githubUserManager/.github/workflows/ci.yml at main · reMarkable/githubUserManager · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
name: ci
on:
  push:
    branches:
      - main
  pull_request:
  release:
    types:
      - created
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version-file: go.mod
          cache: true
      - run: |
          go vet ./...
          go test -race -coverprofile=coverage.out ./...
          go build ./...
      - id: docker_meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ghcr.io/remarkable/githubusermanager/githubusermanager
          # Tag by event so each image is traceable to what produced it:
          #   - pull request  -> `pr-<number>` (so a PR build can be tested)
          #   - push to main  -> `main`
          #   - release        -> the exact release tag (e.g. `v2.0.0.0-rc1`)
          #   - any build      -> `sha-<shortsha>` (for debugging/pinning)
          tags: |
            type=ref,event=pr
            type=ref,event=branch
            type=raw,value=${{ github.event.release.tag_name }},enable=${{ github.event_name == 'release' }}
            type=sha
          labels: |
            org.opencontainers.image.vendor=reMarkable
            org.opencontainers.image.documentation=https://github.com/reMarkable/githubUserManager
            org.opencontainers.image.authors=Marcus Ramberg <marcus.ramberg@remarkable.com>
            maintainer=reMarkable
      - name: Login to GitHub Container Registry
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      # Push on every internal build, including same-repo PRs (tagged
      # `pr-<number>`), so a PR image can be pulled and tested before merge.
      # Fork PRs only build (no push) because they get a read-only token. The
      # action itself still runs as a Docker container action built from the
      # Dockerfile at the referenced commit, so consumers can keep pinning an
      # immutable SHA.
      - name: Build and push to GitHub Container Registry
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
          tags: ${{ steps.docker_meta.outputs.tags }}
          labels: ${{ steps.docker_meta.outputs.labels }}