diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index e82b162..f4be987 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -1,23 +1,16 @@ -name: Docker Build +name: Build Docker Image on: push: tags: - "*" - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }} - jobs: - build: + build_docker_image: + name: Build Docker Image runs-on: ubuntu-latest permissions: - contents: read packages: write - id-token: write - attestations: write - + contents: read steps: - name: Checkout repository uses: actions/checkout@v4 @@ -26,10 +19,9 @@ jobs: uses: docker/setup-buildx-action@v3 - name: Log in to Container Registry - if: github.event_name != 'pull_request' uses: docker/login-action@v3 with: - registry: ${{ env.REGISTRY }} + registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} @@ -37,13 +29,10 @@ jobs: id: meta uses: docker/metadata-action@v5 with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + images: ghcr.io/${{ github.repository }} tags: | - type=ref,event=branch - type=ref,event=pr type=ref,event=tag - type=sha,prefix={{branch}}-,enable={{is_default_branch}} - type=raw,value=latest,enable={{is_default_branch}} + type=raw,value=latest,enable={{ and is_default_branch (not (contains ref_name "-")) }} - name: Build and push Docker image id: build @@ -51,18 +40,8 @@ jobs: with: context: . platforms: linux/amd64,linux/arm64 - push: ${{ github.event_name != 'pull_request' }} + push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max build-args: | VERSION=${{ github.ref_name }} - - - name: Generate artifact attestation - if: github.event_name != 'pull_request' && steps.build.outputs.digest != '' - uses: actions/attest-build-provenance@v1 - with: - subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - subject-digest: ${{ steps.build.outputs.digest }} - push-to-registry: true