chore: Bump version to 0.24.0 #37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - 'docs/**' | |
| - 'mkdocs.yml' | |
| - '.github/workflows/docs.yml' | |
| - '**.md' | |
| release: | |
| types: [published] | |
| pull_request: | |
| branches: [main] | |
| paths-ignore: | |
| - 'docs/**' | |
| - 'mkdocs.yml' | |
| - '.github/workflows/docs.yml' | |
| - '**.md' | |
| permissions: | |
| contents: read | |
| packages: write | |
| security-events: write | |
| jobs: | |
| docker: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Extract version and normalize repository name | |
| - name: Get version | |
| id: version | |
| run: | | |
| VERSION=$(grep '__version__' muc_one_up/version.py | cut -d'"' -f2) | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "📦 Version: $VERSION" | |
| - name: Set lowercase repository name | |
| id: repo | |
| run: | | |
| REPO_LC=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]') | |
| echo "repo_lc=$REPO_LC" >> $GITHUB_OUTPUT | |
| echo "📦 Repository (lowercase): $REPO_LC" | |
| # Docker setup | |
| - uses: docker/setup-buildx-action@v3 | |
| - uses: docker/login-action@v3 | |
| if: github.event_name != 'pull_request' | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Metadata | |
| - uses: docker/metadata-action@v5 | |
| id: meta | |
| with: | |
| images: ghcr.io/${{ steps.repo.outputs.repo_lc }}/muconeup | |
| tags: | | |
| type=semver,pattern={{version}},value=${{ steps.version.outputs.version }} | |
| type=semver,pattern={{major}}.{{minor}},value=${{ steps.version.outputs.version }} | |
| type=edge,branch=main | |
| type=ref,event=pr | |
| type=raw,value=latest,enable=${{ github.event_name == 'release' }} | |
| # Build | |
| - uses: docker/build-push-action@v6 | |
| id: build | |
| with: | |
| context: . | |
| file: docker/Dockerfile | |
| platforms: linux/amd64 | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # Security scan - Report vulnerabilities without failing build | |
| # Vulnerabilities are visible in GitHub Security tab | |
| # Note: ignore-unfixed=true excludes unfixable base image vulnerabilities | |
| - name: Run Trivy security scan | |
| uses: aquasecurity/trivy-action@0.30.0 | |
| if: github.event_name != 'pull_request' | |
| with: | |
| image-ref: ghcr.io/${{ steps.repo.outputs.repo_lc }}/muconeup:${{ steps.version.outputs.version }} | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| ignore-unfixed: true # Ignore vulnerabilities with no available fixes | |
| exit-code: 0 # Don't fail build, just report to Security tab | |
| - uses: github/codeql-action/upload-sarif@v3 | |
| if: always() && github.event_name != 'pull_request' | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| # Test | |
| - name: Test image | |
| if: github.event_name != 'pull_request' | |
| run: | | |
| docker run --rm ghcr.io/${{ steps.repo.outputs.repo_lc }}/muconeup:${{ steps.version.outputs.version }} --version |