gh-workflows/.github/workflows/dockerbuild-github.yml at master · contentflow/gh-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: Build Docker image for Github

on:
  workflow_call:

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      contents: write
      packages: write

    steps:
      - name: 'Cleanup build folder'
        run: |
          ls -la ./
          rm -rf ./* || true
          rm -rf ./.??* || true
          ls -la ./

      - uses: actions/checkout@v4
        with:
          fetch-tags: true
          fetch-depth: 0

      - uses: actions/setup-go@v5
        with:
          go-version: '1.24'
          check-latest: true

      - name: Log in to the Container registry
        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set Github Registry
        id: gh-registry
        run: |
          echo "GITHUB_REGISTRY=ghcr.io" >> $GITHUB_ENV

      - name: Import Secrets
        id: import-secrets
        uses: hashicorp/vault-action@v3
        with:
          url: ${{ secrets.VAULT_ADDR }}
          method: approle
          roleId: ${{ secrets.VAULT_ROLE_ID }}
          secretId: ${{ secrets.VAULT_SECRET_ID }}
          secrets: |
            secret/deployments/github registry | REGISTRY;
            secret/deployments/github token | GH_TOKEN

      - name: Extract live metadata for Docker
        id: meta_live
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.GITHUB_REGISTRY }}/${{ github.repository }}
          tags: |
            type=schedule
            type=semver,pattern={{version}}
            type=raw,value=latest,enable=${{ inputs.environment == 'staging' || github.event.ref == format('refs/heads/{0}', 'master') }}

      - name: Extract staging metadata for Docker on Github
        id: meta_staging
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.GITHUB_REGISTRY }}/${{ github.repository }}
          tags: |
            type=schedule
            type=semver,pattern={{version}}
            type=raw,value=latest,enable=${{ inputs.environment == 'staging' || github.event.ref == format('refs/heads/{0}', 'master') }}

      - name: Extract branch name
        shell: bash
        run: |
          echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
          echo "tag=$(git describe --tags || git rev-parse --short HEAD || echo 'none')" >> $GITHUB_OUTPUT
        id: extract_branch

      - name: "Get version"
        run: |
          echo "${{ steps.extract_branch.outputs.branch }}" > version.txt

      - name: Build and push to staging
        id: push
        uses: docker/build-push-action@v5
        if: startsWith(github.event.ref, 'refs/heads/master') || github.event.inputs.environment == 'staging'
        with:
          file: Dockerfile
          context: .
          build-args: |
            VAULT_ADDR=${{ secrets.VAULT_ADDR }}
            VAULT_ROLE_ID=${{ secrets.VAULT_ROLE_ID }}
            VAULT_SECRET_ID=${{ secrets.VAULT_SECRET_ID }}
            GH_TOKEN=${{ env.GH_TOKEN }}
          push: true
          tags: |
            ${{ steps.meta_staging.outputs.tags }}

      #- name: "set version for staging"
      #  if: startswith(github.event.ref, 'refs/heads/master')
      #  run: |
      #    cp version.txt ${{ steps.extract_branch.outputs.tag }}
      #    gsutil rm gs://contentflow-builds/contentflow/${{ github.event.repository.name }}/staging/* || true
      #- name: 'Upload staging version file'
      #  if: startsWith(github.event.ref, 'refs/heads/master')
      #  uses: google-github-actions/upload-cloud-storage@v2
      #  with:
      #    path: ${{ steps.extract_branch.outputs.tag }}
      #    headers: |-
      #      content-type: text/plain
      #    destination: "contentflow-builds/contentflow/${{ github.event.repository.name }}/staging/"

      - name: Build and push to production
        uses: docker/build-push-action@v5
        if: startsWith(github.event.ref, 'refs/tags/v') || github.event.inputs.environment == 'production'
        with:
          file: Dockerfile
          context: .
          build-args: |
            VAULT_ADDR=${{ secrets.VAULT_ADDR }}
            VAULT_ROLE_ID=${{ secrets.VAULT_ROLE_ID }}
            VAULT_SECRET_ID=${{ secrets.VAULT_SECRET_ID }}
            GH_TOKEN=${{ env.GH_TOKEN }}
          push: true
          tags: |
            ${{ steps.meta_live.outputs.tags }}

      #- name: "set version for production"
      #  if: startswith(github.event.ref, 'refs/tags/v')
      #  run: |
      #    cp version.txt ${{ steps.extract_branch.outputs.tag }}
      #    gsutil rm gs://contentflow-builds/contentflow/${{ github.event.repository.name }}/production/* || true

      #- name: 'Upload production version file'
      #  if: startsWith(github.event.ref, 'refs/tags/v')
      #  uses: google-github-actions/upload-cloud-storage@v2
      #  with:
      #    path: ${{ steps.extract_branch.outputs.tag }}
      #    headers: |-
      #      content-type: text/plain
      #    destination: "contentflow-builds/contentflow/${{ github.event.repository.name }}/production/"