BBergleandClaude Sonnet 5
45719f284c
Was tag-push-or-manual-dispatch only. Adds a push:main trigger so main stays continuously deployable without needing a version tag for every change. Also fixes a real bug this surfaced while testing the D17 registry-TLS fix: the old tag logic unconditionally retagged :latest on every run, including manual test dispatches off a feature branch — one such dispatch, done while verifying the previous commit, silently overwrote :latest with a feature-branch build. Tag resolution now only moves :latest on an actual main push or a version tag; a manual dispatch gets its own manual-<timestamp>-<sha> tag and leaves :latest alone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R2ZKeWkZV7ehf7fivrAkkG
73 lines
3.2 KiB
YAML
73 lines
3.2 KiB
YAML
name: Release image
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build-and-push:
|
|
name: Build and push single-container image
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# driver: docker (not the action's default docker-container driver) so buildx reuses the
|
|
# host's own dockerd instead of spinning up an isolated builder container — the isolated
|
|
# one doesn't see the host's /etc/docker/certs.d, which is how the login step below trusts
|
|
# the registry's self-signed cert (docs/DECISIONS.md D17). We don't need multi-platform
|
|
# builds, so nothing the docker-container driver offers is actually lost here.
|
|
- uses: docker/setup-buildx-action@v3
|
|
with:
|
|
driver: docker
|
|
|
|
# secrets.GITEA_TOKEN cannot push to the Gitea container registry — a documented Gitea
|
|
# limitation, not a misconfiguration (see CLAUDE.md). REGISTRY_TOKEN is a separate PAT with
|
|
# package:write, expected to already exist as a repo secret.
|
|
#
|
|
# registry.bbergle.com:9537, not the raw 192.168.0.3:3000 Gitea talks HTTP on directly —
|
|
# Docker refuses any non-localhost registry over plain HTTP by default. This hostname is an
|
|
# NPMplus proxy host in front of Gitea's registry, terminating TLS with a self-signed cert;
|
|
# the runner host trusts it via /etc/docker/certs.d/registry.bbergle.com:9537/ca.crt (not
|
|
# committed here — host-local trust material, docs/DECISIONS.md D17 has the full setup).
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: registry.bbergle.com:9537
|
|
username: BBergle
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
# `latest` should only ever mean "what's actually on main" (or a tagged release) — not
|
|
# whatever a manual test dispatch off some feature branch happened to build. Learned the
|
|
# hard way: a manual dispatch off this very branch, while verifying the fix above, silently
|
|
# overwrote `latest` under the old unconditional-tags logic. Building the full tag list here
|
|
# in bash (rather than a conditional expression inline in the tags: block below) means there's
|
|
# never a blank line for build-push-action to choke on when latest isn't included.
|
|
- name: Resolve image tags
|
|
id: tag
|
|
run: |
|
|
IMG=registry.bbergle.com:9537/bbergle/bike-app
|
|
if [ "${{ gitea.ref_type }}" = "tag" ]; then
|
|
VALUE="${{ gitea.ref_name }}"
|
|
UPDATE_LATEST=true
|
|
elif [ "${{ gitea.ref_name }}" = "main" ] && [ "${{ gitea.event_name }}" = "push" ]; then
|
|
VALUE="main-$(git rev-parse --short HEAD)"
|
|
UPDATE_LATEST=true
|
|
else
|
|
VALUE="manual-$(date -u +%Y%m%d%H%M%S)-$(git rev-parse --short HEAD)"
|
|
UPDATE_LATEST=false
|
|
fi
|
|
{
|
|
echo "tags<<EOF"
|
|
echo "$IMG:$VALUE"
|
|
[ "$UPDATE_LATEST" = true ] && echo "$IMG:latest"
|
|
echo "EOF"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: Dockerfile
|
|
push: true
|
|
tags: ${{ steps.tag.outputs.tags }}
|