Skip to content

ci: build and publish ghcr.io/saveweb/hq #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yzqzss merged 1 commit into from
Oct 8, 2026
Merged

ci: build and publish ghcr.io/saveweb/hq #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 63 additions & 0 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
name: Build image

on:
push:
branches: [main]
tags: ["v*"]
pull_request:

permissions:
contents: read
packages: write

jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/setup-go@v6
with:
go-version-file: go.mod
- run: go vet ./...
- run: go test ./...

image:

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Make image publishing depend on tests

On a main or tag push where go vet or go test fails but the Dockerfile still builds, this independent job continues and pushes the main, version, and potentially latest tags. GitHub documents that jobs without dependencies run in parallel, so the failed test job does not gate this publication; add needs: test to prevent rejected code from reaching GHCR. GitHub Actions documentation

Useful? React with 👍 / 👎.

runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: docker/setup-buildx-action@v3
- uses: docker/login-action@v3
if: github.event_name != 'pull_request'
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- id: meta
uses: docker/metadata-action@v5
with:
images: ghcr.io/${{ github.repository }}
tags: |
type=ref,event=branch
type=sha,prefix=sha-
type=semver,pattern=v{{version}}
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Exclude prereleases from the latest tag

When a prerelease such as v2.0.0-rc.1 is pushed, this raw rule unconditionally publishes it as latest; even malformed tags beginning with v do the same while the semver rule rejects them. This bypasses metadata-action's semver-aware latest handling, which deliberately avoids treating prereleases as public stable versions, so consumers of latest can unexpectedly receive an RC or invalid release. Use the semver flavor's automatic latest behavior or explicitly restrict this rule to stable semver tags. docker/metadata-action documentation

Useful? React with 👍 / 👎.

- name: Version string
id: ver
run: |
if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
echo "version=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
else
echo "version=$(git rev-parse --short=7 HEAD)" >> "$GITHUB_OUTPUT"
fi
- uses: docker/build-push-action@v6
with:
context: .
platforms: linux/amd64
push: ${{ github.event_name != 'pull_request' }}

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Serialize writes to mutable image tags

When two main pushes run concurrently, both builds write the same main tag, and the older build can finish last and move that tag back to an older commit; concurrent version-tag runs can similarly race on latest. Because the workflow has no concurrency or publication-order guard, consumers of these mutable tags can receive stale images after a newer run has succeeded. Serialize or cancel superseded publication runs before allowing them to push.

Useful? React with 👍 / 👎.

tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve the computed VERSION in the image label

On a main push, the metadata action selects the higher-priority branch tag and generates org.opencontainers.image.version=main; passing those labels to Buildx replaces the Dockerfile's VERSION=<short SHA> label. Thus the published image does not contain the short-SHA version computed above. The action documents that its highest-priority tag becomes the generated OCI version label, so override that label with steps.ver.outputs.version or stop supplying the conflicting generated label. docker/metadata-action priority documentation

Useful? React with 👍 / 👎.

build-args: |
VERSION=${{ steps.ver.outputs.version }}
COMMIT=${{ github.sha }}
cache-from: type=gha
cache-to: type=gha,mode=max
Loading