ff1e128f0e
e978d3c switched the publish trigger from `push` to `workflow_run` and
correctly migrated the `type=raw,value=latest` rule to read the upstream
head_branch from `github.event.workflow_run.*` — but left the
`type=semver,pattern={{raw}}` rule unchanged. That rule still reads
`github.ref`, which under workflow_run dispatch is always
`refs/heads/main` (the default branch where the workflow file lives),
not the triggering tag ref. As a result, no semver tag was extracted,
metadata-action produced no tags, and `buildx` failed with
"tag is needed when pushing to registry". The `latest` tag kept
publishing because its rule was migrated; versioned tags (v1.19.0,
v1.19.1) silently stopped publishing.
Pass the upstream head_branch to the semver rule explicitly via `value`,
gated by `enable` so it only fires for v* tags. Mirrors the migration
the raw rule already received.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
126 lines
3.9 KiB
YAML
126 lines
3.9 KiB
YAML
name: Publish
|
|
on:
|
|
workflow_run:
|
|
workflows: [ "CI" ]
|
|
types: [ "completed" ]
|
|
permissions:
|
|
contents: read
|
|
concurrency:
|
|
group: publish-${{ github.event.workflow_run.id || github.ref }}
|
|
cancel-in-progress: false
|
|
jobs:
|
|
docker-clean-metadata:
|
|
if: |
|
|
github.event.workflow_run.conclusion == 'success' &&
|
|
github.event.workflow_run.event == 'push' &&
|
|
(
|
|
github.event.workflow_run.head_branch == 'main' ||
|
|
startsWith(github.event.workflow_run.head_branch || '', 'v')
|
|
)
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
json: ${{ steps.meta.outputs.json }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ github.event.workflow_run.head_sha }}
|
|
fetch-depth: 0
|
|
- name: Extract metadata (tags, labels) for Docker
|
|
id: meta
|
|
uses: docker/metadata-action@v6
|
|
with:
|
|
images: |
|
|
ghcr.io/${{ github.repository }}
|
|
tags: |
|
|
type=raw,value=latest,enable=${{ github.event.workflow_run.head_branch == 'main' }}
|
|
type=semver,pattern={{raw}},value=${{ github.event.workflow_run.head_branch }},enable=${{ startsWith(github.event.workflow_run.head_branch || '', 'v') }}
|
|
|
|
docker-build:
|
|
if: |
|
|
github.event.workflow_run.conclusion == 'success' &&
|
|
github.event.workflow_run.event == 'push' &&
|
|
(
|
|
github.event.workflow_run.head_branch == 'main' ||
|
|
startsWith(github.event.workflow_run.head_branch || '', 'v')
|
|
)
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- os: self-hosted
|
|
arch: amd64
|
|
- os: ubuntu-24.04-arm
|
|
arch: arm64
|
|
|
|
runs-on: ${{ matrix.os }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ github.event.workflow_run.head_sha }}
|
|
fetch-depth: 0
|
|
- name: Log in to the GitHub Container registry
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Extract metadata (tags, labels) for Docker
|
|
id: meta
|
|
uses: docker/metadata-action@v6
|
|
with:
|
|
tags: |
|
|
type=raw,value=latest,enable=${{ github.event.workflow_run.head_branch == 'main' }}
|
|
type=semver,pattern={{raw}},value=${{ github.event.workflow_run.head_branch }},enable=${{ startsWith(github.event.workflow_run.head_branch || '', 'v') }}
|
|
flavor: |
|
|
latest=auto
|
|
suffix=-${{ matrix.arch }},onlatest=true
|
|
images: |
|
|
ghcr.io/${{ github.repository }}
|
|
|
|
- name: Build and push Docker images
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
|
|
docker-manifest:
|
|
if: |
|
|
github.event.workflow_run.conclusion == 'success' &&
|
|
github.event.workflow_run.event == 'push' &&
|
|
(
|
|
github.event.workflow_run.head_branch == 'main' ||
|
|
startsWith(github.event.workflow_run.head_branch || '', 'v')
|
|
)
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
needs:
|
|
- docker-build
|
|
- docker-clean-metadata
|
|
runs-on: ubuntu-latest
|
|
|
|
strategy:
|
|
matrix:
|
|
image: ${{ fromJson(needs.docker-clean-metadata.outputs.json).tags }}
|
|
|
|
steps:
|
|
- name: Log in to the GitHub Container registry
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Create and push manifest
|
|
run: |
|
|
docker manifest create ${{ matrix.image }} ${{ matrix.image }}-amd64 ${{ matrix.image }}-arm64
|
|
docker manifest push ${{ matrix.image }}
|