jetsung / 【CI】GitHub Action for Docker

# 构建阶段 FROM rust:1.85-trixie AS builder # Set working directory WORKDIR /app COPY . . # 编译应用 # 使用 --release 模式进行优化 RUN cargo build --release # 运行阶段 FROM gcr.io/distroless/cc-debian12:nonroot # Set working directory WORKDIR /app # 从构建阶段复制编译好的二进制文件 # 请根据实际项目名称修改 'app' COPY --from=builder /app/target/release/app /app/app # Expose port EXPOSE 8080 # 设置运行时的入口点 ENTRYPOINT ["/app/app"]

- 使用项目提供的 Docker 镜像 > **版本：** `latest`, `dev`(GHCR only), <`TAG`> | Registry | Image | | ------------------------------------------------------------------------------------------ | ------------------------------------------------------ | | [**Docker Hub**](https://hub.docker.com/r/jetsung/rclone-backup/) | `jetsung/rclone-backup` | | [**GitHub Container Registry**](https://github.com/jetsung/rclone-backup/pkgs/container/rclone-backup) | `ghcr.io/jetsung/rclone-backup` | | **Tencent Cloud Container Registry（SG）** | `sgccr.ccs.tencentyun.com/jetsung/rclone-backup` | | **Aliyun Container Registry（GZ）** | `registry.cn-guangzhou.aliyuncs.com/jetsung/rclone-backup` |

## https://docs.docker.com/build/bake/ ## https://docs.docker.com/reference/cli/docker/buildx/bake/#set ## https://github.com/crazy-max/buildx#remote-with-local ## https://github.com/docker/metadata-action variable "VERSION" { default = "latest" } ## Special target: https://github.com/docker/metadata-action#bake-definition target "docker-metadata-action" {} target "_image" { inherits = ["docker-metadata-action"] } target "_common" { context = "." dockerfile = "docker/Dockerfile" platforms = ["linux/amd64"] args = { VERSION = "${VERSION}" } } target "default" { inherits = ["_common"] tags = [ "app:local", ] } group "dev" { targets = ["dev"] } target "dev" { inherits = ["_common", "_image"] } group "release" { targets = ["release"] } target "release" { inherits = ["_common", "_image"] platforms = ["linux/amd64","linux/arm64"] }

name: Docker-Dev on: push: branches: - dev* paths: - "docker/Dockerfile" - ".github/workflows/docker-dev.yml" env: GHCR_SLUG: ghcr.io/${{ github.repository }} permissions: contents: read packages: write jobs: build: strategy: matrix: include: - arch: amd64 runner: ubuntu-24.04 tag: dev-amd64 - arch: arm64 runner: ubuntu-24.04-arm tag: dev-arm64 runs-on: ${{ matrix.runner }} outputs: package_name: ${{ steps.get_package_name.outputs.package_name }} steps: - name: Checkout Source Code uses: actions/checkout@v6 - name: Set package name id: get_package_name run: | PACKAGE_NAME="$(basename ${{ github.repository }})" echo "package_name=$PACKAGE_NAME" >> $GITHUB_ENV echo "package_name=$PACKAGE_NAME" >> $GITHUB_OUTPUT - name: Login to GitHub Container Registry (ghcr.io) uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} # - name: Docker meta # id: meta # uses: docker/metadata-action@v6 # with: # images: ${{ env.GHCR_SLUG }} # labels: | # org.opencontainers.image.title=${{ env.package_name }} # org.opencontainers.image.vendor=Jetsung Chan # [email protected] # org.opencontainers.image.url=https://i.jetsung.com # tags: ${{ matrix.tag }} # - name: Set up Docker Buildx # uses: docker/setup-buildx-action@v4 # - name: Build (without push) # uses: docker/bake-action@v7 # with: # files: | # ./docker/docker-bake.hcl # cwd://${{ steps.meta.outputs.bake-file }} # targets: ${{ matrix.tag }} # push: ${{ github.event_name != 'pull_request' }} - name: Build and push uses: docker/build-push-action@v7 with: context: . file: ./docker/Dockerfile platforms: linux/${{ matrix.arch }} push: ${{ github.event_name != 'pull_request' }} tags: ${{ env.GHCR_SLUG }}:${{ matrix.tag }} manifest: needs: build runs-on: ubuntu-24.04 steps: - name: Checkout code uses: actions/checkout@v6 - name: Log in to GHCR uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Create and push multi-arch manifest run: | docker manifest create ${{ env.GHCR_SLUG }}:dev \ --amend ${{ env.GHCR_SLUG }}:dev-amd64 \ --amend ${{ env.GHCR_SLUG }}:dev-arm64 docker manifest push ${{ env.GHCR_SLUG }}:dev shell: bash - uses: actions/delete-package-versions@v5 continue-on-error: true with: package-name: ${{ needs.build.outputs.package_name }} package-type: 'container' min-versions-to-keep: 2 delete-only-untagged-versions: 'true'

name: Docker-Release on: push: tags: - "*" # release: # types: [created] # branches: # - 'main' workflow_dispatch: inputs: version: description: 'Version tag' required: false default: '' env: branch: latest image_org: jetsung acr_registry: registry.cn-guangzhou.aliyuncs.com hcr_registry: swr.ap-southeast-3.myhuaweicloud.com tcr_registry: sgccr.ccs.tencentyun.com package_name: app permissions: contents: read packages: write jobs: build: runs-on: ubuntu-24.04 outputs: tag: ${{ steps.get_version.outputs.version }} package_name: ${{ env.package_name }} steps: - name: Checkout Source Code uses: actions/checkout@v6 with: ref: 'main' - name: Get version id: get_version run: | if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_type }}" == "tag" ]]; then version=${{ github.ref_name }} elif [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${{ github.event.inputs.version }}" ]]; then version=${{ github.event.inputs.version }} else version=latest-$(date +%Y%m%d) fi echo "version=${version#v}" >> $GITHUB_OUTPUT - name: Set up QEMU uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v4 - name: Docker meta id: meta uses: docker/metadata-action@v6 with: images: ${{ env.package_name }} labels: | org.opencontainers.image.title=${{ env.package_name }} org.opencontainers.image.vendor=Jetsung Chan tags: | type=raw,value=latest - name: Build with Bake uses: docker/bake-action@v7 with: files: | ./docker/docker-bake.hcl cwd://${{ steps.meta.outputs.bake-file }} targets: release push: false provenance: false set: | *.attest=type=provenance,disabled=true *.attest=type=sbom,disabled=true *.output=type=oci,dest=./image.tar release.args.VERSION=${{ steps.get_version.outputs.version }} # - name: Build image and create OCI artifact # uses: docker/build-push-action@v7 # with: # context: . # platforms: linux/amd64,linux/arm64 # push: false # provenance: false # build-args: | # VERSION=${{ steps.get_version.outputs.version }} # outputs: type=oci,dest=./image.tar - name: Upload image as artifact uses: actions/upload-artifact@v7 with: name: docker-image path: ./image.tar retention-days: 1 sync-to-docker: needs: build runs-on: ubuntu-24.04 continue-on-error: true steps: - name: Check Docker Hub credentials id: check_dockerhub run: | if [ -z "${{ secrets.DOCKERHUB_USERNAME }}" ] || [ -z "${{ secrets.DOCKERHUB_TOKEN }}" ]; then echo "Docker Hub credentials not configured, skipping..." echo "skip=true" >> $GITHUB_OUTPUT else echo "skip=false" >> $GITHUB_OUTPUT fi - name: Install Skopeo if: steps.check_dockerhub.outputs.skip != 'true' uses: jetsung/install-skopeo@v1 - name: Check Skopeo if: steps.check_dockerhub.outputs.skip != 'true' run: | skopeo --version - name: Login to Docker Hub if: steps.check_dockerhub.outputs.skip != 'true' uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Download image artifact if: steps.check_dockerhub.outputs.skip != 'true' uses: actions/download-artifact@v8 with: name: docker-image path: . - name: Sync to Docker Hub if: steps.check_dockerhub.outputs.skip != 'true' env: SRC_IMAGE: oci-archive:./image.tar DEST_REPO: ${{ env.image_org }}/${{ env.package_name }} DEST_TAG: ${{ needs.build.outputs.tag }} run: | skopeo copy --all $SRC_IMAGE docker://$DEST_REPO:$DEST_TAG skopeo copy --all $SRC_IMAGE docker://$DEST_REPO:latest sync-to-ghcr: needs: build runs-on: ubuntu-24.04 steps: - name: Install Skopeo uses: jetsung/install-skopeo@v1 - name: Check Skopeo run: | skopeo --version - name: Login to GitHub Container Registry (ghcr.io) uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Download image artifact uses: actions/download-artifact@v8 with: name: docker-image path: . - name: Sync to GitHub Container Registry (ghcr.io) env: SRC_IMAGE: oci-archive:./image.tar DEST_REPO: ghcr.io/${{ github.repository_owner }}/${{ env.package_name }} DEST_TAG: ${{ needs.build.outputs.tag }} run: | skopeo copy --all $SRC_IMAGE docker://$DEST_REPO:$DEST_TAG skopeo copy --all $SRC_IMAGE docker://$DEST_REPO:latest - uses: actions/delete-package-versions@v5 continue-on-error: true with: package-name: ${{ env.package_name }} package-type: 'container' min-versions-to-keep: 2 delete-only-untagged-versions: 'true' sync-to-aliyun: needs: build runs-on: ubuntu-24.04 continue-on-error: true steps: - name: Check Aliyun credentials id: check_aliyun run: | if [ -z "${{ secrets.ALIYUN_USERNAME }}" ] || [ -z "${{ secrets.ALIYUN_TOKEN }}" ]; then echo "Aliyun credentials not configured, skipping..." echo "skip=true" >> $GITHUB_OUTPUT else echo "skip=false" >> $GITHUB_OUTPUT fi - name: Install Skopeo if: steps.check_aliyun.outputs.skip != 'true' uses: jetsung/install-skopeo@v1 - name: Check Skopeo if: steps.check_aliyun.outputs.skip != 'true' run: | skopeo --version - name: Login to Aliyun if: steps.check_aliyun.outputs.skip != 'true' uses: docker/login-action@v4 with: registry: ${{ env.acr_registry }} username: ${{ secrets.ALIYUN_USERNAME }} password: ${{ secrets.ALIYUN_TOKEN }} - name: Download image artifact if: steps.check_aliyun.outputs.skip != 'true' uses: actions/download-artifact@v8 with: name: docker-image path: . - name: Sync to Aliyun if: steps.check_aliyun.outputs.skip != 'true' env: SRC_IMAGE: oci-archive:./image.tar DEST_REPO: ${{ env.acr_registry }}/${{ env.image_org }}/${{ env.package_name }} DEST_TAG: ${{ needs.build.outputs.tag }} run: | skopeo copy --all $SRC_IMAGE docker://$DEST_REPO:$DEST_TAG skopeo copy --all $SRC_IMAGE docker://$DEST_REPO:latest sync-to-tencent: needs: build runs-on: ubuntu-24.04 continue-on-error: true steps: - name: Check Tencent credentials id: check_tencent run: | if [ -z "${{ secrets.TENCENT_USERNAME }}" ] || [ -z "${{ secrets.TENCENT_TOKEN }}" ]; then echo "Tencent credentials not configured, skipping..." echo "skip=true" >> $GITHUB_OUTPUT else echo "skip=false" >> $GITHUB_OUTPUT fi - name: Install Skopeo if: steps.check_tencent.outputs.skip != 'true' uses: jetsung/install-skopeo@v1 - name: Check Skopeo if: steps.check_tencent.outputs.skip != 'true' run: | skopeo --version - name: Login to Tencent if: steps.check_tencent.outputs.skip != 'true' uses: docker/login-action@v4 with: registry: ${{ env.tcr_registry }} username: ${{ secrets.TENCENT_USERNAME }} password: ${{ secrets.TENCENT_TOKEN }} - name: Download image artifact if: steps.check_tencent.outputs.skip != 'true' uses: actions/download-artifact@v8 with: name: docker-image path: . - name: Sync to Tencent if: steps.check_tencent.outputs.skip != 'true' env: SRC_IMAGE: oci-archive:./image.tar DEST_REPO: ${{ env.tcr_registry }}/${{ env.image_org }}/${{ env.package_name }} DEST_TAG: ${{ needs.build.outputs.tag }} run: | skopeo copy --all $SRC_IMAGE docker://$DEST_REPO:$DEST_TAG skopeo copy --all $SRC_IMAGE docker://$DEST_REPO:latest