Publish the authoring skills as a sandbox kit #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and push images | |
| # Builds and pushes BOTH container images defined in docker-bake.hcl — | |
| # dockersamples/simspace (runtime) and dockersamples/simspace-authoring — as | |
| # multi-arch manifests (linux/amd64 + linux/arm64), releasing them in lock-step | |
| # under the same tags so a lab pinned to a version gets a matching pair. | |
| # | |
| # Auth is keyless via Docker Hub's OIDC connection (no long-lived PAT stored as a | |
| # secret): the id-token permission lets docker/login-action exchange a GitHub | |
| # OIDC token for a short-lived Docker Hub token against the org's connection. | |
| # | |
| # Tagging: | |
| # push to main -> latest | |
| # push tag vX.Y.Z -> X.Y.Z, X, latest (a release of both images) | |
| # manual dispatch -> the tags you enter (comma-separated), default latest | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*.*.*"] | |
| workflow_dispatch: | |
| inputs: | |
| tags: | |
| description: "Comma-separated image tags to push." | |
| type: string | |
| default: "latest" | |
| permissions: | |
| contents: read | |
| id-token: write # required for the Docker Hub OIDC token exchange | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Compute image tags | |
| id: tags | |
| # main -> latest; a vX.Y.Z tag -> X.Y.Z + X + latest; manual -> the input. | |
| run: | | |
| set -euo pipefail | |
| ref="${{ github.ref }}" | |
| if [ -n "${{ inputs.tags }}" ]; then | |
| tags="${{ inputs.tags }}" | |
| elif [[ "$ref" == refs/tags/v* ]]; then | |
| version="${ref#refs/tags/v}" | |
| major="${version%%.*}" | |
| tags="${version},${major},latest" | |
| else | |
| tags="latest" | |
| fi | |
| echo "tags=$tags" >> "$GITHUB_OUTPUT" | |
| echo "Pushing tags: $tags" | |
| - name: Login to Docker Hub (OIDC) | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| env: | |
| DOCKERHUB_OIDC_CONNECTIONID: 80de9e44-46f6-4c48-96a5-e0bd0a336f5b | |
| with: | |
| username: dockersamples | |
| - name: Set up Docker Build Cloud | |
| # Must come AFTER login — the cloud builder authenticates with the token | |
| # obtained above. Build Cloud provides native multi-arch nodes, so no | |
| # QEMU emulation is needed. `install: true` makes it the default builder | |
| # so the bake step below uses it. | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| with: | |
| driver: cloud | |
| endpoint: dockersamples/gha-workflows | |
| install: true | |
| - name: Build and push (both images, multi-arch) | |
| uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0 | |
| with: | |
| push: true | |
| env: | |
| TAGS: ${{ steps.tags.outputs.tags }} |