graham.systems
An OIDC-protected index page for your homeserver.
1name: Build and publish container image
2
3on:
4 release:
5 types:
6 - published
7
8env:
9 REGISTRY: ghcr.io
10 IMAGE_NAME: ${{ github.repository }}
11
12jobs:
13 build-and-push-image:
14 runs-on: ubuntu-latest
15
16 permissions:
17 contents: read
18 packages: write
19 attestations: write
20 id-token: write
21
22 steps:
23 - name: Checkout repository
24 uses: actions/checkout@v4
25
26 - name: Authenticate with Container registry
27 uses: docker/login-action@v3
28 with:
29 registry: ${{ env.REGISTRY }}
30 username: ${{ github.actor }}
31 password: ${{ secrets.GITHUB_TOKEN }}
32
33 - name: Extract metadata for Docker
34 id: meta
35 uses: docker/metadata-action@v5
36 with:
37 images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
38
39 - name: Build and Push Docker image
40 id: push
41 uses: docker/build-push-action@v6
42 with:
43 context: .
44 push: true
45 tags: ${{ steps.meta.outputs.tags }}
46 labels: ${{ steps.meta.outputs.labels }}
47
48 - name: Generate artifact attestation
49 uses: actions/attest-build-provenance@v2
50 with:
51 subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
52 subject-digest: ${{ steps.push.outputs.digest }}
53 push-to-registry: true