-
Notifications
You must be signed in to change notification settings - Fork 1
145 lines (111 loc) · 3.63 KB
/
cicd.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
# Docs: https://docs.github.com/en/actions
name: CI/CD
on:
push:
branches: ["master"]
pull_request:
branches: ["master"]
env:
DOCKER_REGISTRY: ghcr.io
DOCKER_IMAGE_NAME: php-nginx
DOCKER_IMAGE_REPO: ghcr.io/${{ github.repository_owner }}/php-nginx
jobs:
docker:
name: Build Docker images
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- name: Harden CI
uses: step-security/[email protected]
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
api.github.com:443
actions-results-receiver-production.githubapp.com:443
auth.docker.io:443
dl-cdn.alpinelinux.org:443
github.com:443
pecl.php.net:443
production.cloudflare.docker.com:443
productionresultssa4.blob.core.windows.net:443
registry-1.docker.io:443
- name: Checkout source code
uses: actions/checkout@v4
- name: Build Docker images
run: ./bin/build;
- name: Save Docker images
run: docker image save $(docker images --format "{{.Repository}}:{{.Tag}}" "${{ env.DOCKER_IMAGE_REPO }}") | gzip -9 > docker_images.tgz
- name: Upload Docker image artifacts
uses: actions/upload-artifact@v4
with:
name: docker
path: docker_images.tgz
test-docker:
name: Test Docker images
needs: [docker]
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- name: Harden CI
uses: step-security/[email protected]
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
api.github.com:443
github.com:443
- name: Checkout source code
uses: actions/checkout@v4
- name: Download Docker image artifacts
uses: actions/download-artifact@v4
with:
name: docker
- name: Load Docker images
run: gzip --uncompress --stdout docker_images.tgz | docker image load
- name: Test Docker images
run: ./bin/test;
push-docker-repo:
name: Push images to repository
needs: [test-docker]
if: github.ref == 'refs/heads/master'
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- name: Harden CI
uses: step-security/[email protected]
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
api.github.com:443
ghcr.io:443
github.com:443
# Need source code to push README file contents to Docker Hub
- name: Checkout source code
uses: actions/checkout@v4
- name: Download Docker image artifacts
uses: actions/download-artifact@v4
with:
name: docker
- name: Load Docker images
run: gzip --uncompress --stdout docker_images.tgz | docker image load
- name: Log in to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ${{ env.DOCKER_REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Push images
run: |
for image_name in $(docker images --format "{{.Repository}}:{{.Tag}}" "${{ env.DOCKER_IMAGE_REPO }}"); do
echo "Pushing ${image_name}";
docker push "${image_name}";
done;
- name: Purge untagged images
uses: actions/delete-package-versions@v5
with:
package-name: ${{ env.DOCKER_IMAGE_NAME }}
package-type: "container"
min-versions-to-keep: 9
delete-only-untagged-versions: true