diff --git a/.github/workflows/docker-image.yml b/.github/workflows/build-docker-image.yml similarity index 97% rename from .github/workflows/docker-image.yml rename to .github/workflows/build-docker-image.yml index 2675c14..09fea59 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/build-docker-image.yml @@ -1,4 +1,4 @@ -name: Docker Image CI +name: Build Docker Image on: push: diff --git a/.github/workflows/push-docker-image.yml b/.github/workflows/push-docker-image.yml new file mode 100644 index 0000000..7e8ebb5 --- /dev/null +++ b/.github/workflows/push-docker-image.yml @@ -0,0 +1,61 @@ +name: Push Docker Image + +on: + push: + branches: [ "micronaut" ] + +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }} + +jobs: + build: + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + attestations: write + id-token: write + steps: + - uses: actions/checkout@v4 + - name: Set up JDK 17 + uses: actions/setup-java@v4 + with: + java-version: '17' + distribution: 'temurin' + cache: maven + - uses: s4u/maven-settings-action@64e42c454dbd42ef6370ac8539685755aedd205b + with: + servers: | + [{ + "id": "github-playground-micronaut", + "username": "epsilonlabs", + "password": "${{ secrets.GH_TOKEN_READ_MICRONAUT }}" + }] + - name: Download the backend JAR + run: mvn -B dependency:copy-dependencies -DexcludeTransitive=true && ls target/dependency + - name: Log in to the Container registry + uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + - name: Extract metadata (tags, labels) for Docker + id: meta + uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + - name: Build and push Docker image + id: push + uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4 + with: + context: . + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + - name: Generate artifact attestation + uses: actions/attest-build-provenance@v1 + with: + subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}} + subject-digest: ${{ steps.push.outputs.digest }} + push-to-registry: true