Merge pull request #5606 from nodetool-ai/docs/readme-creative-onboar… #4648
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| on: | |
| push: | |
| # Build images for main and any `preview/**` branch. The metadata-action | |
| # step below tags non-tag refs as `{branch}-{shortsha}` (and `latest` only on | |
| # main). `pull_request` is intentionally not used to avoid duplicate builds | |
| # for in-repo PRs (which would fire both events). Fork PRs cannot push to | |
| # GHCR anyway, so the loss of fork preview images is not a regression. | |
| branches: | |
| - main | |
| - 'preview/**' | |
| tags: | |
| - 'v*.*.*' | |
| - 'v*.*.*-*' | |
| workflow_dispatch: | |
| # Cancel superseded runs for the same branch/tag, but never cancel a main or | |
| # release-tag build — those produce the images people deploy from. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/') }} | |
| jobs: | |
| docker-publish: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| permissions: | |
| contents: read | |
| packages: write | |
| # Required by docker/build-push-action for OCI provenance / SBOM | |
| # attestations pushed alongside the image to GHCR. | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Cache UV packages | |
| uses: actions/cache@v6 | |
| with: | |
| path: ~/.cache/uv | |
| key: uv-${{ runner.os }}-${{ hashFiles('**/pyproject.toml') }} | |
| restore-keys: | | |
| uv-${{ runner.os }}- | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 | |
| with: | |
| registry: ghcr.io | |
| # Use repository_owner instead of github.actor so the login identity | |
| # is stable regardless of which user triggered the push. The token | |
| # itself is what authorizes the push; username is informational. | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Compute short SHA | |
| id: vars | |
| run: echo "short_sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT" | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 | |
| with: | |
| images: | | |
| ghcr.io/nodetool-ai/nodetool | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=sha,prefix={{branch}}-,enable=${{ !startsWith(github.ref, 'refs/tags/') }} | |
| - name: Build and push | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: . | |
| platforms: linux/amd64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| USE_LOCAL_REPO=1 | |
| GIT_COMMIT_HASH=${{ steps.vars.outputs.short_sha }} | |
| BUILD_NUMBER=${{ github.run_number }} | |
| no-cache-filters: | | |
| pip-deps | |
| cache-from: type=registry,ref=ghcr.io/nodetool-ai/nodetool:buildcache | |
| cache-to: type=registry,ref=ghcr.io/nodetool-ai/nodetool:buildcache,mode=max | |
| # Disable provenance/SBOM attestations. They create extra manifest | |
| # entries that fail with "permission_denied: write_package" on first | |
| # push of a new GHCR package. Re-enable once the package exists and | |
| # the repository is linked under Package settings > Manage Actions | |
| # access. | |
| provenance: false | |
| sbom: false |