11name : Docker Build & Deploy
2-
32on :
43 push :
54 branches :
1110 - main
1211 workflow_dispatch :
1312 schedule :
14- - cron : ' 0 2 * * 0' # Weekly cleanup on Sundays
15-
13+ - cron : 0 2 * * 0 # Weekly cleanup on Sundays
1614concurrency :
1715 group : ${{ github.workflow }}-${{ github.ref }}
1816 cancel-in-progress : ${{ github.event_name == 'pull_request' }}
19-
2017env :
2118 REGISTRY : ghcr.io
2219 IMAGE_NAME : ${{ github.repository }}
2320 DOCKER_BUILD_SUMMARY : true
2421 DOCKER_BUILD_CHECKS_ANNOTATIONS : true
25-
2622jobs :
2723 validate :
2824 if : github.event_name == 'pull_request'
3228 steps :
3329 - name : Set up Docker Buildx
3430 uses : docker/setup-buildx-action@v3
35-
3631 - name : Build for validation (Git context)
3732 uses : docker/build-push-action@v6.18.0
3833 timeout-minutes : 15
@@ -49,14 +44,12 @@ jobs:
4944 annotations : |
5045 org.opencontainers.image.title=Tux Discord Bot
5146 org.opencontainers.image.description=All Things Linux Discord Bot
52-
5347 - name : Test container starts
5448 run : |
5549 docker run --rm --name tux-test \
5650 --entrypoint python \
5751 tux:pr-${{ github.event.number }} \
5852 -c "import tux; import sqlite3; import asyncio; print('🔍 Testing bot imports...'); print('✅ Main bot module imports successfully'); print('✅ SQLite available'); print('✅ Asyncio available'); conn = sqlite3.connect(':memory:'); conn.close(); print('✅ Database connectivity working'); print('🎉 All smoke tests passed!')"
59-
6053 build :
6154 if : github.event_name != 'pull_request'
6255 runs-on : ubuntu-latest
@@ -74,25 +67,21 @@ jobs:
7467 uses : actions/checkout@v4
7568 with :
7669 fetch-depth : 0
77-
7870 - name : Set up QEMU
7971 uses : docker/setup-qemu-action@v3
8072 with :
8173 platforms : linux/amd64,linux/arm64
82-
8374 - name : Set up Docker Buildx
8475 uses : docker/setup-buildx-action@v3
8576 with :
8677 driver-opts : |
8778 image=moby/buildkit:buildx-stable-1
88-
8979 - name : Log in to Container Registry
9080 uses : docker/login-action@v3
9181 with :
9282 registry : ${{ env.REGISTRY }}
9383 username : ${{ github.actor }}
9484 password : ${{ secrets.GITHUB_TOKEN }}
95-
9685 - name : Extract metadata
9786 id : meta
9887 uses : docker/metadata-action@v5
@@ -111,7 +100,6 @@ jobs:
111100 org.opencontainers.image.source=https://github.com/${{ github.repository }}
112101 org.opencontainers.image.revision=${{ github.sha }}
113102 org.opencontainers.image.licenses=MIT
114-
115103 - name : Build and push
116104 id : build
117105 uses : docker/build-push-action@v6.18.0
@@ -135,14 +123,12 @@ jobs:
135123 annotations : ${{ steps.meta.outputs.annotations }}
136124 build-args : |
137125 BUILDKIT_INLINE_CACHE=1
138-
139126 - name : Test pushed image
140127 run : |
141128 docker run --rm --name tux-prod-test \
142129 --entrypoint python \
143130 "$(echo '${{ steps.meta.outputs.tags }}' | head -1)" \
144131 -c "import tux; import sqlite3; import asyncio; print('🔍 Testing production image...'); print('✅ Bot imports successfully'); print('✅ Dependencies available'); conn = sqlite3.connect(':memory:'); conn.close(); print('✅ Database connectivity working'); print('🎉 Production image verified!')"
145-
146132 security :
147133 if : github.event_name != 'pull_request'
148134 needs : build
@@ -154,32 +140,28 @@ jobs:
154140 uses : actions/checkout@v4
155141 with :
156142 fetch-depth : 0
157-
158143 - name : Get first image tag
159144 id : first_tag
160- run : echo "image=$(echo '${{ needs.build.outputs.image }}' | head -1)" >> "$GITHUB_OUTPUT"
161-
145+ run : echo "image=$(echo '${{ needs.build.outputs.image }}' | head -1)" >>
146+ " $GITHUB_OUTPUT "
162147 - name : Cache Trivy
163148 uses : actions/cache@v4
164149 with :
165150 path : ~/.cache/trivy
166151 key : cache-trivy-${{ github.run_id }}
167152 restore-keys : |
168153 cache-trivy-
169-
170154 - name : Run Trivy vulnerability scanner
171155 uses : aquasecurity/trivy-action@master
172156 with :
173157 image-ref : ${{ steps.first_tag.outputs.image }}
174158 format : sarif
175159 output : trivy-results.sarif
176160 severity : CRITICAL,HIGH
177-
178161 - name : Upload Trivy scan results
179162 uses : github/codeql-action/upload-sarif@v3
180163 with :
181164 sarif_file : trivy-results.sarif
182-
183165 - name : Fail on critical vulnerabilities (excluding known issues)
184166 uses : aquasecurity/trivy-action@master
185167 with :
@@ -189,9 +171,9 @@ jobs:
189171 exit-code : ' 1'
190172 ignore-unfixed : true
191173 trivyignores : .trivyignore
192-
193174 cleanup :
194- if : github.event_name != 'pull_request' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
175+ if : github.event_name != 'pull_request' && (github.event_name == 'schedule' ||
176+ github.event_name == 'workflow_dispatch')
195177 runs-on : ubuntu-latest
196178 permissions :
197179 packages : write
0 commit comments