48 lines
1.6 KiB
YAML
48 lines
1.6 KiB
YAML
name: release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*.*.*"
|
|
|
|
jobs:
|
|
verify-publish:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Verify release
|
|
run: bash ./scripts/codex_verify.sh
|
|
- name: Build immutable image
|
|
env:
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
run: |
|
|
set -euo pipefail
|
|
version="${GITHUB_REF_NAME#v}"
|
|
registry="gitea.itworx.tech"
|
|
image="${registry}/jens/vacatureradar:${version}"
|
|
printf '%s' "$REGISTRY_TOKEN" | docker login "$registry" --username "$REGISTRY_USER" --password-stdin
|
|
docker build --file Dockerfile.unraid \
|
|
--build-arg "VCS_REF=${GITHUB_SHA}" \
|
|
--build-arg "APP_VERSION=${version}" \
|
|
--tag "$image" .
|
|
docker push "$image"
|
|
docker image inspect "$image" --format '{{index .RepoDigests 0}}' > image-digest.txt
|
|
docker sbom "$image" --format spdx-json > sbom.spdx.json
|
|
cat > RELEASE_NOTES.md <<EOF
|
|
# VacatureRadar ${version}
|
|
|
|
Immutable release image built from commit ${GITHUB_SHA}.
|
|
The accompanying digest, SPDX SBOM and checksums are release evidence.
|
|
EOF
|
|
sha256sum image-digest.txt sbom.spdx.json RELEASE_NOTES.md > SHA256SUMS
|
|
- name: Publish release evidence
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: release-evidence-${{ github.ref_name }}
|
|
path: |
|
|
image-digest.txt
|
|
sbom.spdx.json
|
|
SHA256SUMS
|
|
RELEASE_NOTES.md
|