Add SOPS for secrets encryption/decryption #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push Docker Images | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 13 * * 1" | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_BASE: ghcr.io/${{ github.repository }} | |
| IMAGE_TMUX: ghcr.io/${{ github.repository }}-tmux | |
| jobs: | |
| build: | |
| permissions: | |
| contents: read | |
| packages: write | |
| runs-on: ${{ matrix.runs-on }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runs-on: ubuntu-latest | |
| platform: linux/amd64 | |
| - runs-on: ubuntu-24.04-arm | |
| platform: linux/arm64 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Prepare | |
| run: | | |
| platform=${{ matrix.platform }} | |
| echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV | |
| - name: Docker meta (base) | |
| id: meta-base | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE_BASE }} | |
| - name: Docker meta (tmux) | |
| id: meta-tmux | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE_TMUX }} | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build and push base image (digest) | |
| id: build-base | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| target: base | |
| platforms: ${{ matrix.platform }} | |
| labels: ${{ steps.meta-base.outputs.labels }} | |
| tags: ${{ env.IMAGE_BASE }} | |
| outputs: type=image,push-by-digest=true,name-canonical=true,push=true | |
| - name: Build and push tmux image (digest) | |
| id: build-tmux | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| target: tmux | |
| platforms: ${{ matrix.platform }} | |
| labels: ${{ steps.meta-tmux.outputs.labels }} | |
| tags: ${{ env.IMAGE_TMUX }} | |
| outputs: type=image,push-by-digest=true,name-canonical=true,push=true | |
| - name: Export digests | |
| run: | | |
| mkdir -p ${{ runner.temp }}/digests/base | |
| mkdir -p ${{ runner.temp }}/digests/tmux | |
| digest_base="${{ steps.build-base.outputs.digest }}" | |
| digest_tmux="${{ steps.build-tmux.outputs.digest }}" | |
| touch "${{ runner.temp }}/digests/base/${digest_base#sha256:}" | |
| touch "${{ runner.temp }}/digests/tmux/${digest_tmux#sha256:}" | |
| - name: Upload base digest | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: digests-base-${{ env.PLATFORM_PAIR }} | |
| path: ${{ runner.temp }}/digests/base/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| - name: Upload tmux digest | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: digests-tmux-${{ env.PLATFORM_PAIR }} | |
| path: ${{ runner.temp }}/digests/tmux/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| merge: | |
| permissions: | |
| contents: read | |
| packages: write | |
| runs-on: ubuntu-latest | |
| needs: | |
| - build | |
| steps: | |
| - name: Download base digests | |
| uses: actions/download-artifact@v7 | |
| with: | |
| path: ${{ runner.temp }}/digests/base | |
| pattern: digests-base-* | |
| merge-multiple: true | |
| - name: Download tmux digests | |
| uses: actions/download-artifact@v7 | |
| with: | |
| path: ${{ runner.temp }}/digests/tmux | |
| pattern: digests-tmux-* | |
| merge-multiple: true | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Docker meta (base) | |
| id: meta-base | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE_BASE }} | |
| tags: | | |
| type=raw,value=latest,enable=true | |
| - name: Docker meta (tmux) | |
| id: meta-tmux | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE_TMUX }} | |
| tags: | | |
| type=raw,value=latest,enable=true | |
| - name: Create base manifest | |
| working-directory: ${{ runner.temp }}/digests/base | |
| run: | | |
| docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | |
| $(printf '${{ env.IMAGE_BASE }}@sha256:%s ' *) | |
| - name: Create tmux manifest | |
| working-directory: ${{ runner.temp }}/digests/tmux | |
| run: | | |
| docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | |
| $(printf '${{ env.IMAGE_TMUX }}@sha256:%s ' *) |