Release (docker) #40
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release (docker) | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| release_version: | |
| description: 'Release version. Example: v1.0.0, latest' | |
| required: true | |
| default: '' | |
| latest: | |
| description: 'Tag as latest ?' | |
| type: boolean | |
| required: false | |
| default: false | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| RELEASE_VERSION: ${{ github.event.inputs.release_version }} | |
| jobs: | |
| build: | |
| runs-on: [kuberunner] | |
| steps: | |
| - name: Validate Release Version | |
| run: | | |
| if [[ ! "${{ env.RELEASE_VERSION }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] && [[ "${{ env.RELEASE_VERSION }}" != "latest" ]]; then | |
| echo "Release version format is incorrect. It should be 'latest' or 'v*.*.*'." | |
| exit 1 | |
| fi | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Cache Docker layers | |
| uses: actions/cache@v4 | |
| with: | |
| path: /tmp/.buildx-cache | |
| key: ${{ runner.os }}-buildx-gear | |
| restore-keys: | | |
| ${{ runner.os }}-buildx-gear | |
| ${{ runner.os }} | |
| - name: Log in to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Prepare Docker Tags | |
| run: | | |
| if [[ "${{ github.event.inputs.latest }}" == "true" ]]; then | |
| echo "DOCKER_TAGS=ghcr.io/gear-tech/node:${{ env.RELEASE_VERSION }},ghcr.io/gear-tech/node:latest" >> $GITHUB_ENV | |
| else | |
| echo "DOCKER_TAGS=ghcr.io/gear-tech/node:${{ env.RELEASE_VERSION }}" >> $GITHUB_ENV | |
| fi | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| file: ./docker/Dockerfile-release | |
| push: true | |
| tags: ${{ env.DOCKER_TAGS }} | |
| build-args: RELEASE_VERSION=${{ env.RELEASE_VERSION }} | |
| cache-from: type=local,src=/tmp/.buildx-cache | |
| cache-to: type=local,dest=/tmp/.buildx-cache | |
| - name: Scan the Docker image with Trivy | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: image | |
| image-ref: 'ghcr.io/gear-tech/node:${{ env.RELEASE_VERSION }}' | |
| format: 'table' | |
| output: 'trivy-results.txt' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| hide-progress: true | |
| - name: Notify Trivy scan result in Telegram | |
| uses: appleboy/telegram-action@master | |
| with: | |
| to: ${{ secrets.TELEGRAM_DEVOPS_CHAT }} | |
| token: ${{ secrets.TELEGRAM_DEVOPS_TOKEN }} | |
| format: markdown | |
| disable_web_page_preview: true | |
| message: | | |
| *Status*: ℹ️ | |
| *Details:* Trivy scan completed for ${{ env.DOCKER_TAGS }} | |
| document: trivy-results.txt | |
| - name: Notify build failure in Telegram | |
| if: failure() | |
| uses: appleboy/telegram-action@master | |
| with: | |
| to: ${{ secrets.TELEGRAM_DEVOPS_CHAT }} | |
| token: ${{ secrets.TELEGRAM_DEVOPS_TOKEN }} | |
| format: markdown | |
| disable_web_page_preview: true | |
| message: | | |
| *Status:* 🔥 | |
| *Problem:* Build failed | |
| *Details:* https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }} |