kacerrandClaude Opus 5.5
60360ca5b9
- ci: reject a manual dispatch with tag "latest"; concurrency group per tag - Dockerfile: declare GIT_COMMIT after the module download layer - Makefile: docker-build targets linux/amd64 by default - patch.go: no shared package-level pointers; main.go: no init() - tests: assert that merge replaces managed listener content - docs: flows.md startup section matches main.go; review saved to docs/reviews Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
81 lines
2.5 KiB
YAML
81 lines
2.5 KiB
YAML
name: Build and Push
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Image tag (not "latest")'
|
|
required: true
|
|
push:
|
|
tags:
|
|
- '*'
|
|
|
|
concurrency:
|
|
group: build-${{ github.ref }}-${{ inputs.tag }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
- name: Vet
|
|
run: go vet ./...
|
|
- name: Build
|
|
run: go build ./...
|
|
- name: Test (short)
|
|
run: go test -short ./...
|
|
|
|
build:
|
|
needs: check
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Compute image tags
|
|
id: meta
|
|
run: |
|
|
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
|
TAG="${{ inputs.tag }}"
|
|
# The Deployment runs :latest; only real tag pushes may move it.
|
|
if [ "$TAG" = "latest" ]; then
|
|
echo "refusing to dispatch with tag 'latest'" >&2
|
|
exit 1
|
|
fi
|
|
else
|
|
TAG="${{ github.ref_name }}"
|
|
fi
|
|
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
|
|
echo "sha=sha-$(echo '${{ github.sha }}' | cut -c1-12)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Login to Gitea registry
|
|
run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin gitea.home.hrajfrisbee.cz
|
|
|
|
- name: Build and push
|
|
run: |
|
|
IMAGE=gitea.home.hrajfrisbee.cz/${{ github.repository }}
|
|
docker build \
|
|
--build-arg GIT_COMMIT=$(echo '${{ github.sha }}' | cut -c1-12) \
|
|
--label org.opencontainers.image.source=https://gitea.home.hrajfrisbee.cz/${{ github.repository }} \
|
|
--label org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
|
|
-t "$IMAGE:${{ steps.meta.outputs.tag }}" \
|
|
-t "$IMAGE:${{ steps.meta.outputs.sha }}" \
|
|
.
|
|
docker push "$IMAGE:${{ steps.meta.outputs.tag }}"
|
|
docker push "$IMAGE:${{ steps.meta.outputs.sha }}"
|
|
|
|
# Only real tag pushes move :latest — an ad-hoc dispatch of an old ref must not clobber it.
|
|
- name: Push latest (tag builds only)
|
|
if: github.event_name == 'push'
|
|
run: |
|
|
IMAGE=gitea.home.hrajfrisbee.cz/${{ github.repository }}
|
|
docker tag "$IMAGE:${{ steps.meta.outputs.tag }}" "$IMAGE:latest"
|
|
docker push "$IMAGE:latest"
|