Skip to content

Release (docker)

Release (docker) #32

name: Release (docker)
on:
workflow_dispatch:
inputs:
release_version:
description: 'Release version. Example: v1.0.0, latest'
required: true
default: ''
latest:
description: 'Tag as latest ?'
type: boolean
required: false
default: false
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
RELEASE_VERSION: ${{ github.event.inputs.release_version }}
jobs:
build:
runs-on: [kuberunner]
steps:
- name: Validate Release Version
run: |
if [[ ! "${{ env.RELEASE_VERSION }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] && [[ "${{ env.RELEASE_VERSION }}" != "latest" ]]; then
echo "Release version format is incorrect. It should be 'latest' or 'v*.*.*'."
exit 1
fi
- name: Checkout
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Cache Docker layers
uses: actions/cache@v4
with:
path: /tmp/.buildx-cache
key: ${{ runner.os }}-buildx-gear
restore-keys: |
${{ runner.os }}-buildx-gear
${{ runner.os }}
- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Prepare Docker Tags
run: |
if [[ "${{ github.event.inputs.latest }}" == "true" ]]; then
echo "DOCKER_TAGS=ghcr.io/gear-tech/node:${{ env.RELEASE_VERSION }},ghcr.io/gear-tech/node:latest" >> $GITHUB_ENV
else
echo "DOCKER_TAGS=ghcr.io/gear-tech/node:${{ env.RELEASE_VERSION }}" >> $GITHUB_ENV
fi
- name: Build and push Docker image
uses: docker/build-push-action@v5
with:
file: ./docker/Dockerfile-release
push: true
tags: ${{ env.DOCKER_TAGS }}
build-args: RELEASE_VERSION=${{ env.RELEASE_VERSION }}
cache-from: type=local,src=/tmp/.buildx-cache
cache-to: type=local,dest=/tmp/.buildx-cache
- name: Scan the Docker image with Trivy
uses: aquasecurity/trivy-action@master
with:
scan-type: image
image-ref: 'ghcr.io/gear-tech/node:${{ env.RELEASE_VERSION }}'
format: 'table'
output: 'trivy-results.txt'
exit-code: '0'
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
hide-progress: true
- name: Notify Trivy scan result in Telegram
uses: appleboy/telegram-action@master
with:
to: ${{ secrets.TELEGRAM_DEVOPS_CHAT }}
token: ${{ secrets.TELEGRAM_DEVOPS_TOKEN }}
format: markdown
disable_web_page_preview: true
message: |
*Status*: ℹ️
*Details:* Trivy scan completed for ${{ env.DOCKER_TAGS }}
document: trivy-results.txt
- name: Notify build failure in Telegram
if: failure()
uses: appleboy/telegram-action@master
with:
to: ${{ secrets.TELEGRAM_DEVOPS_CHAT }}
token: ${{ secrets.TELEGRAM_DEVOPS_TOKEN }}
format: markdown
disable_web_page_preview: true
message: |
*Status:* 🔥
*Problem:* Build failed
*Details:* https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}