chore(deps): update dependency vite (8.2.1 → 8.2.2) #166
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json | |
| # | |
| # Build the domarinn container and publish it to GHCR. | |
| # | |
| # The heavy lifting (per-platform runner split, manifest-list merge, SBOM | |
| # attestation, cosign signing, cache wiring) is delegated to Docker's own | |
| # reusable build workflow rather than hand-rolled here. Its default `runner` | |
| # mapping already sends linux/arm64 legs to ubuntu-24.04-arm, so multi-arch is | |
| # a platform list rather than a matrix plus a digest-shuffling merge job. | |
| # | |
| # Tags: `rolling` tracks main; a published release produces semver tags | |
| # (1.2.3, 1.2, 1). There is deliberately no `latest` — pin a version or track | |
| # `rolling`, but do not let an unpinned tag silently jump a major. | |
| # | |
| # Auth is the built-in GITHUB_TOKEN: GHCR accepts it, so this workflow needs | |
| # no registry secrets at all. | |
| name: Docker | |
| on: | |
| push: | |
| branches: [main] | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| concurrency: | |
| group: docker-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name != 'release' }} | |
| jobs: | |
| image: | |
| name: Build and push | |
| permissions: | |
| contents: read | |
| # id-token lets the reusable workflow mint an OIDC token for keyless | |
| # cosign signing; packages is what actually authorises the GHCR push. | |
| id-token: write | |
| packages: write | |
| uses: docker/github-builder/.github/workflows/build.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| output: image | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| sbom: true | |
| sign: "true" | |
| cache: true | |
| cache-scope: domarinn | |
| cache-mode: max | |
| # Lowercase literal, not ghcr.io/${{ github.repository }}: GHCR rejects | |
| # uppercase path segments and the org name is mixed-case. | |
| meta-images: ghcr.io/atviksecurity/domarinn | |
| meta-flavor: latest=false | |
| meta-tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=raw,value=rolling,enable={{is_default_branch}} | |
| meta-labels: | | |
| org.opencontainers.image.vendor=Atvik Security | |
| set-meta-labels: true | |
| set-meta-annotations: true | |
| secrets: | |
| registry-auths: | | |
| - registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} |