ci: release tags also push :latest images #165
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| # Build + push two image variants on every push to main (tag :latest) and | |
| # every release tag (tag :vX.Y.Z), mirrored to GHCR and Docker Hub: | |
| # ghcr.io/<owner>/mdt-dialout-collector — standalone daemon | |
| # ghcr.io/<owner>/mdt-dialout-collector-lib — library (.so + header + .pc) | |
| # docker.io/<dh-user>/mdt-dialout-collector — same, public mirror | |
| # docker.io/<dh-user>/mdt-dialout-collector-lib — same, public mirror | |
| # | |
| # Docker Hub: username sits in repo variables (vars.DOCKERHUB_USERNAME — not | |
| # sensitive, it's part of the public image path); PAT lives in repo secrets | |
| # (secrets.DOCKERHUB_TOKEN). | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - 'v*' | |
| env: | |
| IMAGE_NAME: mdt-dialout-collector | |
| jobs: | |
| ci: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: write | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Build standalone image | |
| # Repo root as build context so the multi-stage Dockerfile can | |
| # COPY CMakeLists.txt / proto / src from the checkout. | |
| run: | | |
| docker build . -f docker/Dockerfile \ | |
| --target standalone \ | |
| --tag $IMAGE_NAME \ | |
| --label "runnumber=${GITHUB_RUN_ID}" | |
| - name: Build library image | |
| run: | | |
| docker build . -f docker/Dockerfile \ | |
| --target library \ | |
| --tag $IMAGE_NAME-lib \ | |
| --label "runnumber=${GITHUB_RUN_ID}" | |
| - name: Log into GHCR | |
| # Auto-provided GITHUB_TOKEN works because the job has | |
| # `permissions: packages: write` above. No manually-managed PAT needed. | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin | |
| - name: Push images to GHCR | |
| run: | | |
| OWNER=$(echo "${{ github.repository_owner }}" | tr '[A-Z]' '[a-z]') | |
| # main push → :latest; release tag → :vX.Y.Z AND :latest, so a | |
| # release always (re)establishes the tag the README tells users | |
| # to pull. | |
| VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,') | |
| TAGS="${VERSION} latest" | |
| [ "$VERSION" = "main" ] && TAGS="latest" | |
| for variant in "$IMAGE_NAME" "$IMAGE_NAME-lib"; do | |
| IMAGE_ID="ghcr.io/${OWNER}/${variant}" | |
| for tag in ${TAGS}; do | |
| echo "pushing ${IMAGE_ID}:${tag}" | |
| docker tag "${variant}" "${IMAGE_ID}:${tag}" | |
| docker push "${IMAGE_ID}:${tag}" | |
| done | |
| done | |
| # Docker Hub mirror — GHCR copies stay private (org policy disallows public | |
| # container packages on network-analytics). Skipped silently if either | |
| # input is unset, so the GHCR push above isn't gated on Docker Hub being | |
| # configured. Login + push live in the same step so the secret is consumed | |
| # and forgotten in one shell. | |
| - name: Push images to Docker Hub | |
| env: | |
| DH_USER: ${{ vars.DOCKERHUB_USERNAME }} | |
| DH_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} | |
| run: | | |
| if [ -z "${DH_USER}" ] || [ -z "${DH_TOKEN}" ]; then | |
| echo "::warning::vars.DOCKERHUB_USERNAME or secrets.DOCKERHUB_TOKEN unset — skipping Docker Hub mirror" | |
| exit 0 | |
| fi | |
| echo "${DH_TOKEN}" | docker login docker.io -u "${DH_USER}" --password-stdin | |
| VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,') | |
| TAGS="${VERSION} latest" | |
| [ "$VERSION" = "main" ] && TAGS="latest" | |
| for variant in "$IMAGE_NAME" "$IMAGE_NAME-lib"; do | |
| IMAGE_ID="docker.io/${DH_USER}/${variant}" | |
| for tag in ${TAGS}; do | |
| echo "pushing ${IMAGE_ID}:${tag}" | |
| docker tag "${variant}" "${IMAGE_ID}:${tag}" | |
| docker push "${IMAGE_ID}:${tag}" | |
| done | |
| done |