--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
.github/workflows/docker.yml 60a4c6ab8b159c465c663848e8e75326d07430ee (60a4c6ab) Text, 10.09 KB
T8b949e# Build multi-arch image, push to GHCR, and keyless-sign the manifest (Cosign).
T8b949e# Optionally also push to Docker Hub when credentials are configured (fork-friendly).
T8b949e# Runs on push to main/master (tags :latest and :sha-*), dev (tags :dev and :sha-*),
T8b949e# tags (semver tags + :latest), and workflow_dispatch.
T8b949e#
T8b949e# Optional Docker Hub (same tag set as GHCR):
T8b949e# Repository secrets (both required to enable Hub push; omit either to skip):
T8b949e# DOCKERHUB_USERNAME Docker Hub user or org (e.g. quad4io).
T8b949e# DOCKERHUB_TOKEN Docker Hub access token (PAT) with push to the target repo.
T8b949e# Optional repository variable:
T8b949e# DOCKERHUB_REPOSITORY Image name under the user (default: meshchatx) -> docker.io/$user/$repo
T8b949e#
T8b949e# Pinned third-party actions (bump tag and SHA together when upgrading).
T8b949e# Automated check: first step resolves each tag via api.github.com and
T8b949e# compares to the commit below. Manual bump helpers (resolve annotated tags):
T8b949e#
T8b949e# curl -sSf -H "Accept: application/vnd.github+json" -H "Authorization: Bearer $GH_TOKEN" \
T8b949e# "https://api.github.com/repos/OWNER/REPO/git/refs/tags/TAG" | jq .
T8b949e# # if object.type is "tag", follow object.url and jq -r .object.sha
T8b949e#
T8b949e# Pinned refs:
T8b949e# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
T8b949e# docker/setup-qemu-action@v3.7.0 c7c53464625b32c7a7e944ae62b3e17d2b600130
T8b949e# docker/setup-buildx-action@v3.11.1 e468171a9de216ec08956ac3ada2f0791b6bd435
T8b949e# docker/login-action@v3.5.0 184bdaa0721073962dff0199f1fb9940f07167d1
T8b949e# docker/build-push-action@v6.18.0 263435318d21b8e681c14492fe198d362a7d2c83
T8b949e# sigstore/cosign-installer@v3.10.1 7e8b541eb2e61bf99390e1afd4be13a184e9ebc5
Tff7b72nameTb4b4b4: Ta5d6ffDockerTa5d6ff Ta5d6ff(GHCRTa5d6ff Ta5d6ff+Ta5d6ff Ta5d6ffDockerTa5d6ff Ta5d6ffHub)
Tff7b72onTb4b4b4:
Tff7b72workflow_dispatchTb4b4b4:
Tff7b72pushTb4b4b4:
Tff7b72branchesTb4b4b4:
Tb4b4b4- Ta5d6ffmain
Tb4b4b4- Ta5d6ffmaster
Tb4b4b4- Ta5d6ffdev
Tff7b72tagsTb4b4b4:
Tb4b4b4- Ta5d6ff"Ta5d6ff*Ta5d6ff"
Tff7b72permissionsTb4b4b4:
Tff7b72contentsTb4b4b4: Ta5d6ffread
Tff7b72packagesTb4b4b4: Ta5d6ffwrite
Tff7b72id-tokenTb4b4b4: Ta5d6ffwrite
Tff7b72concurrencyTb4b4b4:
Tff7b72groupTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.workflowTa5d6ff Ta5d6ff}}-${{Ta5d6ff Ta5d6ffgithub.refTa5d6ff Ta5d6ff}}
Tff7b72cancel-in-progressTb4b4b4: Ta5d6fftrue
Tff7b72envTb4b4b4:
Tff7b72REGISTRYTb4b4b4: Ta5d6ffghcr.io
Tff7b72jobsTb4b4b4:
Tff7b72buildTb4b4b4:
Tff7b72runs-onTb4b4b4: Ta5d6ffubuntu-latest
Tff7b72timeout-minutesTb4b4b4: Ta5d6ff120
Tff7b72strategyTb4b4b4:
Tff7b72fail-fastTb4b4b4: Ta5d6fffalse
Tff7b72matrixTb4b4b4:
Tff7b72includeTb4b4b4:
Tb4b4b4- Tff7b72variantTb4b4b4: Ta5d6ffstandard
Tff7b72dockerfileTb4b4b4: Ta5d6ff./Dockerfile
Tff7b72tag_suffixTb4b4b4: Ta5d6ff"Ta5d6ff"
Tb4b4b4- Tff7b72variantTb4b4b4: Ta5d6ffhardened
Tff7b72dockerfileTb4b4b4: Ta5d6ff./Dockerfile.hardened
Tff7b72tag_suffixTb4b4b4: Ta5d6ff"Ta5d6ff-hardenedTa5d6ff"
Tff7b72stepsTb4b4b4:
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffVerifyTa5d6ff Ta5d6ffactionTa5d6ff Ta5d6ffpinsTa5d6ff Ta5d6ff(GitHubTa5d6ff Ta5d6ffAPI)
Tff7b72envTb4b4b4:
Tff7b72GH_TOKENTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.tokenTa5d6ff Ta5d6ff}}
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72set -euo pipefail
Tff7b72hdr=(-H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${GH_TOKEN}")
Tff7b72api="https://api.github.com/repos"
Tff7b72resolve() {
Tff7b72local repo="$1" tag="$2" ref typ url
Tff7b72ref=$(curl -sSf "${hdr[@]}" "${api}/${repo}/git/refs/tags/${tag}")
Tff7b72typ=$(printf '%s' "$ref" | jq -r .object.type)
Tff7b72if [ "$typ" = "commit" ]; then
Tff7b72printf '%s' "$ref" | jq -r .object.sha
Tff7b72return
Tff7b72fi
Tff7b72url=$(printf '%s' "$ref" | jq -r .object.url)
Tff7b72curl -sSf "${hdr[@]}" "$url" | jq -r .object.sha
Tff7b72}
Tff7b72check() {
Tff7b72local repo="$1" tag="$2" want="$3" got
Tff7b72got=$(resolve "$repo" "$tag")
Tff7b72if [ "$got" != "$want" ]; then
Tff7b72printf 'Pin mismatch %s@%s: expected %s got %s\n' "$repo" "$tag" "$want" "$got" >&2
Tff7b72exit 1
Tff7b72fi
Tff7b72printf 'OK %s@%s -> %s\n' "$repo" "$tag" "$got"
Tff7b72}
Tff7b72check actions/checkout v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
Tff7b72check docker/setup-qemu-action v3.7.0 c7c53464625b32c7a7e944ae62b3e17d2b600130
Tff7b72check docker/setup-buildx-action v3.11.1 e468171a9de216ec08956ac3ada2f0791b6bd435
Tff7b72check docker/login-action v3.5.0 184bdaa0721073962dff0199f1fb9940f07167d1
Tff7b72check docker/build-push-action v6.18.0 263435318d21b8e681c14492fe198d362a7d2c83
Tff7b72check sigstore/cosign-installer v3.10.1 7e8b541eb2e61bf99390e1afd4be13a184e9ebc5
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffCheckout
Tff7b72usesTb4b4b4: Ta5d6ffactions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffOCITa5d6ff Ta5d6fflabelTa5d6ff Ta5d6fftimestampsTa5d6ff Ta5d6ffandTa5d6ff Ta5d6ffversion
Tff7b72idTb4b4b4: Ta5d6ffoci
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72set -euo pipefail
Tff7b72echo "created=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> "$GITHUB_OUTPUT"
Tff7b72if [ "${{ github.ref_type }}" = "tag" ]; then
Tff7b72echo "version=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
Tff7b72else
Tff7b72echo "version=sha-$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
Tff7b72fi
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffRegistryTa5d6ff Ta5d6ffimageTa5d6ff Ta5d6ff(GHCRTa5d6ff Ta5d6fflowercase)
Tff7b72idTb4b4b4: Ta5d6ffimage
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72set -euo pipefail
Tff7b72lower="$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')"
Tff7b72echo "name=${REGISTRY}/${lower}" >> "$GITHUB_OUTPUT"
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetTa5d6ff Ta5d6ffupTa5d6ff Ta5d6ffQEMU
Tff7b72usesTb4b4b4: Ta5d6ffdocker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetTa5d6ff Ta5d6ffupTa5d6ff Ta5d6ffDockerTa5d6ff Ta5d6ffBuildx
Tff7b72usesTb4b4b4: Ta5d6ffdocker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffLogTa5d6ff Ta5d6ffinTa5d6ff Ta5d6fftoTa5d6ff Ta5d6ffGHCR
Tff7b72usesTb4b4b4: Ta5d6ffdocker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
Tff7b72withTb4b4b4:
Tff7b72registryTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.REGISTRYTa5d6ff Ta5d6ff}}
Tff7b72usernameTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.actorTa5d6ff Ta5d6ff}}
Tff7b72passwordTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.tokenTa5d6ff Ta5d6ff}}
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffDetectTa5d6ff Ta5d6ffDockerTa5d6ff Ta5d6ffHubTa5d6ff Ta5d6ffcredentials
Tff7b72idTb4b4b4: Ta5d6ffdockerhub
Tff7b72envTb4b4b4:
Tff7b72DH_USERTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.DOCKERHUB_USERNAMETa5d6ff Ta5d6ff}}
Tff7b72DH_TOKENTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.DOCKERHUB_TOKENTa5d6ff Ta5d6ff}}
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72set -euo pipefail
Tff7b72if [ -n "${DH_USER}" ] && [ -n "${DH_TOKEN}" ]; then
Tff7b72echo "configured=true" >> "$GITHUB_OUTPUT"
Tff7b72else
Tff7b72echo "configured=false" >> "$GITHUB_OUTPUT"
Tff7b72fi
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffLogTa5d6ff Ta5d6ffinTa5d6ff Ta5d6fftoTa5d6ff Ta5d6ffDockerTa5d6ff Ta5d6ffHub
Tff7b72ifTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsteps.dockerhub.outputs.configuredTa5d6ff Ta5d6ff==Ta5d6ff Ta5d6ff'true'Ta5d6ff Ta5d6ff}}
Tff7b72usesTb4b4b4: Ta5d6ffdocker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
Tff7b72withTb4b4b4:
Tff7b72registryTb4b4b4: Ta5d6ffdocker.io
Tff7b72usernameTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.DOCKERHUB_USERNAMETa5d6ff Ta5d6ff}}
Tff7b72passwordTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.DOCKERHUB_TOKENTa5d6ff Ta5d6ff}}
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffGenerateTa5d6ff Ta5d6ffGHCRTa5d6ff Ta5d6fftags
Tff7b72idTb4b4b4: Ta5d6fftags
Tff7b72envTb4b4b4:
Tff7b72GITHUB_REFTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.refTa5d6ff Ta5d6ff}}
Tff7b72GITHUB_REF_NAMETb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.ref_nameTa5d6ff Ta5d6ff}}
Tff7b72TAG_SUFFIXTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffmatrix.tag_suffixTa5d6ff Ta5d6ff}}
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72set -euo pipefail
Tff7b72TAG_SUFFIX="${{ matrix.tag_suffix }}" sh scripts/ci/docker-tags.sh "${{ steps.image.outputs.name }}" /tmp/docker-tags.txt
Tff7b72{
Tff7b72echo 'tags<<EOF'
Tff7b72sed 's/^-t //' /tmp/docker-tags.txt
Tff7b72echo 'EOF'
Tff7b72} >> "$GITHUB_OUTPUT"
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffGenerateTa5d6ff Ta5d6ffDockerTa5d6ff Ta5d6ffHubTa5d6ff Ta5d6fftags
Tff7b72idTb4b4b4: Ta5d6ffdh_tags
Tff7b72ifTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsteps.dockerhub.outputs.configuredTa5d6ff Ta5d6ff==Ta5d6ff Ta5d6ff'true'Ta5d6ff Ta5d6ff}}
Tff7b72envTb4b4b4:
Tff7b72GITHUB_REFTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.refTa5d6ff Ta5d6ff}}
Tff7b72GITHUB_REF_NAMETb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.ref_nameTa5d6ff Ta5d6ff}}
Tff7b72DH_USERTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsecrets.DOCKERHUB_USERNAMETa5d6ff Ta5d6ff}}
Tff7b72DH_REPO_NAMETb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffvars.DOCKERHUB_REPOSITORYTa5d6ff Ta5d6ff}}
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72set -euo pipefail
Tff7b72repo="${DH_REPO_NAME:-meshchatx}"
Tff7b72base="docker.io/$(printf '%s' "$DH_USER" | tr '[:upper:]' '[:lower:]')/$(printf '%s' "$repo" | tr '[:upper:]' '[:lower:]')"
Tff7b72TAG_SUFFIX="${{ matrix.tag_suffix }}" sh scripts/ci/docker-tags.sh "${base}" /tmp/docker-hub-tags.txt
Tff7b72{
Tff7b72echo 'tags<<EOF'
Tff7b72sed 's/^-t //' /tmp/docker-hub-tags.txt
Tff7b72echo 'EOF'
Tff7b72} >> "$GITHUB_OUTPUT"
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffMergeTa5d6ff Ta5d6ffimageTa5d6ff Ta5d6fftagsTa5d6ff Ta5d6ffforTa5d6ff Ta5d6ffbuild
Tff7b72idTb4b4b4: Ta5d6ffall_tags
Tff7b72envTb4b4b4:
Tff7b72GH_TAGSTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsteps.tags.outputs.tagsTa5d6ff Ta5d6ff}}
Tff7b72DH_TAGSTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsteps.dh_tags.outputs.tagsTa5d6ff Ta5d6ff}}
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72set -euo pipefail
Tff7b72{
Tff7b72echo 'tags<<EOF'
Tff7b72printf '%s\n' "${GH_TAGS}"
Tff7b72if [ -n "${DH_TAGS:-}" ]; then
Tff7b72printf '%s\n' "${DH_TAGS}"
Tff7b72fi
Tff7b72echo 'EOF'
Tff7b72} >> "$GITHUB_OUTPUT"
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffBuildTa5d6ff Ta5d6ffandTa5d6ff Ta5d6ffpush
Tff7b72idTb4b4b4: Ta5d6ffbuild
Tff7b72usesTb4b4b4: Ta5d6ffdocker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
Tff7b72withTb4b4b4:
Tff7b72contextTb4b4b4: Ta5d6ff.
Tff7b72fileTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffmatrix.dockerfileTa5d6ff Ta5d6ff}}
Tff7b72platformsTb4b4b4: Ta5d6fflinux/amd64,linux/arm64
Tff7b72pushTb4b4b4: Ta5d6fftrue
Tff7b72tagsTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffsteps.all_tags.outputs.tagsTa5d6ff Ta5d6ff}}
Tff7b72cache-fromTb4b4b4: Ta5d6fftype=gha,scope=${{Ta5d6ff Ta5d6ffmatrix.variantTa5d6ff Ta5d6ff}}
Tff7b72cache-toTb4b4b4: Ta5d6fftype=gha,mode=max,scope=${{Ta5d6ff Ta5d6ffmatrix.variantTa5d6ff Ta5d6ff}}
Tff7b72build-argsTb4b4b4: Tb4b4b4|
Tff7b72OCI_REVISION=${{ github.sha }}
Tff7b72OCI_VERSION=${{ steps.oci.outputs.version }}
Tff7b72OCI_CREATED=${{ steps.oci.outputs.created }}
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffInstallTa5d6ff Ta5d6ffCosign
Tff7b72usesTb4b4b4: Ta5d6ffsigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffCosignTa5d6ff Ta5d6ffsignTa5d6ff Ta5d6ff(keyless,Ta5d6ff Ta5d6ffGHCRTa5d6ff Ta5d6ffonly)
Tff7b72envTb4b4b4:
Tff7b72COSIGN_YESTb4b4b4: Ta5d6ff"Ta5d6fftrueTa5d6ff"
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72set -euo pipefail
Tff7b72test -n "${{ steps.build.outputs.digest }}"
Tff7b72cosign sign "${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }}"
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────