chore(main): release 0.3.0 #1722
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and test | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # This builds the images and uploads them as artifacts | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # Package write permission is needed to update the cache | |
| packages: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - uses: cardinalby/export-env-action@v2 | |
| with: | |
| envFile: '.env' | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Prepare Docker build | |
| run: make pre_build | |
| - name: Build dev image | |
| uses: docker/bake-action@v7 | |
| env: | |
| IMAGE_NAME: ${{ github.repository }} | |
| with: | |
| source: . | |
| files: docker-bake.hcl | |
| targets: dev | |
| load: true | |
| # Fork PRs can't authenticate to the org registry; skip cache-to only on those | |
| # so internal PRs still benefit from caching. | |
| set: | | |
| ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'dev.cache-to=' || '' }} | |
| - name: Export Docker dev image to tar | |
| run: | | |
| docker save "$REGISTRY/$GITHUB_REPOSITORY:dev" > "${{ runner.temp }}/image.tar" | |
| - name: Upload image artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: image | |
| path: ${{ runner.temp }}/image.tar | |
| # Run the playwright tests. Uses the dev image artifacts created in the build job | |
| test: | |
| needs: build | |
| timeout-minutes: 60 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: lts/* | |
| - name: Install dependencies | |
| run: make init | |
| - name: Download previously built image | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: image | |
| path: ${{ runner.temp }} | |
| - name: Load image | |
| run: | | |
| docker load --input ${{ runner.temp }}/image.tar | |
| docker image ls -a | |
| - name: Build languages | |
| # Need to build languages as the dev image uses locally mapped volumes for the themes | |
| run: make build_languages | |
| - name: Run Playwright tests | |
| run: make test | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: test-results | |
| # Playwright .last-run.json file won't be uploaded without this | |
| include-hidden-files: true | |
| path: ${{ github.workspace }}/test-results/ | |
| retention-days: 30 | |
| # Only runs on push to main. Does the full multi-platform build (using above image to cache the linux/amd64 one) | |
| # and pushes the images to the registry | |
| # | |
| # ⚠️ The job name is referenced by container-deploy.yml via fountainhead/action-wait-for-check. | |
| # The matrix strategy adds matrix values in parentheses, e.g. "push-images (regular)". | |
| # If renaming or restructuring this job, update the check name in container-deploy.yml accordingly. | |
| push-images: | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| # Only push images if tests have passed | |
| needs: test | |
| permissions: | |
| contents: read | |
| id-token: write | |
| packages: write | |
| strategy: | |
| matrix: | |
| target: [regular, testcontainer] | |
| fail-fast: false | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - uses: cardinalby/export-env-action@v2 | |
| with: | |
| envFile: '.env' | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=ref,event=pr | |
| type=ref,event=branch | |
| type=sha,format=long | |
| - name: Prepare Docker build | |
| run: make pre_build | |
| - name: Build and push regular image | |
| if: matrix.target == 'regular' | |
| uses: docker/bake-action@v7 | |
| env: | |
| IMAGE_NAME: ${{ github.repository }} | |
| with: | |
| source: . | |
| files: | | |
| docker-bake.hcl | |
| ${{ steps.meta.outputs.bake-file }} | |
| targets: regular | |
| push: ${{ github.event_name != 'pull_request' }} | |
| set: | | |
| ${{ github.event_name == 'pull_request' && 'regular.cache-to=' || '' }} | |
| - name: Build and push testcontainer image | |
| if: matrix.target == 'testcontainer' | |
| uses: docker/bake-action@v7 | |
| env: | |
| IMAGE_NAME: ${{ github.repository }} | |
| with: | |
| source: . | |
| files: docker-bake.hcl | |
| targets: testcontainer | |
| push: ${{ github.event_name != 'pull_request' }} | |
| set: | | |
| ${{ github.event_name == 'pull_request' && 'testcontainer.cache-to=' || '' }} | |
| - name: Sign ${{ matrix.target }} image | |
| run: | | |
| if [ "${{ matrix.target }}" = "regular" ]; then | |
| # Keyless sign immutable digest references for all published regular tags | |
| seen_digests="" | |
| tags="${{ steps.meta.outputs.tags }}" | |
| for tag in $tags; do | |
| digest="$(docker buildx imagetools inspect "$tag" | awk '/^Digest:/ {print $2; exit}')" | |
| if [ -z "$digest" ]; then | |
| echo "Failed to resolve digest for $tag" >&2 | |
| exit 1 | |
| fi | |
| # Avoid signing the same digest multiple times when several tags point to it | |
| if [[ " $seen_digests " != *" $digest "* ]]; then | |
| cosign sign --yes "$tag@$digest" | |
| seen_digests="$seen_digests $digest" | |
| fi | |
| done | |
| else | |
| # Keyless sign immutable digest reference for testcontainer | |
| test_tag="$REGISTRY/$GITHUB_REPOSITORY:testcontainer" | |
| test_digest="$(docker buildx imagetools inspect "$test_tag" | awk '/^Digest:/ {print $2; exit}')" | |
| if [ -z "$test_digest" ]; then | |
| echo "Failed to resolve digest for $test_tag" >&2 | |
| exit 1 | |
| fi | |
| cosign sign --yes "$test_tag@$test_digest" | |
| fi | |