ksv741
6a87379813
TD-009: retry verification of an existing digest without republishing. Paired backend workflow fix: 82eccc3.
64 lines
3.0 KiB
YAML
64 lines
3.0 KiB
YAML
name: Frontend image
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
concurrency:
|
|
group: frontend-image-publication
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
IMAGE: nexus.personal.ksv741.ru/docker-hosted/wealthledger/frontend
|
|
RELEASE_TAG: ${{ gitea.ref_name }}
|
|
REVISION: ${{ gitea.sha }}
|
|
DOCKER_CONFIG: ${{ runner.temp }}/wealthledger-frontend-docker
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
- uses: https://github.com/actions/setup-node@v4
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Validate release version
|
|
run: |
|
|
node --input-type=commonjs -e 'const p = require("./package.json"); const l = require("./package-lock.json"); if (!/^v\d+\.\d+\.\d+$/.test(process.env.RELEASE_TAG) || process.env.RELEASE_TAG !== `v${p.version}` || l.version !== p.version || l.packages[""].version !== p.version) process.exit(1)'
|
|
test "$(git rev-parse HEAD)" = "$REVISION"
|
|
docker version
|
|
docker buildx version
|
|
- run: npm ci
|
|
env:
|
|
HUSKY: '0'
|
|
- run: npm run verify
|
|
env:
|
|
KNIP_DISABLE_RAW_TRANSFER: '1'
|
|
- name: Login with dedicated Nexus writer
|
|
env:
|
|
REGISTRY_USERNAME: ${{ secrets.NEXUS_USERNAME }}
|
|
REGISTRY_TOKEN: ${{ secrets.NEXUS_PASSWORD }}
|
|
run: |
|
|
test -n "$REGISTRY_USERNAME" && test -n "$REGISTRY_TOKEN"
|
|
install -d -m 700 "$DOCKER_CONFIG"
|
|
printf '%s' "$REGISTRY_TOKEN" | docker login nexus.personal.ksv741.ru --username "$REGISTRY_USERNAME" --password-stdin
|
|
- name: Publish immutable release tag
|
|
run: |
|
|
VERSION="${RELEASE_TAG#v}"
|
|
if docker manifest inspect "$IMAGE:$VERSION" >/dev/null 2>manifest-error.log; then
|
|
DIGEST="$(docker buildx imagetools inspect "$IMAGE:$VERSION" --format '{{.Manifest.Digest}}')"
|
|
else
|
|
if ! grep -Eq 'manifest unknown|no such manifest' manifest-error.log; then
|
|
echo 'Cannot prove tag absence; refusing publication'; exit 1
|
|
fi
|
|
docker buildx build --target production --build-arg VERSION="$VERSION" --build-arg REVISION="$REVISION" --tag "$IMAGE:$VERSION" --metadata-file image-metadata.json --push .
|
|
DIGEST="$(node --input-type=commonjs -p 'require("./image-metadata.json")["containerimage.digest"]')"
|
|
fi
|
|
docker pull "$IMAGE@$DIGEST"
|
|
test "$(docker image inspect "$IMAGE@$DIGEST" --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$REVISION"
|
|
test "$(docker image inspect "$IMAGE@$DIGEST" --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = "$VERSION"
|
|
docker run --rm --entrypoint sh "$IMAGE@$DIGEST" -c 'test -s /usr/share/nginx/html/index.html && nginx -t && nginx && wget -q -O /dev/null http://127.0.0.1:8080/'
|
|
printf 'Frontend image: %s@%s\n' "$IMAGE" "$DIGEST"
|
|
- name: Remove registry session
|
|
if: always()
|
|
run: rm -rf "$DOCKER_CONFIG"
|