8d1ead4eef
When a PR enters the merge queue, GitHub triggers both a 'merge_group' and a 'push' event. These events might share the same concurrency key as they both reference the temporary 'gh-readonly-queue/' branch. This creates a race condition where the redundant 'push' job could incorrectly cancel the official 'merge_group' run. This commit adds an explicit filter to ignore 'push' events on queue branches, ensuring CI stability and saving runner minutes.
62 lines
2 KiB
YAML
62 lines
2 KiB
YAML
name: docker
|
||
on:
|
||
push:
|
||
branches:
|
||
- 'master'
|
||
tags:
|
||
- 'v*.*.*'
|
||
pull_request:
|
||
merge_group:
|
||
types:
|
||
- checks_requested
|
||
workflow_dispatch:
|
||
inputs:
|
||
use_cache:
|
||
description: "Use build cache"
|
||
required: true
|
||
type: boolean
|
||
default: true
|
||
|
||
concurrency:
|
||
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.merge_group.head_ref || github.ref }}
|
||
cancel-in-progress: true
|
||
|
||
jobs:
|
||
build:
|
||
uses: docker/github-builder/.github/workflows/build.yml@v1
|
||
# Exclude 'push' events from the Merge Queue to avoid a race condition where
|
||
# the 'push' event might cancel the 'merge_group' event via the concurrency group.
|
||
if: (!(github.event_name == 'push' && startsWith(github.ref, 'refs/heads/gh-readonly-queue/')))
|
||
permissions:
|
||
contents: read
|
||
packages: write
|
||
id-token: write
|
||
attestations: write
|
||
with:
|
||
context: . # Use local checkout to support GitHub Merge Queue
|
||
output: image
|
||
platforms: linux/amd64,linux/arm64
|
||
push: ${{ github.event_name != 'pull_request' }}
|
||
cache: ${{ github.event_name != 'workflow_dispatch' || inputs.use_cache }}
|
||
# We don't sign the image because ghcr.io doesn't support OCI Referrers API yet, and the fallback relies on pushing new tags on each build
|
||
# https://github.com/docker/github-builder/issues/109#issuecomment-3885082486
|
||
# https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#backwards-compatibility
|
||
sign: false
|
||
sbom: true
|
||
meta-images: ghcr.io/${{ github.repository }}
|
||
meta-tags: |
|
||
type=ref,event=branch
|
||
type=ref,event=pr
|
||
type=semver,pattern={{raw}}
|
||
set-meta-annotations: true
|
||
set-meta-labels: true
|
||
labels: |
|
||
org.opencontainers.image.title=Oxipng
|
||
annotations: |
|
||
org.opencontainers.image.title=Oxipng
|
||
|
||
secrets:
|
||
registry-auths: |
|
||
- registry: ghcr.io
|
||
username: ${{ github.actor }}
|
||
password: ${{ secrets.GITHUB_TOKEN }}
|