ci: fork-friendly GHCR Docker release workflow (#4) #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release with Docker image to GHCR | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v**" | |
| permissions: | |
| contents: read | |
| jobs: | |
| verify: | |
| name: Verify release should continue | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| outputs: | |
| continue: ${{ steps.verify_branch.outputs.continue }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Verify ref points to a commit on main branch | |
| id: verify_branch | |
| run: | | |
| REF_COMMIT=$(git rev-list -n 1 "$GITHUB_REF") | |
| echo "Ref commit: $REF_COMMIT" | |
| git fetch origin main | |
| MAIN_COMMIT=$(git rev-parse origin/main) | |
| echo "Main commit: $MAIN_COMMIT" | |
| if git merge-base --is-ancestor "$REF_COMMIT" "$MAIN_COMMIT"; then | |
| echo "continue=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "continue=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Stop if ref is not on main branch | |
| if: steps.verify_branch.outputs.continue != 'true' | |
| run: | | |
| echo "Ref commit is not on main branch, skipping release." | |
| exit 0 | |
| build-server-core: | |
| name: Build and push server-core | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| needs: verify | |
| if: needs.verify.outputs.continue == 'true' | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - name: Use Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version-file: ".node-version" | |
| - uses: ./.github/actions/setup-meteor | |
| - name: Prepare Environment | |
| run: | | |
| corepack enable | |
| yarn install | |
| yarn meteor lint | |
| - name: Build libs | |
| run: yarn build:packages | |
| - name: Build webui | |
| run: | | |
| cd packages/webui | |
| yarn build | |
| - name: Persist Built Version information | |
| run: | | |
| cd meteor | |
| yarn inject-git-hash | |
| - name: Prepare webui for meteor build | |
| run: | | |
| rm -Rf meteor/public | |
| cp -R packages/webui/dist meteor/public | |
| - name: Meteor Build | |
| run: | | |
| cd meteor | |
| NODE_OPTIONS="--max-old-space-size=4096" METEOR_DEBUG_BUILD=1 meteor build --allow-superuser --directory . | |
| mv bundle/programs/web.browser/assets/ bundle/programs/web.browser/app/assets/ || true | |
| - name: Meteor Bundle NPM Build | |
| run: | | |
| cd meteor/bundle/programs/server | |
| meteor npm install | |
| - name: Lowercase repository name for GHCR | |
| run: echo "REPO=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV" | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Get the Docker tag for GHCR | |
| id: ghcr-tag | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: | | |
| ghcr.io/${{ env.REPO }}-server-core | |
| tags: | | |
| type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} | |
| type=raw,value=build-${{ github.run_number }},enable=${{ github.ref == 'refs/heads/main' }} | |
| type=ref,event=tag | |
| - name: Note main build tags | |
| if: github.ref == 'refs/heads/main' | |
| run: | | |
| echo "**Main build published**" >> "$GITHUB_STEP_SUMMARY" | |
| echo "- \`ghcr.io/${{ env.REPO }}-server-core:latest\`" >> "$GITHUB_STEP_SUMMARY" | |
| echo "- \`ghcr.io/${{ env.REPO }}-server-core:build-${{ github.run_number }}\`" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Log in to GitHub Container Registry | |
| if: steps.ghcr-tag.outputs.tags != '' | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push Docker image to GHCR | |
| if: steps.ghcr-tag.outputs.tags != '' | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: ./meteor/Dockerfile.circle | |
| push: true | |
| provenance: false | |
| labels: ${{ steps.ghcr-tag.outputs.labels }} | |
| tags: ${{ steps.ghcr-tag.outputs.tags }} | |
| github-token: ${{ github.token }} | |
| build-gateways: | |
| name: Build and push ${{ matrix.gateway-name }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| needs: verify | |
| if: needs.verify.outputs.continue == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| gateway-name: [playout-gateway, mos-gateway, live-status-gateway] | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - name: Use Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version-file: ".node-version" | |
| - name: Build | |
| run: | | |
| corepack enable | |
| cd packages | |
| yarn install | |
| yarn build:single ${{ matrix.gateway-name }}/tsconfig.build.json | |
| yarn run pinst --disable | |
| yarn workspaces focus ${{ matrix.gateway-name }} --production | |
| - name: Lowercase repository name for GHCR | |
| run: echo "REPO=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV" | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Get the Docker tag for GHCR | |
| id: ghcr-tag | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: | | |
| ghcr.io/${{ env.REPO }}-${{ matrix.gateway-name }} | |
| tags: | | |
| type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} | |
| type=raw,value=build-${{ github.run_number }},enable=${{ github.ref == 'refs/heads/main' }} | |
| type=ref,event=tag | |
| - name: Log in to GitHub Container Registry | |
| if: steps.ghcr-tag.outputs.tags != '' | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push Docker image to GHCR | |
| if: steps.ghcr-tag.outputs.tags != '' | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: ./packages | |
| file: ./packages/${{ matrix.gateway-name }}/Dockerfile.circle | |
| push: true | |
| provenance: false | |
| labels: ${{ steps.ghcr-tag.outputs.labels }} | |
| tags: ${{ steps.ghcr-tag.outputs.tags }} | |
| github-token: ${{ github.token }} | |
| release: | |
| name: Create GitHub Release | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| needs: | |
| - verify | |
| - build-server-core | |
| - build-gateways | |
| if: needs.verify.outputs.continue == 'true' && startsWith(github.ref, 'refs/tags/') | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Lowercase repository name for GHCR | |
| run: echo "REPO=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV" | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| name: Release ${{ github.ref_name }} | |
| body: | | |
| Docker images pushed to GHCR: | |
| ```bash | |
| docker pull ghcr.io/${{ env.REPO }}-server-core:${{ github.ref_name }} | |
| docker pull ghcr.io/${{ env.REPO }}-playout-gateway:${{ github.ref_name }} | |
| docker pull ghcr.io/${{ env.REPO }}-mos-gateway:${{ github.ref_name }} | |
| docker pull ghcr.io/${{ env.REPO }}-live-status-gateway:${{ github.ref_name }} | |
| ``` | |
| `latest` continues to track the most recent `main` build. |