I'm siGit, running on siGit Code & Deploy platform, browsing siGit Code coding agent repo.
main
| 1 | name: Release Assurance runner image |
| 2 | |
| 3 | # Builds ghcr.io/getsigit/sigit-code-assurance-runner, the guest image of the |
| 4 | # siGit Code Assurance Fireactions pool, with the released `sigit` baked in. |
| 5 | # release-github dispatches this once the release assets exist. A pull request |
| 6 | # that touches the image builds it without pushing, so a broken Dockerfile |
| 7 | # shows up before merge. |
| 8 | on: |
| 9 | workflow_dispatch: |
| 10 | inputs: |
| 11 | tag: |
| 12 | description: "Release tag (e.g. v0.1.1)" |
| 13 | required: true |
| 14 | pull_request: |
| 15 | paths: |
| 16 | - packaging/assurance-runner/** |
| 17 | - .github/workflows/release-assurance-image.yml |
| 18 | |
| 19 | concurrency: |
| 20 | group: ${{ github.workflow }}-${{ github.event.inputs.tag || github.ref }} |
| 21 | cancel-in-progress: false |
| 22 | |
| 23 | permissions: |
| 24 | contents: read |
| 25 | packages: write |
| 26 | |
| 27 | env: |
| 28 | IMAGE: ghcr.io/getsigit/sigit-code-assurance-runner |
| 29 | |
| 30 | jobs: |
| 31 | build: |
| 32 | name: Build image |
| 33 | runs-on: ubuntu-latest |
| 34 | timeout-minutes: 60 |
| 35 | |
| 36 | steps: |
| 37 | - name: Checkout |
| 38 | # The dispatched ref, not the tag: the tag only picks the sigit to bake in, and a tag |
| 39 | # older than packaging/assurance-runner/ has no Dockerfile to build. |
| 40 | uses: actions/checkout@v6 |
| 41 | |
| 42 | - name: Resolve tags |
| 43 | id: meta |
| 44 | shell: bash |
| 45 | run: | |
| 46 | if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then |
| 47 | tag="${{ github.event.inputs.tag }}" |
| 48 | echo "sigit_version=${tag}" >> "$GITHUB_OUTPUT" |
| 49 | { |
| 50 | echo "tags<<EOF" |
| 51 | echo "${IMAGE}:latest" |
| 52 | echo "${IMAGE}:${tag}" |
| 53 | echo "${IMAGE}:$(git rev-parse HEAD)" |
| 54 | echo "EOF" |
| 55 | } >> "$GITHUB_OUTPUT" |
| 56 | else |
| 57 | # Not `latest`: v1.7.6's linux-amd64 binary needs GLIBC_2.43 and the base has |
| 58 | # 2.39. Move to `latest` once a release is built on ubuntu-24.04. |
| 59 | echo "sigit_version=v1.7.5" >> "$GITHUB_OUTPUT" |
| 60 | echo "tags=${IMAGE}:pr-${{ github.event.pull_request.number }}" >> "$GITHUB_OUTPUT" |
| 61 | fi |
| 62 | |
| 63 | - uses: docker/setup-buildx-action@v4 |
| 64 | |
| 65 | - uses: docker/login-action@v4 |
| 66 | if: github.event_name == 'workflow_dispatch' |
| 67 | with: |
| 68 | registry: ghcr.io |
| 69 | username: ${{ github.actor }} |
| 70 | password: ${{ secrets.GITHUB_TOKEN }} |
| 71 | |
| 72 | - uses: docker/build-push-action@v7 |
| 73 | with: |
| 74 | context: packaging/assurance-runner |
| 75 | build-args: SIGIT_VERSION=${{ steps.meta.outputs.sigit_version }} |
| 76 | push: ${{ github.event_name == 'workflow_dispatch' }} |
| 77 | tags: ${{ steps.meta.outputs.tags }} |
| 78 | cache-from: type=gha |
| 79 | cache-to: type=gha,mode=max |