Publish Docker image #13
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Docker image | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - pyproject.toml | |
| workflow_dispatch: | |
| jobs: | |
| tests: | |
| permissions: | |
| checks: write | |
| pull-requests: write | |
| contents: write | |
| uses: ./.github/workflows/test.yaml | |
| secrets: inherit | |
| push_to_registry: | |
| name: Push Docker image to GitHub Packages | |
| runs-on: ubuntu-latest | |
| needs: tests | |
| permissions: | |
| contents: read # required for actions/checkout | |
| packages: write # required for pushing to ghcr.io | |
| id-token: write # required for signing with cosign | |
| outputs: | |
| version: ${{ steps.extract_version.outputs.VERSION }} | |
| tag: ${{ steps.extract_version.outputs.TAG }} | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v4 | |
| - name: Extract version | |
| id: extract_version | |
| run: | | |
| VERSION=$(grep 'version =' pyproject.toml | sed -e 's/version = "\(.*\)"/\1/')-$(echo $GITHUB_SHA | cut -c1-7) | |
| echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT" | |
| TAG=v$(grep 'version =' pyproject.toml | sed -e 's/version = "\(.*\)"/\1/') | |
| echo "TAG=$TAG" >> "$GITHUB_OUTPUT" | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0 | |
| with: | |
| cosign-release: 'v2.2.4' | |
| # - name: Build and push Docker image | |
| # id: build-and-push | |
| # uses: docker/build-push-action@v5 | |
| # with: | |
| # context: . | |
| # push: true | |
| # tags: | | |
| # ghcr.io/sysdiglabs/sysdig-mcp-server:latest | |
| # ghcr.io/sysdiglabs/sysdig-mcp-server:v${{ steps.extract_version.outputs.VERSION }} | |
| # - name: Sign the published Docker image | |
| # env: | |
| # TAGS: | | |
| # ghcr.io/sysdiglabs/sysdig-mcp-server:latest | |
| # ghcr.io/sysdiglabs/sysdig-mcp-server:v${{ steps.extract_version.outputs.VERSION }} | |
| # DIGEST: ${{ steps.build-and-push.outputs.digest }} | |
| # run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} | |
| tag_release: | |
| name: Tag Release | |
| runs-on: ubuntu-latest | |
| needs: push_to_registry | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v4 | |
| - name: Get tag version | |
| id: semantic_release | |
| uses: anothrNick/[email protected] | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| DEFAULT_BUMP: "patch" | |
| TAG_CONTEXT: ${{ (github.base_ref != 'main') && 'branch' || 'repo' }} | |
| PRERELEASE_SUFFIX: "beta" | |
| PRERELEASE: ${{ (github.base_ref != 'main') && 'true' || 'false' }} | |
| DRY_RUN: true | |
| INITIAL_VERSION: ${{ steps.pyproject_version.outputs.TAG }} | |
| - name: Summary | |
| run: | | |
| echo "## Release Summary | |
| - Tag: ${{ steps.semantic_release.outputs.tag }} | |
| - Docker Image: ghcr.io/sysdiglabs/sysdig-mcp-server:v${{ steps.extract_version.outputs.VERSION }}" >> $GITHUB_STEP_SUMMARY |