diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6e2eb3c2..3bbbeeb0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,99 +1,99 @@ -name: Release - -on: - push: - tags: - - 'v*.*.*' - -permissions: - contents: write - -env: - DOCKER_REPOSITORY: networlddev/dockerupdateguard - DOCKERFILE_PATH: src/DockerUpdateGuard/Dockerfile - -jobs: - release: - name: Build, Push & Release - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - name: Derive version from tag - id: version - run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" - - - name: Install .NET 10 SDK - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 - with: - dotnet-version: '10.0.x' - dotnet-quality: 'preview' - - - name: Restore - run: dotnet restore DockerUpdateGuard.slnx - - - name: Install Reihitsu.Cli - run: dotnet tool install -g Reihitsu.Cli - - - name: Check formatting - run: reihitsu-format --check . - - - name: Build - run: dotnet build DockerUpdateGuard.slnx -c Release --no-restore - - - name: Test - run: > - dotnet test DockerUpdateGuard.slnx - -c Release --no-build - --logger trx - --results-directory ${{ runner.temp }}/TestResults - - - name: Log in to Docker Hub - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - - name: Resolve base runtime image and digest - id: basedigest - run: | - BASE_RUNTIME=$(sed -n 's/^ARG BASE_RUNTIME="\([^"]*\)".*$/\1/p' "$DOCKERFILE_PATH") - if [[ -z "$BASE_RUNTIME" ]]; then - echo "::error::No ARG BASE_RUNTIME default found in $DOCKERFILE_PATH" - exit 1 - fi - docker pull "$BASE_RUNTIME" - REPO_DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$BASE_RUNTIME") - DIGEST="${REPO_DIGEST#*@}" - if [[ ! "$DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then - echo "::error::Unexpected base image digest '$REPO_DIGEST' for $BASE_RUNTIME" - exit 1 - fi - echo "name=$BASE_RUNTIME" >> "$GITHUB_OUTPUT" - echo "digest=$DIGEST" >> "$GITHUB_OUTPUT" - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - - - name: Build & push image - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 - with: - context: . - file: ${{ env.DOCKERFILE_PATH }} - push: true - build-args: | - APP_VERSION=${{ steps.version.outputs.version }} - BASE_RUNTIME=${{ steps.basedigest.outputs.name }} - BASE_RUNTIME_DIGEST=${{ steps.basedigest.outputs.digest }} - tags: | - ${{ env.DOCKER_REPOSITORY }}:${{ steps.version.outputs.version }} - ${{ env.DOCKER_REPOSITORY }}:latest - - - name: Create GitHub Release - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 - with: - tag_name: ${{ github.ref_name }} - generate_release_notes: true - body: | - Docker image: `${{ env.DOCKER_REPOSITORY }}:${{ steps.version.outputs.version }}` +name: Release + +on: + push: + tags: + - 'v*.*.*' + +permissions: + contents: write + +env: + DOCKER_REPOSITORY: networlddev/dockerupdateguard + DOCKERFILE_PATH: src/DockerUpdateGuard/Dockerfile + +jobs: + release: + name: Build, Push & Release + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Derive version from tag + id: version + run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" + + - name: Install .NET 10 SDK + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 + with: + dotnet-version: '10.0.x' + dotnet-quality: 'preview' + + - name: Restore + run: dotnet restore DockerUpdateGuard.slnx + + - name: Install Reihitsu.Cli + run: dotnet tool install -g Reihitsu.Cli + + - name: Check formatting + run: reihitsu-format --check . + + - name: Build + run: dotnet build DockerUpdateGuard.slnx -c Release --no-restore + + - name: Test + run: > + dotnet test DockerUpdateGuard.slnx + -c Release --no-build + --logger trx + --results-directory ${{ runner.temp }}/TestResults + + - name: Log in to Docker Hub + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Resolve base runtime image and digest + id: basedigest + run: | + BASE_RUNTIME=$(sed -n 's/^ARG BASE_RUNTIME="\([^"]*\)".*$/\1/p' "$DOCKERFILE_PATH") + if [[ -z "$BASE_RUNTIME" ]]; then + echo "::error::No ARG BASE_RUNTIME default found in $DOCKERFILE_PATH" + exit 1 + fi + docker pull "$BASE_RUNTIME" + REPO_DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$BASE_RUNTIME") + DIGEST="${REPO_DIGEST#*@}" + if [[ ! "$DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then + echo "::error::Unexpected base image digest '$REPO_DIGEST' for $BASE_RUNTIME" + exit 1 + fi + echo "name=$BASE_RUNTIME" >> "$GITHUB_OUTPUT" + echo "digest=$DIGEST" >> "$GITHUB_OUTPUT" + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + + - name: Build & push image + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 + with: + context: . + file: ${{ env.DOCKERFILE_PATH }} + push: true + build-args: | + APP_VERSION=${{ steps.version.outputs.version }} + BASE_RUNTIME=${{ steps.basedigest.outputs.name }} + BASE_RUNTIME_DIGEST=${{ steps.basedigest.outputs.digest }} + tags: | + ${{ env.DOCKER_REPOSITORY }}:${{ steps.version.outputs.version }} + ${{ env.DOCKER_REPOSITORY }}:latest + + - name: Create GitHub Release + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 + with: + tag_name: ${{ github.ref_name }} + generate_release_notes: true + body: | + Docker image: `${{ env.DOCKER_REPOSITORY }}:${{ steps.version.outputs.version }}`