steveandClaude Opus 4.8
c9c404aa01
Multi-stage Dockerfile builds the web bundle, embeds it into the static Go binary (CGO_ENABLED=0), and ships it in a minimal alpine runtime: non-root user, ca-certificates + tzdata, SQLite on a /data volume, healthcheck on /api/v1/healthz, OCI provenance labels. build-image.yml pushes to the Gitea registry on every branch push: * main -> :latest * any other branch -> :<branch-name> (sanitized to valid tag chars) * every build -> :sha-<short> (immutable, for pinning) A push to a PR branch covers the PR, so there is no separate pull_request trigger. README documents the image, tags, and a docker run / Komodo compose snippet. Modeled on mort's CI. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
74 lines
2.6 KiB
YAML
74 lines
2.6 KiB
YAML
name: Build image
|
|
|
|
# Build the single-binary image and push it to the Gitea container registry so
|
|
# it can be deployed with Komodo. Tagging:
|
|
# * main -> :latest
|
|
# * any other branch -> :<branch-name> (sanitized to valid Docker tag chars)
|
|
# * every build also -> :sha-<short> (immutable, handy for pinning)
|
|
#
|
|
# Runs on every branch push (so branch images are always available) and can be
|
|
# triggered manually. A push to a PR branch covers the PR too, so there is no
|
|
# separate pull_request trigger (avoids double builds).
|
|
|
|
on:
|
|
push:
|
|
branches: ['**']
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: build-image-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
IMAGE_NAME: gitea.stevedudenhoeffer.com/steve/pansy
|
|
|
|
jobs:
|
|
build-and-push:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
REPO_URL="https://token:${{ github.token }}@gitea.stevedudenhoeffer.com/${{ github.repository }}.git"
|
|
git clone --depth=1 --branch "${{ github.ref_name }}" "$REPO_URL" .
|
|
|
|
- name: Set up Docker Buildx
|
|
run: docker buildx create --use --name pansy-builder --driver docker-container 2>/dev/null || docker buildx use pansy-builder
|
|
|
|
- name: Log in to Gitea registry
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin
|
|
|
|
- name: Compute tags
|
|
id: meta
|
|
run: |
|
|
SHA_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7)
|
|
if [ "${GITHUB_REF_NAME}" = "main" ]; then
|
|
PRIMARY="latest"
|
|
else
|
|
# Normalize the branch name to valid Docker tag chars [a-zA-Z0-9._-].
|
|
PRIMARY=$(echo "${GITHUB_REF_NAME}" | sed 's/[^a-zA-Z0-9._-]/-/g' | sed 's/--*/-/g' | sed 's/^[-.]*//;s/-$//')
|
|
fi
|
|
TAGS="${IMAGE_NAME}:${PRIMARY},${IMAGE_NAME}:sha-${SHA_SHORT}"
|
|
echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
|
|
echo "Building tags: ${TAGS}"
|
|
|
|
- name: Build and push (linux/amd64)
|
|
run: |
|
|
TAG_FLAGS=""
|
|
IFS=',' read -ra TAG_ARRAY <<< "${{ steps.meta.outputs.tags }}"
|
|
for tag in "${TAG_ARRAY[@]}"; do
|
|
TAG_FLAGS="$TAG_FLAGS --tag $tag"
|
|
done
|
|
|
|
docker buildx build \
|
|
--push \
|
|
--platform linux/amd64 \
|
|
$TAG_FLAGS \
|
|
--build-arg "BUILD_COMMIT=${GITHUB_SHA}" \
|
|
--build-arg "BUILD_BRANCH=${GITHUB_REF_NAME}" \
|
|
--build-arg "BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \
|
|
--file ./Dockerfile \
|
|
.
|