Build & Push — Backend (vault-api) #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & Push — Backend (vault-api) | |
| on: | |
| # Trigger 1: manual run with a custom tag | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'Image tag to use (e.g. v1.0.0 or hotfix-login)' | |
| required: true | |
| type: string | |
| # Trigger 2 + 3 combined under one push block (YAML does not allow duplicate keys) | |
| # - when a git tag v* is pushed → image tag = git tag name | |
| # - when backend files change on main → image tag = first 7 chars of commit SHA | |
| # Note: paths filter applies to branch pushes only, not tag pushes | |
| push: | |
| branches: [main] | |
| tags: | |
| - 'v*' | |
| paths: | |
| - 'vault/backend/**' | |
| # Required permissions for pushing to GitHub Container Registry | |
| permissions: | |
| contents: read | |
| packages: write | |
| jobs: | |
| build-and-push: | |
| name: Build and push vault-api image | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Step 1: Clone the repository onto the runner | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| # Step 2: Determine the image tag based on how this workflow was triggered | |
| - name: Determine image tag | |
| id: tag | |
| run: | | |
| if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| # Manual trigger: use the tag the user typed in | |
| TAG="${{ github.event.inputs.tag }}" | |
| elif [ "${{ github.ref_type }}" = "tag" ]; then | |
| # Git tag push: use the tag name (e.g. v1.0.0) | |
| TAG="${{ github.ref_name }}" | |
| else | |
| # Branch push: use first 7 characters of commit SHA (e.g. abc1234) | |
| TAG="${{ github.sha }}" | |
| TAG="${TAG:0:7}" | |
| fi | |
| echo "tag=${TAG}" >> $GITHUB_OUTPUT | |
| echo "Image will be tagged as: ${TAG}" | |
| # Step 3: Log into GitHub Container Registry | |
| # GITHUB_TOKEN is automatic — GitHub creates it for every workflow run | |
| # It has permission to push packages for this repo without any manual setup | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Step 4: Set up Docker Buildx (enables multi-platform builds + better caching) | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # Step 5: Build the backend Docker image and push to GHCR | |
| # context: the directory sent to Docker as the build context | |
| # tags: we push two tags — the specific version tag + "latest" | |
| - name: Build and push | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: ./vault/backend | |
| file: ./vault/backend/Dockerfile | |
| push: true | |
| tags: | | |
| ghcr.io/${{ github.repository_owner }}/vault-api:${{ steps.tag.outputs.tag }} | |
| ghcr.io/${{ github.repository_owner }}/vault-api:latest | |
| # Cache layers from the previous build to speed up future builds | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # Step 6: Print a summary so it's easy to see what was pushed | |
| - name: Print image details | |
| run: | | |
| echo "✅ Image pushed successfully" | |
| echo "📦 ghcr.io/${{ github.repository_owner }}/vault-api:${{ steps.tag.outputs.tag }}" | |
| echo "📦 ghcr.io/${{ github.repository_owner }}/vault-api:latest" |