------------------------------------------------------- @@ -382,17 +402,6 @@ jobs: short_description: ${{ env.DOCKER_IMAGE_DESCRIPTION }} readme_file: 'README_NONGITHUB.md' - - name: quay / push README.md to quay - continue-on-error: true - if: steps.github-readme.outcome == 'success' && hashFiles('README_NONGITHUB.md') != '' - uses: christian-korneck/update-container-description-action@d36005551adeaba9698d8d67a296bd16fa91f8e8 - env: - DOCKER_APIKEY: ${{ secrets.QUAY_TOKEN }} - with: - destination_container_repo: quay.io/${{ env.DOCKER_IMAGE_NAME }} - provider: quay - readme_file: 'README_NONGITHUB.md' - - name: github / commit & push continue-on-error: true if: steps.github-readme.outcome == 'success' && hashFiles('README.md') != '' @@ -406,7 +415,7 @@ jobs: if [ -f LICENSE ]; then git add LICENSE fi - git commit -m "auto update README.md" + git commit -m "github-actions[bot]: update README.md" git push origin HEAD:master diff --git a/.github/workflows/readme.yml b/.github/workflows/readme.yml new file mode 100644 index 0000000..068edce --- /dev/null +++ b/.github/workflows/readme.yml @@ -0,0 +1,16 @@ +name: readme + +on: + workflow_dispatch: + +jobs: + readme: + runs-on: ubuntu-latest + steps: + - name: update README.md + uses: the-actions-org/workflow-dispatch@3133c5d135c7dbe4be4f9793872b6ef331b53bc7 + with: + wait-for-completion: false + workflow: docker.yml + token: "${{ secrets.REPOSITORY_TOKEN }}" + inputs: '{ "build":"false", "release":"false", "readme":"true" }' \ No newline at end of file