Skip to content

1.0.1

1.0.1 #13

name: "Build: Release Container"
on:
release:
types: [published]
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v4
- name: Set lower case image name
run: echo "IMAGE_NAME_LC=${REPO,,}" >> $GITHUB_ENV
env:
REPO: ${{ github.repository }}
- name: Extract version from tag
id: version
run: |
TAG="${GITHUB_REF_NAME#v}"
echo "app_version=$TAG" >> $GITHUB_OUTPUT
- name: Log in to GHCR
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build and push
uses: docker/build-push-action@v6
with:
context: .
file: build/Dockerfile
# Always re-resolve the base image instead of reusing whatever the runner or the GHA layer
# cache already has. The Dockerfile intentionally floats on the `8.0-*` tag so .NET runtime
# patches are picked up automatically — but that only works if the tag is actually
# re-resolved. Without this, a patched runtime (e.g. 8.0.28 -> 8.0.29, six High CVEs) can sit
# unapplied in published images while every project-level dependency scans clean.
pull: true
push: true
cache-from: type=gha
cache-to: type=gha,mode=max
build-args: |
APP_VERSION=${{ steps.version.outputs.app_version }}
COMMIT_SHA=${{ github.sha }}
IMAGE_TAG=latest
DOTNET_REGISTRY=${{ vars.DOTNET_REGISTRY || 'ghcr.io/cyberdrain' }}
tags: |
${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:latest
${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:${{ steps.version.outputs.app_version }}
labels: |
org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
org.opencontainers.image.description=Craft - CyberDrain Runtime for Apps, Functions, Tasks
org.opencontainers.image.revision=${{ github.sha }}
org.opencontainers.image.version=${{ steps.version.outputs.app_version }}