diff --git a/.github/workflows/create-nginx.yaml b/.github/workflows/create-nginx.yaml new file mode 100644 index 0000000..e6e22b3 --- /dev/null +++ b/.github/workflows/create-nginx.yaml @@ -0,0 +1,58 @@ +name: Create Nginx image + +on: + push: + branches: + - main + paths: + - 'docker/**/nginx/**' + +env: + REGISTRY: ghcr.io + IMAGE_NAME: 2martens/docker-nginx + +jobs: + create-nginx: + name: Build Nginx image + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + attestations: write + id-token: write + strategy: + matrix: + env: [ test ] + environment: ${{ matrix.env }} + steps: + - uses: actions/checkout@v4 + - name: Perform docker login + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + - name: Extract metadata (tags, labels) for Docker + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=raw,value=${{ matrix.env }} + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Build & push Nginx image to GHCR + id: push + uses: docker/build-push-action@v6 + with: + platforms: linux/amd64,linux/arm64 + context: docker/${{ matrix.env }}/nginx + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + - name: Attest + uses: actions/attest-build-provenance@v2 + id: attest + with: + subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + subject-digest: ${{ steps.push.outputs.digest }} diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml index 815ba71..2d19901 100644 --- a/.github/workflows/deploy.yaml +++ b/.github/workflows/deploy.yaml @@ -31,72 +31,11 @@ jobs: id: detect run: | echo "changed_envs=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep '^docker/' | cut -d/ -f2 | sort -u | tr '\n' ' ')" >> "$GITHUB_OUTPUT" - create-nginx: - name: Build Nginx image - runs-on: ubuntu-latest - needs: fact-finding - permissions: - contents: read - packages: write - attestations: write - id-token: write - strategy: - matrix: - env: [ test ] - environment: ${{ matrix.env }} - steps: - - uses: actions/checkout@v4 - - name: Exit if this environment wasn't changed - id: check - run: | - echo "Changed envs: '${{ needs.fact-finding.outputs.changed_envs }}'" - if [[ (${{ github.event_name }} == 'workflow_dispatch' && "${{ github.event.inputs.deploy }}" == 'true') || "${{ needs.fact-finding.outputs.changed_envs }}" =~ "${{ matrix.env }}" ]]; then - echo "should_deploy=true" >> $GITHUB_OUTPUT - else - echo "should_deploy=false" >> $GITHUB_OUTPUT - fi - shell: bash - - name: Perform docker login - if: steps.check.outputs.should_deploy == 'true' - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - name: Extract metadata (tags, labels) for Docker - id: meta - if: steps.check.outputs.should_deploy == 'true' - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - tags: | - type=raw,value=${{ matrix.env }} - - name: Set up Docker Buildx - if: steps.check.outputs.should_deploy == 'true' - uses: docker/setup-buildx-action@v3 - - name: Build & push Nginx image to GHCR - id: push - if: steps.check.outputs.should_deploy == 'true' - uses: docker/build-push-action@v6 - with: - platforms: linux/amd64,linux/arm64 - context: docker/${{ matrix.env }}/nginx - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - - name: Attest - if: steps.check.outputs.should_deploy == 'true' - uses: actions/attest-build-provenance@v2 - id: attest - with: - subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - subject-digest: ${{ steps.push.outputs.digest }} deploy: name: Deploy runs-on: ubuntu-latest needs: - fact-finding - - create-nginx strategy: matrix: env: [ test ]