f1238a9b2e
Some checks failed
Build and Push Docker / build (push) Failing after 25s
- 将docker登录的用户名从固定字符串改为使用secret管理 - 将docker登录的密码从固定GITEA_TOKEN改为使用专用密码secret - 提高了CI/CD流程中docker登录步骤的安全性和灵活性
79 lines
2.4 KiB
YAML
79 lines
2.4 KiB
YAML
name: Build and Push Docker
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags:
|
|
- "v*"
|
|
env:
|
|
REGISTRY: 192.168.100.120:8418
|
|
IMAGE_NAME: fengling/fengling-console
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Configure Docker for insecure registry
|
|
run: |
|
|
mkdir -p /etc/docker
|
|
cat > /etc/docker/daemon.json << 'EOF'
|
|
{
|
|
"insecure-registries": ["192.168.100.120:8418"]
|
|
}
|
|
EOF
|
|
pkill -HUP dockerd || true
|
|
sleep 3
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
with:
|
|
driver: docker-container
|
|
driver-opts: image=moby/buildkit:latest
|
|
buildkitd-flags: --allow-insecure-entitlement security.insecure
|
|
- name: Cache Docker layers
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: /tmp/.buildx-cache
|
|
key: ${{ runner.os }}-buildx-${{ github.sha }}
|
|
restore-keys: |
|
|
${{ runner.os }}-buildx-
|
|
- name: Extract version
|
|
id: version
|
|
run: |
|
|
VERSION=${{ github.ref_name }}
|
|
if [[ $VERSION == v* ]]; then
|
|
VERSION=${VERSION#v}
|
|
fi
|
|
echo "version=$VERSION" >> $GITHUB_OUTPUT
|
|
- name: Login to Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ secrets.USERNAME }}
|
|
password: ${{ secrets.PASSWORD }}
|
|
- name: Extract metadata
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
|
tags: |
|
|
type=ref,event=branch
|
|
type=sha,prefix=
|
|
type=raw,value=latest,enable={{is_default_branch}}
|
|
type=raw,value=${{ steps.version.outputs.version }}
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
file: src/Dockerfile
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
BUILD_VERSION=${{ steps.version.outputs.version }}
|
|
cache-from: type=local,src=/tmp/.buildx-cache
|
|
cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
|
|
provenance: false
|
|
- name: Move cache
|
|
if: always()
|
|
run: |
|
|
rm -rf /tmp/.buildx-cache
|
|
mv /tmp/.buildx-cache-new /tmp/.buildx-cache |