Fox's Git Mirrors
.github/workflows/publish-oci.yml HEAD (ed7be254) Text, 3.76 KB
name: Publish OCI Armory
on:
workflow_dispatch:
inputs:
registry:
description: OCI registry namespace
required: true
default: ghcr.io/styrene-lab/omegon-armory
dry_run:
description: Build artifacts without pushing
required: true
default: "false"
type: choice
options:
- "false"
- "true"
push:
branches: [main]
paths:
- catalog/**
- catalog-registry.toml
- personas/**
- skills/**
- tones/**
- scripts/build-oci-artifacts.py
- scripts/publish-oci-artifacts.py
- .github/workflows/publish-oci.yml
permissions:
contents: read
packages: write
id-token: write
jobs:
publish:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- name: Set registry
id: registry
run: |
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
echo "value=${{ inputs.registry }}" >> "$GITHUB_OUTPUT"
echo "dry_run=${{ inputs.dry_run }}" >> "$GITHUB_OUTPUT"
else
echo "value=ghcr.io/styrene-lab/omegon-armory" >> "$GITHUB_OUTPUT"
echo "dry_run=false" >> "$GITHUB_OUTPUT"
fi
- uses: oras-project/setup-oras@v1
- uses: sigstore/cosign-installer@v3
- name: Build OCI payloads and index
run: |
python3 scripts/build-oci-artifacts.py \\
--registry "${{ steps.registry.outputs.value }}" \\
--out dist/oci
- name: Upload build output
uses: actions/upload-artifact@v4
with:
name: armory-oci-dist
path: dist/oci
- name: Login to GHCR
if: steps.registry.outputs.dry_run != 'true' && startsWith(steps.registry.outputs.value, 'ghcr.io/')
run: |
echo "${{ secrets.GITHUB_TOKEN }}" \\
| oras login ghcr.io \\
--username "${{ github.actor }}" \\
--password-stdin
- name: Publish OCI artifacts
if: steps.registry.outputs.dry_run != 'true'
run: |
python3 scripts/publish-oci-artifacts.py \\
--out dist/oci \\
--sign
- name: Smoke published OCI index
if: steps.registry.outputs.dry_run != 'true'
run: |
REGISTRY="${{ steps.registry.outputs.value }}"
oras manifest fetch "$REGISTRY/index:latest" >/tmp/armory-index-manifest.json
rm -rf /tmp/armory-index-smoke
mkdir -p /tmp/armory-index-smoke
oras pull "$REGISTRY/index:latest" --output /tmp/armory-index-smoke
INDEX_TARBALL="$(find /tmp/armory-index-smoke -name armory-index.tar.gz -print -quit)"
test -n "$INDEX_TARBALL"
tar -tzf "$INDEX_TARBALL" | grep -qx 'index.json'
- name: Smoke representative published artifacts
if: steps.registry.outputs.dry_run != 'true'
run: |
python3 - <<'PY'
import json
import os
import subprocess
index = json.load(open('dist/oci/index.json'))
seen = set()
refs = []
for item in index['items']:
kind = item['kind']
if kind in seen:
continue
seen.add(kind)
refs.append(item['ref'])
for ref in refs:
print(f'+ oras manifest fetch {ref}')
subprocess.run(['oras', 'manifest', 'fetch', ref], check=True, stdout=subprocess.DEVNULL)
PY
- name: Dry run publish commands
if: steps.registry.outputs.dry_run == 'true'
run: |
python3 scripts/publish-oci-artifacts.py \\
--out dist/oci \\
--dry-run \\
--sign
Served by rngit 1.5.2 - Generated in 0.02s