ahp
77748bcba2
build-and-push / build (push) Canceled after 55s
Use an explicit Gitea token (write:package scope) instead of the built-in job token for docker login.
84 lines
3.2 KiB
YAML
84 lines
3.2 KiB
YAML
name: build-and-push
|
|
|
|
# On a version tag push (v*), build both images and publish them to the
|
|
# Gitea container registry. Argo CD then rolls them out via
|
|
# deploy/helm/pargar (values-apollo.yaml pins the matching image tags).
|
|
#
|
|
# Requires a registered Gitea Actions runner, a `REGISTRY_TOKEN` secret
|
|
# (Gitea access token with write:package scope) so docker login can push to
|
|
# the registry.
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
env:
|
|
REGISTRY: src.panahifar.ir
|
|
BACKEND_IMAGE: ahp/pargar-backend
|
|
FRONTEND_IMAGE: ahp/pargar-frontend
|
|
# Single credential location shared by login + build steps (the job runs
|
|
# in a container whose HOME can differ between steps).
|
|
DOCKER_CONFIG: /tmp/.docker
|
|
|
|
jobs:
|
|
build:
|
|
# Gitea runners match on their registered labels (default: linux-amd64)
|
|
runs-on: linux-amd64
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Image tag (strip leading v)
|
|
id: meta
|
|
run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
|
|
|
|
# The job container (node:20-bookworm) ships no docker CLI, and builds
|
|
# run against the runner host's daemon (docker-outside-of-docker), so
|
|
# the socket must be mounted by the runner config.
|
|
- name: Set up Docker CLI (not shipped in job container)
|
|
run: |
|
|
set -eu
|
|
if [ ! -S /var/run/docker.sock ]; then
|
|
echo "::error::/var/run/docker.sock is not mounted in the job container - add 'options: -v /var/run/docker.sock:/var/run/docker.sock' and 'valid_volumes: [/var/run/docker.sock]' under 'container:' in the act_runner config.yaml, then restart the runner."
|
|
exit 1
|
|
fi
|
|
curl -fsSL "https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz" | tar xz --strip-components=1 -C /usr/local/bin docker/docker
|
|
mkdir -p /root/.docker/cli-plugins
|
|
curl -fsSL "https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64" -o /root/.docker/cli-plugins/docker-buildx
|
|
chmod +x /root/.docker/cli-plugins/docker-buildx
|
|
docker version
|
|
|
|
- name: Login to Gitea container registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
- name: Build and push backend
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: ./backend
|
|
push: true
|
|
tags: |
|
|
${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:${{ steps.meta.outputs.version }}
|
|
${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:latest
|
|
|
|
- name: Build and push frontend
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: ./frontend
|
|
push: true
|
|
# Empty = same-origin API/WS through the Traefik reverse proxy
|
|
# (the production topology). Override via repo variables if needed.
|
|
build-args: |
|
|
NEXT_PUBLIC_API_URL=${{ vars.NEXT_PUBLIC_API_URL }}
|
|
NEXT_PUBLIC_WS_URL=${{ vars.NEXT_PUBLIC_WS_URL }}
|
|
tags: |
|
|
${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:${{ steps.meta.outputs.version }}
|
|
${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:latest
|