ksv741
0ec7ae51af
Backend security / security (push) Successful in 7s
Backend verify / verify (push) Successful in 2m27s
Backend security / security (pull_request) Successful in 8s
Backend verify / verify (pull_request) Successful in 2m22s
Conventional commits / commits (pull_request) Failing after 22s
60 lines
2.7 KiB
YAML
60 lines
2.7 KiB
YAML
name: Backend image
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
concurrency:
|
|
group: backend-image-publication
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
IMAGE: nexus.ksv741.keenetic.pro/wealthledger/backend
|
|
RELEASE_TAG: ${{ gitea.ref_name }}
|
|
REVISION: ${{ gitea.sha }}
|
|
DOCKER_CONFIG: ${{ runner.temp }}/wealthledger-backend-docker
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
- uses: https://github.com/actions/setup-node@v4
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Validate release version
|
|
run: |
|
|
node --input-type=commonjs -e 'const p = require("./package.json"); const l = require("./package-lock.json"); if (!/^v\d+\.\d+\.\d+$/.test(process.env.RELEASE_TAG) || process.env.RELEASE_TAG !== `v${p.version}` || l.version !== p.version || l.packages[""].version !== p.version) process.exit(1)'
|
|
test "$(git rev-parse HEAD)" = "$REVISION"
|
|
docker version
|
|
docker buildx version
|
|
- run: npm ci
|
|
- run: npx --no-install prisma generate
|
|
- run: npm run verify
|
|
- run: npm run test:e2e
|
|
- name: Login with dedicated Nexus writer
|
|
env:
|
|
REGISTRY_USERNAME: ${{ secrets.NEXUS_USERNAME }}
|
|
REGISTRY_TOKEN: ${{ secrets.NEXUS_PASSWORD }}
|
|
run: |
|
|
test -n "$REGISTRY_USERNAME" && test -n "$REGISTRY_TOKEN"
|
|
install -d -m 700 "$DOCKER_CONFIG"
|
|
printf '%s' "$REGISTRY_TOKEN" | docker login nexus.ksv741.keenetic.pro --username "$REGISTRY_USERNAME" --password-stdin
|
|
- name: Publish immutable release tag
|
|
run: |
|
|
VERSION="${RELEASE_TAG#v}"
|
|
if docker manifest inspect "$IMAGE:$VERSION" >/dev/null 2>manifest-error.log; then
|
|
echo 'Refusing to overwrite an existing release tag'; exit 1
|
|
fi
|
|
if ! grep -Eq 'manifest unknown|no such manifest' manifest-error.log; then
|
|
echo 'Cannot prove tag absence; refusing publication'; exit 1
|
|
fi
|
|
docker buildx build --target production --build-arg VERSION="$VERSION" --build-arg REVISION="$REVISION" --tag "$IMAGE:$VERSION" --metadata-file image-metadata.json --push .
|
|
DIGEST="$(node --input-type=commonjs -p 'require("./image-metadata.json")["containerimage.digest"]')"
|
|
docker pull "$IMAGE@$DIGEST"
|
|
test "$(docker image inspect "$IMAGE@$DIGEST" --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$REVISION"
|
|
npm run test:container -- "$IMAGE@$DIGEST"
|
|
printf 'Backend image: %s@%s\n' "$IMAGE" "$DIGEST"
|
|
- name: Remove registry session
|
|
if: always()
|
|
run: rm -rf "$DOCKER_CONFIG"
|