Maxim ShulgaandClaude Opus 5
9b9d4f0577
The push job called build-push-action twice, once for the ref tag and once for latest. Two builds meant the two tags could resolve to different manifest digests. Build once and let docker/metadata-action supply both tags and the OCI labels for that single build. Replace the deprecated actions/checkout@v2 and docker/build-push-action@v1, default workflow permissions to contents: read so pull requests cannot reach publication credentials, and authenticate with a scoped DOCKER_TOKEN through docker/login-action instead of DOCKER_PASSWORD. The test job's docker-compose.test.yml branch was dead; that file does not exist in the repository. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
70 lines
1.5 KiB
YAML
70 lines
1.5 KiB
YAML
name: Docker
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
tags:
|
|
- '*'
|
|
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
IMAGE: snegov/seafile-client
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Validate compose example
|
|
run: docker compose --file compose.example.yaml config --quiet
|
|
|
|
- name: Build image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
push: false
|
|
load: true
|
|
tags: ${{ env.IMAGE }}:ci
|
|
|
|
push:
|
|
needs: test
|
|
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Every tag of a release must resolve to one manifest digest, so the
|
|
# image is built once and all tags are attached to that single build.
|
|
- name: Collect tags and labels
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ env.IMAGE }}
|
|
tags: |
|
|
type=ref,event=tag
|
|
flavor: |
|
|
latest=true
|
|
|
|
- name: Log in to Docker Hub
|
|
uses: docker/login-action@v3
|
|
with:
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
password: ${{ secrets.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|