09cb2da8c2
Replace the exclusion-based condition with an explicit list of events that should push an image. Any future trigger added to the workflow will default to not pushing, which is the safe behavior.
62 lines
2 KiB
YAML
62 lines
2 KiB
YAML
name: docker
|
||
on:
|
||
push:
|
||
branches:
|
||
- 'master'
|
||
tags:
|
||
- 'v*.*.*'
|
||
pull_request:
|
||
merge_group:
|
||
types:
|
||
- checks_requested
|
||
workflow_dispatch:
|
||
inputs:
|
||
use_cache:
|
||
description: "Use build cache"
|
||
required: true
|
||
type: boolean
|
||
default: true
|
||
|
||
concurrency:
|
||
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
|
||
cancel-in-progress: true
|
||
|
||
jobs:
|
||
build:
|
||
uses: docker/github-builder/.github/workflows/build.yml@v1
|
||
# Exclude 'push' events on Merge Queue branches, as they are already
|
||
# handled by the 'merge_group' event.
|
||
if: (!(github.event_name == 'push' && startsWith(github.ref, 'refs/heads/gh-readonly-queue/')))
|
||
permissions:
|
||
contents: read
|
||
packages: write
|
||
id-token: write
|
||
attestations: write
|
||
with:
|
||
context: . # Use local checkout to support GitHub Merge Queue
|
||
output: image
|
||
platforms: linux/amd64,linux/arm64
|
||
push: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
|
||
cache: ${{ github.event_name != 'workflow_dispatch' || inputs.use_cache }}
|
||
# We don't sign the image because ghcr.io doesn't support OCI Referrers API yet, and the fallback relies on pushing new tags on each build
|
||
# https://github.com/docker/github-builder/issues/109#issuecomment-3885082486
|
||
# https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#backwards-compatibility
|
||
sign: false
|
||
sbom: true
|
||
meta-images: ghcr.io/${{ github.repository }}
|
||
meta-tags: |
|
||
type=ref,event=branch
|
||
type=ref,event=pr
|
||
type=semver,pattern={{raw}}
|
||
set-meta-annotations: true
|
||
set-meta-labels: true
|
||
labels: |
|
||
org.opencontainers.image.title=Oxipng
|
||
annotations: |
|
||
org.opencontainers.image.title=Oxipng
|
||
|
||
secrets:
|
||
registry-auths: |
|
||
- registry: ghcr.io
|
||
username: ${{ github.actor }}
|
||
password: ${{ secrets.GITHUB_TOKEN }}
|