Merge pull request #14 from beyondwin/codex/release-v2.0.0 #41
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Server Image | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| image_tag: | |
| description: "GHCR image tag to publish, for example v1.2.0" | |
| required: true | |
| type: string | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: | |
| contents: read | |
| packages: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-and-push: | |
| name: Build and push GHCR image | |
| if: ${{ github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v') }} | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: production | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.ref }} | |
| - name: Set image name | |
| id: image | |
| env: | |
| DISPATCH_IMAGE_TAG: ${{ inputs.image_tag || '' }} | |
| run: | | |
| image_name="ghcr.io/${GITHUB_REPOSITORY,,}/readmates-server" | |
| image_tag="${DISPATCH_IMAGE_TAG:-${GITHUB_REF_NAME}}" | |
| if [[ ! "$image_tag" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]]; then | |
| echo "Invalid Docker image tag: $image_tag" >&2 | |
| exit 1 | |
| fi | |
| echo "name=$image_name" >> "$GITHUB_OUTPUT" | |
| echo "tag=$image_tag" >> "$GITHUB_OUTPUT" | |
| - name: Set up Java | |
| uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 | |
| with: | |
| distribution: temurin | |
| java-version: 25 | |
| - name: Set up Gradle | |
| uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 | |
| - name: Server quality gate and build jar | |
| run: ./server/gradlew -p server clean check bootJar | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 | |
| with: | |
| platforms: arm64 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push scan candidate | |
| id: build | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: server | |
| file: server/Dockerfile.release | |
| platforms: linux/arm64 | |
| push: true | |
| tags: ${{ steps.image.outputs.name }}:scan-${{ github.run_id }}-${{ github.run_attempt }} | |
| sbom: true | |
| provenance: true | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Scan image vulnerabilities | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| env: | |
| TRIVY_PLATFORM: linux/arm64 | |
| with: | |
| image-ref: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }} | |
| scanners: vuln | |
| format: table | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| exit-code: '1' | |
| - name: Promote scanned digest to release tag | |
| run: | | |
| docker buildx imagetools create \ | |
| --tag "${{ steps.image.outputs.name }}:${{ steps.image.outputs.tag }}" \ | |
| "${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }}" | |
| - name: Record promoted digest | |
| run: | | |
| { | |
| echo "image=${{ steps.image.outputs.name }}:${{ steps.image.outputs.tag }}" | |
| echo "digest=${{ steps.build.outputs.digest }}" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Upload server failure diagnostics | |
| if: ${{ failure() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: deploy-server-failure-diagnostics | |
| path: | | |
| server/build/reports/tests | |
| server/build/test-results | |
| if-no-files-found: ignore |