dockerfile and ghcr action!!

2026-09-16 01:21:20 -04:00 · 2026-09-15 01:10:51 -04:00
parent 470e95b0f9
commit 5a81ff7716
6 changed files with 385 additions and 26 deletions
@@ -0,0 +1,67 @@
+# Build the exact production image on pull requests, publish branch-named images
+# for development, and replace `latest` only after a successful main-branch
+# push. Keeping every channel in one job prevents a second build path from
+# drifting away from what servers actually download.
+name: Container image
+
+on:
+  pull_request:
+  # Every repository branch gets one moving development image. GitHub does not
+  # grant package-write access to untrusted fork pull requests, which remain
+  # build-only through the separate pull_request event above.
+  push:
+
+# Repository contents are read to build the image. Package write access is used
+# only by the conditional GHCR login and push steps on repository branch pushes.
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+
+      # Buildx supplies the cache and the explicit amd64 build used both for
+      # pull-request verification and publication. QEMU is intentionally absent
+      # because the central server image supports only linux/amd64.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      # GitHub's built-in token can publish to this repository's package. Pull
+      # requests never authenticate to GHCR and therefore cannot publish.
+      - name: Log in to GHCR
+        if: github.event_name == 'push'
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Docker's maintained metadata action converts branch names into valid
+      # container tags, including replacing separators such as `/`. Main gets
+      # only `latest`; every other pushed branch gets only its branch tag.
+      - name: Select image tag
+        id: image-metadata
+        uses: docker/metadata-action@v6
+        with:
+          images: ghcr.io/legop3/multiroombarover
+          flavor: latest=false
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=branch,enable={{is_not_default_branch}}
+
+      # The push switch keeps pull requests build-only. Branch images are
+      # replaced on each successful push, just as main replaces `latest`.
+      - name: Build and optionally publish
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64
+          push: ${{ github.event_name == 'push' }}
+          tags: ${{ steps.image-metadata.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max