mirror of
https://github.com/4gray/iptvnator.git
synced 2026-10-11 11:06:16 -08:00
4grayandClaude Opus 5
319a0404aa
Supersedes the three individual Dependabot PRs (#1249, #1245, #1247) so the pinned-SHA contract stays consistent in one commit. actions/checkout v4 -> v7, actions/upload-artifact v4 -> v7 and actions/download-artifact v4 -> v8 across every workflow. docker.yml moves from checkout v6 to v7 with the rest. publish-snap.yaml keeps full-commit pins, so the three new SHAs are updated there and in the packaging policy tests that assert them (snap-workflow-policy.test-helpers.mjs, publish-snap-workflow.test.mjs, release-snap-assets.test.mjs). Each SHA was checked against the upstream tag refs: checkout 3d3c42e5 = v7.0.1, upload-artifact 043fb46d = v7.0.1, download-artifact 3e5f45b2 = v8.0.1. BUILD_ACTION_ALLOWLIST follows the unpinned bumps in build-and-make.yaml. download-artifact v8 changes two behaviours that matter for the Snap publish path, both in our favour: an artifact digest mismatch now fails the run instead of logging a warning, and the action only unzips responses whose Content-Type says zip. The publish job downloads a normal upload-artifact artifact by name, so decompression is unchanged, and it re-verifies the receipt digest itself regardless. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
124 lines
4.4 KiB
YAML
124 lines
4.4 KiB
YAML
name: docker-build
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- '.github/workflows/docker.yml'
|
|
- 'apps/web/**'
|
|
- 'apps/web-backend/**'
|
|
- 'docker/**'
|
|
- 'libs/**'
|
|
- 'package.json'
|
|
- 'pnpm-lock.yaml'
|
|
push:
|
|
branches:
|
|
- master
|
|
tags:
|
|
- 'v*'
|
|
workflow_dispatch:
|
|
inputs:
|
|
push:
|
|
description: 'Push the image to Docker Hub'
|
|
required: true
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# Superseded PR pushes cancel their still-running image build. Master/tag/
|
|
# manual runs get a unique group (run_id): GitHub keeps at most one pending
|
|
# run per group even with cancel-in-progress: false, so a shared ref group
|
|
# could silently drop a queued publish between two rapid master pushes.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
build:
|
|
name: Build Docker image
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 90
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Prepare Docker metadata
|
|
id: docker-meta
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
version="$(node -p "require('./package.json').version")"
|
|
short_sha="${GITHUB_SHA::12}"
|
|
publish="false"
|
|
platforms="linux/amd64"
|
|
tags="4gray/iptvnator:pr-${{ github.event.pull_request.number || 'manual' }}"
|
|
|
|
if [[ "${GITHUB_EVENT_NAME}" == "push" && "${GITHUB_REF}" == "refs/heads/master" ]]; then
|
|
publish="true"
|
|
platforms="linux/amd64,linux/arm64"
|
|
tags=$(cat <<TAGS
|
|
4gray/iptvnator:latest
|
|
4gray/iptvnator:${version}-pwa
|
|
4gray/iptvnator:${version}-pwa-${short_sha}
|
|
4gray/iptvnator:sha-${short_sha}
|
|
TAGS
|
|
)
|
|
elif [[ "${GITHUB_EVENT_NAME}" == "push" && "${GITHUB_REF}" == refs/tags/v* ]]; then
|
|
publish="true"
|
|
platforms="linux/amd64,linux/arm64"
|
|
tag_version="${GITHUB_REF_NAME#v}"
|
|
tags=$(cat <<TAGS
|
|
4gray/iptvnator:${tag_version}
|
|
4gray/iptvnator:v${tag_version}
|
|
TAGS
|
|
)
|
|
if [[ "${tag_version}" != *-* ]]; then
|
|
tags="${tags}"$'\n'"4gray/iptvnator:stable"
|
|
fi
|
|
elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${{ inputs.push }}" == "true" ]]; then
|
|
publish="true"
|
|
platforms="linux/amd64,linux/arm64"
|
|
tags=$(cat <<TAGS
|
|
4gray/iptvnator:manual-${short_sha}
|
|
4gray/iptvnator:sha-${short_sha}
|
|
TAGS
|
|
)
|
|
fi
|
|
|
|
{
|
|
echo "publish=${publish}"
|
|
echo "platforms=${platforms}"
|
|
echo "tags<<EOF"
|
|
echo "${tags}"
|
|
echo "EOF"
|
|
} >> "${GITHUB_OUTPUT}"
|
|
|
|
- name: Login to Docker Hub
|
|
if: steps.docker-meta.outputs.publish == 'true'
|
|
uses: docker/login-action@v4
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v4
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
- name: Build Docker image
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
file: ./docker/Dockerfile
|
|
push: ${{ steps.docker-meta.outputs.publish == 'true' }}
|
|
tags: ${{ steps.docker-meta.outputs.tags }}
|
|
platforms: ${{ steps.docker-meta.outputs.platforms }}
|
|
build-args: |
|
|
BUILD_COMMIT=${{ github.event.pull_request.head.sha || github.sha }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max,ignore-error=true
|