This commit is contained in:
+104
-39
@@ -3,89 +3,154 @@ name: Build Docker Package
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
tags:
|
||||
- "v*"
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
docker-package:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: gitea_act
|
||||
# 使用 Docker CLI 镜像，因为 runner 默认任务镜像不一定包含 docker、
|
||||
# bash 或基于 Node 的 action 依赖。
|
||||
container:
|
||||
image: docker:28-cli
|
||||
env:
|
||||
REGISTRY: git.hanhan.ltd
|
||||
GITEA_SERVER_URL: https://git.hanhan.ltd
|
||||
NODE_IMAGE: m.daocloud.io/docker.io/library/node:22
|
||||
NPM_REGISTRY: https://registry.npmmirror.com
|
||||
steps:
|
||||
- name: Install job tools
|
||||
shell: sh
|
||||
run: |
|
||||
apk add --no-cache git
|
||||
docker --version
|
||||
git --version
|
||||
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
env:
|
||||
GITEA_ACTOR: ${{ gitea.actor }}
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
||||
shell: sh
|
||||
run: |
|
||||
command -v git
|
||||
|
||||
repository="${GITHUB_REPOSITORY:-${{ gitea.repository }}}"
|
||||
# GITHUB_SERVER_URL 可能指向任务容器无法解析的内部容器主机名，
|
||||
# 因此这里固定使用公网 Gitea 地址。
|
||||
server_url="${GITEA_SERVER_URL}"
|
||||
sha="${GITHUB_SHA:-${{ gitea.sha }}}"
|
||||
|
||||
git init .
|
||||
git remote add origin "${server_url}/${repository}.git"
|
||||
|
||||
if [ -n "${GITEA_TOKEN}" ]; then
|
||||
auth="$(printf '%s:%s' "${GITEA_ACTOR}" "${GITEA_TOKEN}" | base64 | tr -d '\n')"
|
||||
git -c "http.extraHeader=Authorization: Basic ${auth}" fetch --depth=1 origin "${sha}"
|
||||
else
|
||||
git fetch --depth=1 origin "${sha}"
|
||||
fi
|
||||
|
||||
git checkout --force FETCH_HEAD
|
||||
git config --global --add safe.directory "$PWD"
|
||||
|
||||
- name: Prepare image metadata
|
||||
id: meta
|
||||
shell: bash
|
||||
shell: sh
|
||||
run: |
|
||||
repository="${GITHUB_REPOSITORY:-${{ gitea.repository }}}"
|
||||
repository="$(printf '%s' "$repository" | tr '[:upper:]' '[:lower:]')"
|
||||
image="${REGISTRY}/${repository}"
|
||||
image_repository="$(printf '%s' "$repository" | tr '[:upper:]' '[:lower:]')"
|
||||
image="${REGISTRY}/${image_repository}"
|
||||
|
||||
sha="${GITHUB_SHA:-${{ gitea.sha }}}"
|
||||
short_sha="${sha:0:12}"
|
||||
ref="${GITHUB_REF:-${{ gitea.ref }}}"
|
||||
source_url="${GITEA_SERVER_URL}/${repository}"
|
||||
|
||||
: > .image-tags
|
||||
|
||||
# 分支构建发布滚动的 latest 标签；版本标签如 v1.2.3
|
||||
# 只发布不可变的 1.2.3 镜像标签。
|
||||
case "${ref}" in
|
||||
refs/tags/v*)
|
||||
tag="${ref#refs/tags/}"
|
||||
version="${tag#v}"
|
||||
echo "${image}:${version}" >> .image-tags
|
||||
;;
|
||||
*)
|
||||
echo "${image}:latest" >> .image-tags
|
||||
;;
|
||||
esac
|
||||
|
||||
{
|
||||
echo "image=${image}"
|
||||
echo "tags<<EOF"
|
||||
echo "${image}:sha-${short_sha}"
|
||||
# OCI 标签可以帮助 Gitea 和其他镜像仓库展示来源仓库；
|
||||
# 即使包仍需手动关联仓库，也能保留来源元数据。
|
||||
echo "org.opencontainers.image.source=${source_url}"
|
||||
echo "org.opencontainers.image.url=${source_url}"
|
||||
echo "org.opencontainers.image.revision=${sha}"
|
||||
echo "org.opencontainers.image.title=${repository}"
|
||||
} > .image-labels
|
||||
|
||||
if [[ "${ref}" == "refs/heads/master" ]]; then
|
||||
echo "${image}:latest"
|
||||
fi
|
||||
|
||||
if [[ "${ref}" == refs/tags/* ]]; then
|
||||
tag="${ref#refs/tags/}"
|
||||
echo "${image}:${tag}"
|
||||
fi
|
||||
|
||||
echo "EOF"
|
||||
} >> "${GITHUB_OUTPUT}"
|
||||
cat .image-tags
|
||||
|
||||
- name: Login to Gitea container registry
|
||||
env:
|
||||
PACKAGE_USERNAME: ${{ secrets.PACKAGE_USERNAME }}
|
||||
PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
|
||||
GITEA_ACTOR: ${{ gitea.actor }}
|
||||
shell: bash
|
||||
shell: sh
|
||||
run: |
|
||||
if [ -z "${PACKAGE_TOKEN}" ]; then
|
||||
echo "PACKAGE_TOKEN secret is required to publish container packages." >&2
|
||||
echo "Create a Gitea personal access token with package write permission for PACKAGE_USERNAME." >&2
|
||||
exit 1
|
||||
fi
|
||||
username="${PACKAGE_USERNAME:-${GITEA_ACTOR}}"
|
||||
|
||||
if [[ -z "${PACKAGE_TOKEN}" ]]; then
|
||||
echo "PACKAGE_TOKEN secret is required to publish container packages." >&2
|
||||
echo "Create a Gitea personal access token with package write permission and save it as PACKAGE_TOKEN." >&2
|
||||
# PACKAGE_USERNAME 为了方便可以不填；但当 token 所属用户和
|
||||
# 触发流水线的用户不一致时，显式设置它可以避免 unauthorized。
|
||||
if [ -z "${username}" ]; then
|
||||
echo "PACKAGE_USERNAME secret is required because Gitea actor is empty." >&2
|
||||
echo "Set it to the Gitea username that owns PACKAGE_TOKEN." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "${PACKAGE_USERNAME}" ]; then
|
||||
echo "PACKAGE_USERNAME is not set; using Gitea actor '${username}' for docker login."
|
||||
echo "If login fails with unauthorized, set PACKAGE_USERNAME to the token owner."
|
||||
fi
|
||||
|
||||
if ! docker version; then
|
||||
echo "Docker daemon is not reachable from the Gitea runner." >&2
|
||||
echo "Mount /var/run/docker.sock into the runner or use a dind runner image." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "${PACKAGE_TOKEN}" | docker login "${REGISTRY}" -u "${username}" --password-stdin
|
||||
|
||||
- name: Build image
|
||||
shell: bash
|
||||
shell: sh
|
||||
run: |
|
||||
mapfile -t tags <<< "${{ steps.meta.outputs.tags }}"
|
||||
tag_args=""
|
||||
while IFS= read -r tag; do
|
||||
tag_args="${tag_args} --tag ${tag}"
|
||||
done < .image-tags
|
||||
|
||||
args=()
|
||||
for tag in "${tags[@]}"; do
|
||||
args+=(--tag "$tag")
|
||||
done
|
||||
label_args=""
|
||||
while IFS= read -r label; do
|
||||
label_args="${label_args} --label ${label}"
|
||||
done < .image-labels
|
||||
|
||||
docker build \
|
||||
# tag/label 参数都由上面的脚本生成，值里不包含空格；
|
||||
# 这里保留拆词是为了把它们展开成 docker build 参数。
|
||||
# shellcheck disable=SC2086
|
||||
docker build $tag_args $label_args \
|
||||
--build-arg "NODE_IMAGE=${NODE_IMAGE}" \
|
||||
--build-arg "NPM_REGISTRY=${NPM_REGISTRY}" \
|
||||
"${args[@]}" \
|
||||
.
|
||||
|
||||
- name: Push image
|
||||
shell: bash
|
||||
shell: sh
|
||||
run: |
|
||||
mapfile -t tags <<< "${{ steps.meta.outputs.tags }}"
|
||||
|
||||
for tag in "${tags[@]}"; do
|
||||
while IFS= read -r tag; do
|
||||
docker push "$tag"
|
||||
done
|
||||
done < .image-tags
|
||||
|
||||
Reference in New Issue
Block a user