mirror of
https://github.com/Frooodle/Stirling-PDF.git
synced 2025-12-18 20:04:17 +01:00
b83888c74a
# Description of Changes Add lite mode for CI which just runs the most important jobs for deployment. This won't be used in this repo, but allows other repos containing Stirling to easily disable jobs like desktop builds etc. if they're unnecessary, without needing to deal with conflicts in the files. They'll just need to set the repo variable `CI_PROFILE` to `lite`. We have an upstream repo that we'd like these changes for.
209 lines
8.2 KiB
YAML
209 lines
8.2 KiB
YAML
name: Push Docker Image with VersionNumber
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- master
|
|
- main
|
|
|
|
# cancel in-progress jobs if a new job is triggered
|
|
# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
|
|
# or a pull request is updated.
|
|
# It helps to save resources and time by ensuring that only the latest commit is built and tested
|
|
# This is particularly useful for long-running jobs that may take a while to complete.
|
|
# The `group` is set to a combination of the workflow name, event name, and branch name.
|
|
# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
|
|
# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
push:
|
|
if: ${{ vars.CI_PROFILE != 'lite' }}
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
packages: write
|
|
id-token: write
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
|
|
- name: Set up JDK 17
|
|
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
|
|
with:
|
|
java-version: "17"
|
|
distribution: "temurin"
|
|
|
|
- uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
|
|
with:
|
|
gradle-version: 8.14
|
|
|
|
- name: Run Gradle Command
|
|
run: ./gradlew clean build
|
|
env:
|
|
DISABLE_ADDITIONAL_FEATURES: true
|
|
STIRLING_PDF_DESKTOP_UI: false
|
|
|
|
- name: Install cosign
|
|
if: github.ref == 'refs/heads/master'
|
|
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
|
|
with:
|
|
cosign-release: "v2.4.1"
|
|
|
|
- name: Set up Docker Buildx
|
|
id: buildx
|
|
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
|
|
|
|
- name: Get version number
|
|
id: versionNumber
|
|
run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
|
|
with:
|
|
username: ${{ secrets.DOCKER_HUB_USERNAME }}
|
|
password: ${{ secrets.DOCKER_HUB_API }}
|
|
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ github.token }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
|
|
|
|
- name: Convert repository owner to lowercase
|
|
id: repoowner
|
|
run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
|
|
|
|
- name: Generate tags
|
|
id: meta
|
|
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
|
|
if: github.ref != 'refs/heads/main'
|
|
with:
|
|
images: |
|
|
${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
|
|
ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
|
|
ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
|
|
${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
|
|
tags: |
|
|
type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' }}
|
|
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
|
|
|
|
- name: Build and push main Dockerfile
|
|
id: build-push-regular
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
|
|
if: github.ref != 'refs/heads/main'
|
|
with:
|
|
builder: ${{ steps.buildx.outputs.name }}
|
|
context: .
|
|
file: ./docker/embedded/Dockerfile
|
|
push: true
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
|
|
platforms: linux/amd64,linux/arm64/v8
|
|
provenance: true
|
|
sbom: true
|
|
|
|
- name: Sign regular images
|
|
if: github.ref == 'refs/heads/master'
|
|
env:
|
|
DIGEST: ${{ steps.build-push-regular.outputs.digest }}
|
|
TAGS: ${{ steps.meta.outputs.tags }}
|
|
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
|
|
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
|
|
run: |
|
|
echo "$TAGS" | tr ',' '\n' | while read -r tag; do
|
|
cosign sign --yes \
|
|
--key env://COSIGN_PRIVATE_KEY \
|
|
"${tag}@${DIGEST}"
|
|
done
|
|
|
|
- name: Generate tags ultra-lite
|
|
id: meta2
|
|
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
|
|
if: github.ref != 'refs/heads/main'
|
|
with:
|
|
images: |
|
|
${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
|
|
ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
|
|
ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
|
|
${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
|
|
tags: |
|
|
type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
|
|
type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
|
|
|
|
- name: Build and push Dockerfile-ultra-lite
|
|
id: build-push-lite
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
|
|
if: github.ref != 'refs/heads/main'
|
|
with:
|
|
context: .
|
|
file: ./docker/embedded/Dockerfile.ultra-lite
|
|
push: true
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
tags: ${{ steps.meta2.outputs.tags }}
|
|
labels: ${{ steps.meta2.outputs.labels }}
|
|
build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
|
|
platforms: linux/amd64,linux/arm64/v8
|
|
provenance: true
|
|
sbom: true
|
|
|
|
- name: Generate tags fat
|
|
id: meta3
|
|
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
|
|
with:
|
|
images: |
|
|
${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
|
|
ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
|
|
ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
|
|
${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
|
|
tags: |
|
|
type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' }}
|
|
type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' }}
|
|
type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' }}
|
|
|
|
- name: Build and push main Dockerfile fat
|
|
id: build-push-fat
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
|
|
with:
|
|
builder: ${{ steps.buildx.outputs.name }}
|
|
context: .
|
|
file: ./docker/embedded/Dockerfile.fat
|
|
push: true
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
tags: ${{ steps.meta3.outputs.tags }}
|
|
labels: ${{ steps.meta3.outputs.labels }}
|
|
build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
|
|
platforms: linux/amd64,linux/arm64/v8
|
|
provenance: true
|
|
sbom: true
|
|
|
|
- name: Sign fat images
|
|
if: github.ref == 'refs/heads/master'
|
|
env:
|
|
DIGEST: ${{ steps.build-push-fat.outputs.digest }}
|
|
TAGS: ${{ steps.meta3.outputs.tags }}
|
|
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
|
|
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
|
|
run: |
|
|
echo "$TAGS" | tr ',' '\n' | while read -r tag; do
|
|
cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
|
|
done
|