detached 27cd37e

Create docker-publish.yml

commit
27cd37e4421eca2aba906cf9cee4800f72def40e
author
Brice Nema · · 2024-04-19 08:18 UTC
committer
GitHub · · 2024-04-19 08:18 UTC
parent
061a913
signature
GPG UnverifiedB5690EEEBB952194 The key is unknown
1 file · +98 -0
Unified
UnifiedSplit
A .github/workflows/docker-publish.yml +98 -0
@@ -0,0 +1,98 @@
1+name: Docker
2+
3+# This workflow uses actions that are not certified by GitHub.
4+# They are provided by a third-party and are governed by
5+# separate terms of service, privacy policy, and support
6+# documentation.
7+
8+on:
9+ schedule:
10+ - cron: '21 16 * * *'
11+ push:
12+ branches: [ "main" ]
13+ # Publish semver tags as releases.
14+ tags: [ 'v*.*.*' ]
15+ pull_request:
16+ branches: [ "main" ]
17+
18+env:
19+ # Use docker.io for Docker Hub if empty
20+ REGISTRY: ghcr.io
21+ # github.repository as <account>/<repo>
22+ IMAGE_NAME: ${{ github.repository }}
23+
24+
25+jobs:
26+ build:
27+
28+ runs-on: ubuntu-latest
29+ permissions:
30+ contents: read
31+ packages: write
32+ # This is used to complete the identity challenge
33+ # with sigstore/fulcio when running outside of PRs.
34+ id-token: write
35+
36+ steps:
37+ - name: Checkout repository
38+ uses: actions/checkout@v3
39+
40+ # Install the cosign tool except on PR
41+ # https://github.com/sigstore/cosign-installer
42+ - name: Install cosign
43+ if: github.event_name != 'pull_request'
44+ uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
45+ with:
46+ cosign-release: 'v2.1.1'
47+
48+ # Set up BuildKit Docker container builder to be able to build
49+ # multi-platform images and export cache
50+ # https://github.com/docker/setup-buildx-action
51+ - name: Set up Docker Buildx
52+ uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
53+
54+ # Login against a Docker registry except on PR
55+ # https://github.com/docker/login-action
56+ - name: Log into registry ${{ env.REGISTRY }}
57+ if: github.event_name != 'pull_request'
58+ uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
59+ with:
60+ registry: ${{ env.REGISTRY }}
61+ username: ${{ github.actor }}
62+ password: ${{ secrets.GITHUB_TOKEN }}
63+
64+ # Extract metadata (tags, labels) for Docker
65+ # https://github.com/docker/metadata-action
66+ - name: Extract Docker metadata
67+ id: meta
68+ uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
69+ with:
70+ images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
71+
72+ # Build and push Docker image with Buildx (don't push on PR)
73+ # https://github.com/docker/build-push-action
74+ - name: Build and push Docker image
75+ id: build-and-push
76+ uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
77+ with:
78+ context: .
79+ push: ${{ github.event_name != 'pull_request' }}
80+ tags: ${{ steps.meta.outputs.tags }}
81+ labels: ${{ steps.meta.outputs.labels }}
82+ cache-from: type=gha
83+ cache-to: type=gha,mode=max
84+
85+ # Sign the resulting Docker image digest except on PRs.
86+ # This will only write to the public Rekor transparency log when the Docker
87+ # repository is public to avoid leaking data. If you would like to publish
88+ # transparency data even for private images, pass --force to cosign below.
89+ # https://github.com/sigstore/cosign
90+ - name: Sign the published Docker image
91+ if: ${{ github.event_name != 'pull_request' }}
92+ env:
93+ # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
94+ TAGS: ${{ steps.meta.outputs.tags }}
95+ DIGEST: ${{ steps.build-and-push.outputs.digest }}
96+ # This step uses the identity token to provision an ephemeral certificate
97+ # against the sigstore community Fulcio instance.
98+ run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
@@ -0,0 +1,98 @@
1+name: Docker
2+
3+# This workflow uses actions that are not certified by GitHub.
4+# They are provided by a third-party and are governed by
5+# separate terms of service, privacy policy, and support
6+# documentation.
7+
8+on:
9+ schedule:
10+ - cron: '21 16 * * *'
11+ push:
12+ branches: [ "main" ]
13+ # Publish semver tags as releases.
14+ tags: [ 'v*.*.*' ]
15+ pull_request:
16+ branches: [ "main" ]
17+
18+env:
19+ # Use docker.io for Docker Hub if empty
20+ REGISTRY: ghcr.io
21+ # github.repository as <account>/<repo>
22+ IMAGE_NAME: ${{ github.repository }}
23+
24+
25+jobs:
26+ build:
27+
28+ runs-on: ubuntu-latest
29+ permissions:
30+ contents: read
31+ packages: write
32+ # This is used to complete the identity challenge
33+ # with sigstore/fulcio when running outside of PRs.
34+ id-token: write
35+
36+ steps:
37+ - name: Checkout repository
38+ uses: actions/checkout@v3
39+
40+ # Install the cosign tool except on PR
41+ # https://github.com/sigstore/cosign-installer
42+ - name: Install cosign
43+ if: github.event_name != 'pull_request'
44+ uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
45+ with:
46+ cosign-release: 'v2.1.1'
47+
48+ # Set up BuildKit Docker container builder to be able to build
49+ # multi-platform images and export cache
50+ # https://github.com/docker/setup-buildx-action
51+ - name: Set up Docker Buildx
52+ uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
53+
54+ # Login against a Docker registry except on PR
55+ # https://github.com/docker/login-action
56+ - name: Log into registry ${{ env.REGISTRY }}
57+ if: github.event_name != 'pull_request'
58+ uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
59+ with:
60+ registry: ${{ env.REGISTRY }}
61+ username: ${{ github.actor }}
62+ password: ${{ secrets.GITHUB_TOKEN }}
63+
64+ # Extract metadata (tags, labels) for Docker
65+ # https://github.com/docker/metadata-action
66+ - name: Extract Docker metadata
67+ id: meta
68+ uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
69+ with:
70+ images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
71+
72+ # Build and push Docker image with Buildx (don't push on PR)
73+ # https://github.com/docker/build-push-action
74+ - name: Build and push Docker image
75+ id: build-and-push
76+ uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
77+ with:
78+ context: .
79+ push: ${{ github.event_name != 'pull_request' }}
80+ tags: ${{ steps.meta.outputs.tags }}
81+ labels: ${{ steps.meta.outputs.labels }}
82+ cache-from: type=gha
83+ cache-to: type=gha,mode=max
84+
85+ # Sign the resulting Docker image digest except on PRs.
86+ # This will only write to the public Rekor transparency log when the Docker
87+ # repository is public to avoid leaking data. If you would like to publish
88+ # transparency data even for private images, pass --force to cosign below.
89+ # https://github.com/sigstore/cosign
90+ - name: Sign the published Docker image
91+ if: ${{ github.event_name != 'pull_request' }}
92+ env:
93+ # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
94+ TAGS: ${{ steps.meta.outputs.tags }}
95+ DIGEST: ${{ steps.build-and-push.outputs.digest }}
96+ # This step uses the identity token to provision an ephemeral certificate
97+ # against the sigstore community Fulcio instance.
98+ run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 7

Tags 106

↑↓ moveenter openesc close