Dev Image #162
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dev Image | |
| # | |
| # Publishes a single-arch dev image on every GREEN main build so a downstream | |
| # staging deployment can track main ahead of releases. Deliberately separate | |
| # from release.yml: it never touches `:latest`, the published Helm chart, or the | |
| # Homebrew/Scoop/Krew channels, and builds amd64-only from source (Dockerfile | |
| # `full` target) rather than promoting GoReleaser binaries. | |
| # | |
| # Tags pushed: | |
| # :dev mutable, always the newest green main build (what staging tracks) | |
| # :dev-<shortsha> immutable, per-commit handle for rollback / future promotion | |
| name: Dev Image | |
| on: | |
| workflow_run: | |
| workflows: ["CI"] | |
| types: [completed] | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| DOCKER_REPO: ghcr.io/skyhook-io/radar | |
| # Serialize dev builds so two runs can't race on the mutable :dev tag. | |
| concurrency: | |
| group: dev-image | |
| cancel-in-progress: false | |
| jobs: | |
| dev: | |
| # Only publish for a green CI run that came from a push to this repo's own | |
| # main branch. The repo/branch/event guards stop a fork PR (whose CI run | |
| # could carry a head branch named "main") from triggering a privileged build. | |
| if: >- | |
| github.event.workflow_run.conclusion == 'success' && | |
| github.event.workflow_run.event == 'push' && | |
| github.event.workflow_run.head_branch == 'main' && | |
| github.event.workflow_run.head_repository.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.event.workflow_run.head_sha }} | |
| - name: Compute sha | |
| id: sha | |
| run: echo "value=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT" | |
| - uses: docker/setup-buildx-action@v4 | |
| - uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push dev image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| target: full | |
| platforms: linux/amd64 | |
| push: true | |
| build-args: | | |
| VERSION=dev-${{ steps.sha.outputs.value }} | |
| tags: ${{ env.DOCKER_REPO }}:dev-${{ steps.sha.outputs.value }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Move :dev if this commit is still main's tip | |
| # Re-checked AFTER the build (not before): a newer commit landing during | |
| # the build must not be overwritten by this older run. Registry-side | |
| # retag of the just-pushed immutable tag, so no rebuild. | |
| run: | | |
| git fetch --quiet origin main | |
| if [ "$(git rev-parse HEAD)" = "$(git rev-parse FETCH_HEAD)" ]; then | |
| docker buildx imagetools create -t "${DOCKER_REPO}:dev" "${DOCKER_REPO}:dev-${{ steps.sha.outputs.value }}" | |
| else | |
| echo "::notice::superseded by a newer commit on main - leaving :dev unchanged" | |
| fi |