Enhance README and Docker workflow with detailed explanations on registry authentication, workflow triggers, and optional container update webhook. Updated job permissions and streamlined Docker image build and push process.
Publish cloudflare-balancer Docker image / build-and-push (push) Failing after 2m36s
Publish cloudflare-balancer Docker image / build-and-push (push) Failing after 2m36s
This commit is contained in:
Denozordec
+78
-44
@@ -1,61 +1,95 @@
|
||||
name: Docker
|
||||
name: Publish cloudflare-balancer Docker image
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
- master
|
||||
- '**'
|
||||
tags:
|
||||
- 'v*'
|
||||
pull_request:
|
||||
- '*'
|
||||
workflow_dispatch:
|
||||
|
||||
env:
|
||||
# Хост Container Registry (без схемы), тот же что для docker pull/push
|
||||
REGISTRY: git.shts.su
|
||||
IMAGE_REPO: ${{ gitea.repository }}
|
||||
|
||||
jobs:
|
||||
build:
|
||||
build-and-push:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 20
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Build image
|
||||
run: docker build -t cloudflare-balancer:ci .
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
driver-opts: |
|
||||
image=moby/buildkit:v0.13.2
|
||||
|
||||
# Публикация в registry: не используйте `if: secrets.X != ''` — в Gitea/GitHub
|
||||
# проверка «пустой ли секрет» в выражениях часто всегда ложна, шаги пропускаются.
|
||||
# Секреты пробрасываем в env и проверяем в bash.
|
||||
#
|
||||
# Секреты: REGISTRY_URL, REGISTRY_USER, PACKAGE_TOKEN (или REGISTRY_PASSWORD)
|
||||
- name: Login and push to Container Registry (optional)
|
||||
# Пароль registry — встроенный токен job (packages: write), без отдельного PAT
|
||||
- name: Log in to Gitea Registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ gitea.actor }}
|
||||
password: ${{ gitea.token }}
|
||||
|
||||
- name: Prepare Docker tags
|
||||
id: prep
|
||||
shell: bash
|
||||
env:
|
||||
REGISTRY_URL: ${{ secrets.REGISTRY_URL }}
|
||||
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
||||
PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
|
||||
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
||||
REPO: ${{ gitea.repository }}
|
||||
SHA: ${{ gitea.sha }}
|
||||
REF_NAME: ${{ gitea.ref_name }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
IMAGE="${REGISTRY}/${REPO}"
|
||||
BRANCH_OR_TAG="${REF_NAME:-unknown}"
|
||||
SAFE_REF="$(echo "${BRANCH_OR_TAG}" | tr '/' '-')"
|
||||
SHORT_SHA="$(echo "${SHA}" | cut -c1-12)"
|
||||
|
||||
TAGS="$(printf '%s\n%s\n%s\n' \
|
||||
"${IMAGE}:latest" \
|
||||
"${IMAGE}:${SAFE_REF}" \
|
||||
"${IMAGE}:sha-${SHORT_SHA}")"
|
||||
|
||||
echo "tags<<EOF" >> "${GITHUB_OUTPUT}"
|
||||
echo "${TAGS}" >> "${GITHUB_OUTPUT}"
|
||||
echo "EOF" >> "${GITHUB_OUTPUT}"
|
||||
|
||||
- name: Build and push Docker image
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
file: ./Dockerfile
|
||||
push: true
|
||||
platforms: linux/amd64
|
||||
cache-from: |
|
||||
type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_REPO }}:latest
|
||||
cache-to: type=inline
|
||||
tags: ${{ steps.prep.outputs.tags }}
|
||||
labels: |
|
||||
org.opencontainers.image.title=cloudflare-balancer
|
||||
org.opencontainers.image.description=Health-check бэкендов и синхронизация пула A/AAAA в Cloudflare DNS
|
||||
org.opencontainers.image.revision=${{ gitea.sha }}
|
||||
org.opencontainers.image.source=${{ gitea.server_url }}/${{ gitea.repository }}
|
||||
provenance: false
|
||||
|
||||
# Секрет CONTAINER_UPDATE_URL — URL webhook (например Portainer: обычно GET по уникальной ссылке)
|
||||
- name: Webhook обновления контейнера
|
||||
env:
|
||||
CONTAINER_UPDATE_URL: ${{ secrets.CONTAINER_UPDATE_URL }}
|
||||
run: |
|
||||
set -e
|
||||
if [ "${GITHUB_EVENT_NAME:-}" = "pull_request" ]; then
|
||||
echo "Pull request: push в registry не выполняется (только сборка)."
|
||||
if [ -z "${CONTAINER_UPDATE_URL:-}" ]; then
|
||||
echo "CONTAINER_UPDATE_URL не задан — шаг пропущен."
|
||||
exit 0
|
||||
fi
|
||||
if [ -z "${REGISTRY_URL:-}" ] || [ -z "${REGISTRY_USER:-}" ]; then
|
||||
echo "Пропуск registry: задайте секреты REGISTRY_URL и REGISTRY_USER."
|
||||
exit 0
|
||||
fi
|
||||
PASS="${PACKAGE_TOKEN:-}"
|
||||
if [ -z "$PASS" ]; then PASS="${REGISTRY_PASSWORD:-}"; fi
|
||||
if [ -z "$PASS" ]; then
|
||||
echo "Пропуск registry: задайте PACKAGE_TOKEN или REGISTRY_PASSWORD."
|
||||
exit 0
|
||||
fi
|
||||
REG="${REGISTRY_URL#https://}"
|
||||
REG="${REG#http://}"
|
||||
REG="${REG%/}"
|
||||
echo "$PASS" | docker login "$REG" -u "$REGISTRY_USER" --password-stdin
|
||||
IMG="cloudflare-balancer"
|
||||
OWNER_LOWER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
|
||||
TAG="${GITHUB_SHA:0:12}"
|
||||
case "${GITHUB_REF}" in refs/tags/*) TAG="${GITHUB_REF#refs/tags/}" ;; esac
|
||||
docker tag cloudflare-balancer:ci "${REG}/${OWNER_LOWER}/${IMG}:${TAG}"
|
||||
docker tag cloudflare-balancer:ci "${REG}/${OWNER_LOWER}/${IMG}:latest"
|
||||
docker push "${REG}/${OWNER_LOWER}/${IMG}:${TAG}"
|
||||
docker push "${REG}/${OWNER_LOWER}/${IMG}:latest"
|
||||
echo "Опубликовано: ${REG}/${OWNER_LOWER}/${IMG}:${TAG}"
|
||||
curl -fsS -m 120 "${CONTAINER_UPDATE_URL}"
|
||||
|
||||
Reference in New Issue
Block a user