Container

Source content

name: publish-container

on:

workflow_dispatch:

inputs:

tag:

description: Existing accepted release tag to build and publish.

required: true

type: string

confirm_publish:

description: Publish the image to GHCR.

required: true

default: false

type: boolean

permissions: {}

jobs:

image:

if: github.ref == 'refs/heads/main' && inputs.confirm_publish

environment: ghcr

permissions:

contents: read

packages: write

runs-on: ubuntu-latest

timeout-minutes: 25

steps:

- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

with:

ref: ${{ inputs.tag }}

fetch-depth: 0

persist-credentials: false

- name: Verify accepted release tag

id: release

env:

RELEASE_TAG: ${{ inputs.tag }}

run: |

if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then

echo 'Release tag must have the exact form vMAJOR.MINOR.PATCH.'

exit 1

fi

RELEASE_SHA="$(git rev-parse "refs/tags/${RELEASE_TAG}^{commit}")"

test "$(git rev-parse HEAD)" = "$RELEASE_SHA"

git fetch origin main --no-tags

git merge-base --is-ancestor "$RELEASE_SHA" origin/main

SOURCE_EPOCH="$(git show -s --format=%ct "$RELEASE_SHA")"

test -n "$SOURCE_EPOCH"

echo "sha=$RELEASE_SHA" >> "$GITHUB_OUTPUT"

echo "short_sha=${RELEASE_SHA:0:12}" >> "$GITHUB_OUTPUT"

echo "source_epoch=$SOURCE_EPOCH" >> "$GITHUB_OUTPUT"

- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

- uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3

with:

registry: ghcr.io

username: ${{ github.actor }}

password: ${{ secrets.GITHUB_TOKEN }}

- uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5

id: meta

with:

images: ghcr.io/yoheinakajima/epistemedia

tags: |

type=raw,value=${{ inputs.tag }}

type=raw,value=sha-${{ steps.release.outputs.short_sha }}

- uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6

with:

context: .

build-args: |

EPISTEMEDIA_ACCEPTED_COMMIT=${{ steps.release.outputs.sha }}

SOURCE_DATE_EPOCH=${{ steps.release.outputs.source_epoch }}

push: true

tags: ${{ steps.meta.outputs.tags }}

labels: ${{ steps.meta.outputs.labels }}

provenance: mode=max

sbom: true