tinyclaw/.github/workflows/container.yml at 268e130e6ed58e1feff5dd0a160a599e8984832b · warengonzaga/tinyclaw · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
name: Container

on:
  pull_request:
    branches: [ dev, main ]
  push:
    branches: [ dev, main ]
  release:
    types: [ published ]
  workflow_dispatch:

concurrency:
  group: Container-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write
  security-events: write
  pull-requests: write

jobs:
  ci:
    name: CI Gate
    uses: ./.github/workflows/ci.yml
    secrets: inherit
    permissions:
      contents: read
      pull-requests: write

  codeql:
    name: CodeQL Gate
    uses: ./.github/workflows/codeql.yml
    permissions:
      contents: read
      security-events: write
      actions: read

  build:
    name: Build Container Images
    runs-on: ubuntu-latest
    needs: [ ci, codeql ]
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Build and Push Container
        uses: wgtechlabs/container-build-flow-action@v1.8.1
        with:
          registry: both
          dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
          dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
          ghcr-token: ${{ github.token }}
          floating-tags: true
          release-platforms: linux/amd64
          trivy-severity: CRITICAL
          fail-on-vulnerability: true
          commit-convention-enabled: true