|
name: Docker |
|
|
|
# This workflow uses actions that are not certified by GitHub. |
|
# They are provided by a third-party and are governed by |
|
# separate terms of service, privacy policy, and support |
|
# documentation. |
|
|
|
on: |
|
schedule: |
|
- cron: '32 2 * * *' |
|
push: |
|
branches: [ "master" ] |
|
# Publish semver tags as releases. |
|
tags: [ 'v*.*.*' ] |
|
pull_request: |
|
branches: [ "master" ] |
|
|
|
env: |
|
# Use docker.io for Docker Hub if empty |
|
REGISTRY: ghcr.io |
|
# github.repository as <account>/<repo> |
|
IMAGE_NAME: ${{ github.repository }} |
|
|
|
|
|
jobs: |
|
build: |
|
strategy: |
|
fail-fast: false |
|
matrix: |
|
image-tag: [ "CUDA-12.9.1-Ubuntu-20.04", "CUDA-12.9.1-ubi8" ] |
|
|
|
runs-on: ubuntu-22.04 |
|
|
|
permissions: |
|
contents: read |
|
packages: write |
|
# This is used to complete the identity challenge |
|
# with sigstore/fulcio when running outside of PRs. |
|
id-token: write |
|
|
|
steps: |
|
- name: Checkout repository |
|
uses: actions/checkout@v4 |
|
|
|
# Install the cosign tool except on PR |
|
# https://github.com/sigstore/cosign-installer |
|
- name: Install cosign |
|
if: github.event_name != 'pull_request' |
|
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0 |
|
with: |
|
cosign-release: 'v2.2.4' |
|
|
|
# Set up BuildKit Docker container builder to be able to build |
|
# multi-platform images and export cache |
|
# https://github.com/docker/setup-buildx-action |
|
- name: Set up Docker Buildx |
|
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 |
|
|
|
# Login against a Docker registry except on PR |
|
# https://github.com/docker/login-action |
|
- name: Log into registry ${{ env.REGISTRY }} |
|
if: github.event_name != 'pull_request' |
|
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 |
|
with: |
|
registry: ${{ env.REGISTRY }} |
|
username: ${{ github.actor }} |
|
password: ${{ secrets.GITHUB_TOKEN }} |
|
|
|
# Extract metadata (tags, labels) for Docker |
|
# https://github.com/docker/metadata-action |
|
- name: Extract Docker metadata |
|
id: meta |
|
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 |
|
with: |
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} |
|
tags: | |
|
type=raw,value=${{ matrix.image-tag }} |
|
|
|
# Build and push Docker image with Buildx (don't push on PR) |
|
# https://github.com/docker/build-push-action |
|
- name: Build and push Docker image |
|
id: build-and-push |
|
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 |
|
with: |
|
file: Dockerfolder/${{ matrix.image-tag }}.Dockerfile |
|
push: ${{ github.event_name != 'pull_request' }} |
|
tags: ${{ steps.meta.outputs.tags }} |
|
labels: ${{ steps.meta.outputs.labels }} |
|
cache-from: type=gha |
|
cache-to: type=gha,mode=max |
|
|
|
# Sign the resulting Docker image digest except on PRs. |
|
# This will only write to the public Rekor transparency log when the Docker |
|
# repository is public to avoid leaking data. If you would like to publish |
|
# transparency data even for private images, pass --force to cosign below. |
|
# https://github.com/sigstore/cosign |
|
- name: Sign the published Docker image |
|
if: ${{ github.event_name != 'pull_request' }} |
|
env: |
|
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable |
|
TAGS: ${{ steps.meta.outputs.tags }} |
|
DIGEST: ${{ steps.build-and-push.outputs.digest }} |
|
# This step uses the identity token to provision an ephemeral certificate |
|
# against the sigstore community Fulcio instance. |
|
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} |