Build & Push — Frontend (vault-nginx) #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & Push — Frontend (vault-nginx) | |
| on: | |
| # Trigger 1: manual run with a custom tag | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'Image tag to use (e.g. v1.0.0 or hotfix-ui)' | |
| required: true | |
| type: string | |
| # Trigger 2 + 3 combined under one push block (YAML does not allow duplicate keys) | |
| # - when a git tag v* is pushed → image tag = git tag name | |
| # - when frontend/nginx files change on main → image tag = first 7 chars of commit SHA | |
| # Note: paths filter applies to branch pushes only, not tag pushes | |
| push: | |
| branches: [main] | |
| tags: | |
| - 'v*' | |
| paths: | |
| - 'vault/frontend/**' | |
| - 'vault/nginx/**' | |
| # Required permissions for pushing to GitHub Container Registry | |
| permissions: | |
| contents: read | |
| packages: write | |
| jobs: | |
| build-and-push: | |
| name: Build and push vault-nginx image | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Step 1: Clone the repository onto the runner | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| # Step 2: Determine the image tag based on how this workflow was triggered | |
| - name: Determine image tag | |
| id: tag | |
| run: | | |
| if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| # Manual trigger: use the tag the user typed in | |
| TAG="${{ github.event.inputs.tag }}" | |
| elif [ "${{ github.ref_type }}" = "tag" ]; then | |
| # Git tag push: use the tag name (e.g. v1.0.0) | |
| TAG="${{ github.ref_name }}" | |
| else | |
| # Branch push: use first 7 characters of commit SHA (e.g. abc1234) | |
| TAG="${{ github.sha }}" | |
| TAG="${TAG:0:7}" | |
| fi | |
| echo "tag=${TAG}" >> $GITHUB_OUTPUT | |
| echo "Image will be tagged as: ${TAG}" | |
| # Step 3: Lowercase the repository owner | |
| - name: Set lowercase owner | |
| id: owner | |
| run: echo "value=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT | |
| # Step 4: Log into GitHub Container Registry | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Step 5: Set up Docker Buildx | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # Step 6: Build the frontend image and push to GHCR | |
| # context must be ./vault (parent of both frontend/ and nginx/) | |
| # because the Dockerfile copies from both directories | |
| - name: Build and push | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: ./vault | |
| file: ./vault/nginx/Dockerfile | |
| push: true | |
| tags: | | |
| ghcr.io/${{ steps.owner.outputs.value }}/vault-nginx:${{ steps.tag.outputs.tag }} | |
| ghcr.io/${{ steps.owner.outputs.value }}/vault-nginx:latest | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # Step 7: Print a summary | |
| - name: Print image details | |
| run: | | |
| echo "✅ Image pushed successfully" | |
| echo "📦 ghcr.io/${{ steps.owner.outputs.value }}/vault-nginx:${{ steps.tag.outputs.tag }}" | |
| echo "📦 ghcr.io/${{ steps.owner.outputs.value }}/vault-nginx:latest" |