ccbd2f971c
The push condition only excluded pull_request events, causing the builder to attempt a push on merge_group events too. Since no meta-tag rule matches merge_group, this results in a push with no tag, which fails or produces a broken image. Now only pushes on branch/tag push and workflow_dispatch.
62 lines
2 KiB
YAML
62 lines
2 KiB
YAML
name: docker
|
||
on:
|
||
push:
|
||
branches:
|
||
- 'master'
|
||
tags:
|
||
- 'v*.*.*'
|
||
pull_request:
|
||
merge_group:
|
||
types:
|
||
- checks_requested
|
||
workflow_dispatch:
|
||
inputs:
|
||
use_cache:
|
||
description: "Use build cache"
|
||
required: true
|
||
type: boolean
|
||
default: true
|
||
|
||
concurrency:
|
||
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
|
||
cancel-in-progress: true
|
||
|
||
jobs:
|
||
build:
|
||
uses: docker/github-builder/.github/workflows/build.yml@v1
|
||
# Exclude 'push' events on Merge Queue branches, as they are already
|
||
# handled by the 'merge_group' event.
|
||
if: (!(github.event_name == 'push' && startsWith(github.ref, 'refs/heads/gh-readonly-queue/')))
|
||
permissions:
|
||
contents: read
|
||
packages: write
|
||
id-token: write
|
||
attestations: write
|
||
with:
|
||
context: . # Use local checkout to support GitHub Merge Queue
|
||
output: image
|
||
platforms: linux/amd64,linux/arm64
|
||
push: ${{ github.event_name != 'pull_request' && github.event_name != 'merge_group' }}
|
||
cache: ${{ github.event_name != 'workflow_dispatch' || inputs.use_cache }}
|
||
# We don't sign the image because ghcr.io doesn't support OCI Referrers API yet, and the fallback relies on pushing new tags on each build
|
||
# https://github.com/docker/github-builder/issues/109#issuecomment-3885082486
|
||
# https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#backwards-compatibility
|
||
sign: false
|
||
sbom: true
|
||
meta-images: ghcr.io/${{ github.repository }}
|
||
meta-tags: |
|
||
type=ref,event=branch
|
||
type=ref,event=pr
|
||
type=semver,pattern={{raw}}
|
||
set-meta-annotations: true
|
||
set-meta-labels: true
|
||
labels: |
|
||
org.opencontainers.image.title=Oxipng
|
||
annotations: |
|
||
org.opencontainers.image.title=Oxipng
|
||
|
||
secrets:
|
||
registry-auths: |
|
||
- registry: ghcr.io
|
||
username: ${{ github.actor }}
|
||
password: ${{ secrets.GITHUB_TOKEN }}
|