Skip to content

Commit 8e9d881

Browse files
jstarpljstarpl
authored
Merge pull request #27 from SuperFlyTV/feat/docker-build
2 parents 1ed0913 + ce8a4b1 commit 8e9d881

File tree

6 files changed

+204
-2
lines changed

6 files changed

+204
-2
lines changed

‎.github/workflows/build-docker.yaml‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
name: Build Docker
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
- develop
9+
- 'release**'
10+
tags:
11+
- 'v*.*.*'
12+
13+
jobs:
14+
check-build-steps:
15+
name: Check if build and push should be performed
16+
runs-on: ubuntu-latest
17+
timeout-minutes: 5
18+
19+
outputs:
20+
dockerhub-enable: ${{ steps.dockerhub.outputs.dockerhub-publish }}
21+
ghcr-enable: ${{ steps.check-ghcr.outputs.enable }}
22+
build-and-push-enable: ${{ steps.check-build-and-push.outputs.enable }}
23+
24+
steps:
25+
- uses: actions/checkout@v4
26+
with:
27+
persist-credentials: false
28+
29+
- name: Determine if images should be published to DockerHub
30+
id: dockerhub
31+
run: |
32+
# check if a release branch, or main, or a tag
33+
if [[ "${{ github.ref }}" =~ ^refs/heads/release([0-9]+)$ || "${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" == refs/tags/* ]]
34+
then
35+
DOCKERHUB_PUBLISH="1"
36+
else
37+
DOCKERHUB_PUBLISH="0"
38+
fi
39+
# debug output
40+
echo "dockerhub-publish $DOCKERHUB_PUBLISH"
41+
echo "dockerhub-publish=$DOCKERHUB_PUBLISH" >> $GITHUB_OUTPUT
42+
43+
- name: Check if push to GHCR is enabled
44+
id: check-ghcr
45+
env:
46+
GHCR_ENABLED: ${{ secrets.GHCR_ENABLED }}
47+
run: |
48+
echo "Enable push to GHCR: ${{ env.GHCR_ENABLED != '' }}"
49+
echo "enable=${{ env.GHCR_ENABLED != '' }}" >> $GITHUB_OUTPUT
50+
51+
- name: Check if there is access to repo secrets (needed for build and push)
52+
if: steps.dockerhub.outputs.dockerhub-publish == '1' || steps.check-ghcr.outputs.enable == 'true'
53+
id: check-build-and-push
54+
env:
55+
SECRET_ACCESS: ${{ secrets.DOCKERHUB_USERNAME }}
56+
run: |
57+
echo "Enable build and push: ${{ env.SECRET_ACCESS != '' }}"
58+
echo "enable=${{ env.SECRET_ACCESS != '' }}" >> $GITHUB_OUTPUT
59+
60+
build:
61+
name: Build and publish docker image for ${{ matrix.repo }}
62+
runs-on: ubuntu-latest
63+
timeout-minutes: 15
64+
needs:
65+
- check-build-steps
66+
67+
steps:
68+
- uses: actions/checkout@v4
69+
with:
70+
persist-credentials: false
71+
72+
- name: Get the docker tag for GHCR
73+
id: ghcr-tag
74+
if: needs.check-build-steps.outputs.build-and-push-enable == 'true'
75+
uses: docker/metadata-action@v5
76+
with:
77+
images: |
78+
ghcr.io/${{ github.repository }}
79+
tags: |
80+
type=schedule
81+
type=ref,event=branch
82+
type=ref,event=tag
83+
type=raw,value=latest,enable={{is_default_branch}}
84+
type=raw,value=nightly,enable={{is_default_branch}}
85+
86+
- name: Get the docker tag for DockerHub
87+
id: dockerhub-tag
88+
if: needs.check-build-steps.outputs.build-and-push-enable == 'true'
89+
uses: docker/metadata-action@v5
90+
with:
91+
images: |
92+
sofietv/input-gateway
93+
tags: |
94+
type=schedule
95+
type=ref,event=branch
96+
type=ref,event=tag
97+
type=raw,value=latest,enable={{is_default_branch}}
98+
type=raw,value=nightly,enable={{is_default_branch}}
99+
100+
- name: Set up Docker Buildx
101+
if: needs.check-build-steps.outputs.build-and-push-enable == 'true'
102+
uses: docker/setup-buildx-action@v3
103+
104+
- name: Login to DockerHub
105+
if: needs.check-build-steps.outputs.build-and-push-enable == 'true' && needs.check-build-steps.outputs.dockerhub-enable == '1'
106+
uses: docker/login-action@v3
107+
with:
108+
username: ${{ secrets.DOCKERHUB_USERNAME }}
109+
password: ${{ secrets.DOCKERHUB_TOKEN }}
110+
111+
- name: Login to GitHub Container Registry
112+
if: needs.check-build-steps.outputs.build-and-push-enable == 'true' && needs.check-build-steps.outputs.ghcr-enable == 'true'
113+
uses: docker/login-action@v3
114+
with:
115+
registry: ghcr.io
116+
username: ${{ github.repository_owner }}
117+
password: ${{ secrets.GITHUB_TOKEN }}
118+
119+
- name: Build and push to GHCR
120+
if: needs.check-build-steps.outputs.build-and-push-enable == 'true' && needs.check-build-steps.outputs.ghcr-enable == 'true'
121+
uses: docker/build-push-action@v6
122+
with:
123+
context: .
124+
file: Dockerfile
125+
push: true
126+
provenance: false
127+
labels: ${{ steps.ghcr-tag.outputs.labels }}
128+
tags: '${{ steps.ghcr-tag.outputs.tags }}'
129+
130+
- name: Build and push to DockerHub
131+
if: needs.check-build-steps.outputs.build-and-push-enable == 'true' && needs.check-build-steps.outputs.dockerhub-enable == '1'
132+
uses: docker/build-push-action@v6
133+
with:
134+
context: .
135+
file: Dockerfile
136+
push: true
137+
provenance: false
138+
labels: ${{ steps.dockerhub-tag.outputs.labels }}
139+
tags: '${{ steps.dockerhub-tag.outputs.tags }}'
140+
141+
trivy-scanning:
142+
name: Run Trivy scan for ${{ matrix.repo }}
143+
uses: nrkno/github-workflow-docker-build-push/.github/workflows/[email protected]
144+
with:
145+
runs-on: "['ubuntu-latest']"
146+
registry-url: ghcr.io
147+
name: nrkno/sofie-package-manager
148+
# Don't actually push any images, this is just for trivy scanning for now
149+
push: false
150+
trivy-severity: 'CRITICAL'
151+
trivy-summary-enabled: true
152+
trivy-sbom-enabled: true
153+
dockerfile: Dockerfile
154+
secrets:
155+
registry-username: ${{ github.repository_owner }}
156+
registry-password: ${{ secrets.GITHUB_TOKEN }}
157+
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/build-linux.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ on:
44
workflow_dispatch:
55
push:
66
branches:
7-
- master
7+
- main
88
- develop
99
- 'release**'
1010
tags:
@@ -18,6 +18,8 @@ jobs:
1818

1919
steps:
2020
- uses: actions/checkout@v4
21+
with:
22+
persist-credentials: false
2123

2224
- name: Use Node.js
2325
uses: actions/setup-node@v4

‎.github/workflows/build-windows.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ on:
44
workflow_dispatch:
55
push:
66
branches:
7-
- master
7+
- main
88
- develop
99
- 'release**'
1010
tags:
@@ -18,6 +18,8 @@ jobs:
1818

1919
steps:
2020
- uses: actions/checkout@v4
21+
with:
22+
persist-credentials: false
2123

2224
- name: Use Node.js
2325
uses: actions/setup-node@v4

‎.github/workflows/lint-and-test.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ jobs:
1818
steps:
1919
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
2020
- uses: actions/checkout@v4
21+
with:
22+
persist-credentials: false
2123
- name: Use Node.js
2224
uses: actions/setup-node@v4
2325
with:
@@ -50,6 +52,8 @@ jobs:
5052
steps:
5153
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
5254
- uses: actions/checkout@v4
55+
with:
56+
persist-credentials: false
5357
- name: Use Node.js ${{ matrix.node_version }}
5458
uses: actions/setup-node@v4
5559
with:

‎Dockerfile‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
FROM node:22-alpine AS builder
2+
3+
# Environment
4+
5+
WORKDIR /src
6+
7+
# Common
8+
9+
COPY package.json tsconfig.json yarn.lock lerna.json .yarnrc.yml ./
10+
COPY scripts ./scripts
11+
COPY .yarn ./.yarn
12+
13+
# Pakcages
14+
COPY packages ./packages
15+
16+
# Install
17+
RUN corepack enable
18+
RUN yarn install
19+
20+
# Build
21+
RUN yarn build
22+
23+
# Purge dev-dependencies:
24+
RUN yarn workspaces focus -A --production
25+
26+
RUN rm -r scripts
27+
28+
# Create deploy-image:
29+
FROM node:22-alpine
30+
31+
RUN apk add --no-cache fontconfig alsa-lib
32+
33+
COPY --from=builder /src /src
34+
35+
WORKDIR /src/packages/input-gateway
36+
ENTRYPOINT ["node", "dist/index.js"]

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@
4949
"@types/node": "^22.15.21",
5050
"@types/sprintf-js": "^1.1.4",
5151
"@types/underscore": "^1.11.15",
52+
"@yao-pkg/pkg": "^6.5.1",
5253
"concurrently": "^8.2.2",
5354
"jest": "^29.7.0",
5455
"json-schema-to-typescript": "^14.0.4",

0 commit comments

Comments
 (0)