CLIProxyAPI/.github/workflows/trogonstack-image.yml at main · TrogonStack/CLIProxyAPI · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: trogonstack-image

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:
    inputs:
      release:
        description: Tag the built image with the next CalVer version (main only)
        type: boolean
        default: false

permissions:
  contents: read

env:
  # A pull request pushes only when it comes from this repository, so fork PRs
  # build without a registry write.
  PUSH: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}

jobs:
  image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true
      - uses: ./.github/actions/setup-mise
      - id: image
        run: mise run github:workflows:trogonstack-image:image-name
      - name: Refresh models catalog
        run: mise run github:workflows:trogonstack-image:refresh-model-catalogs
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        if: env.PUSH == 'true'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        env:
          # Annotations land on both the image index and its manifest.
          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
          # Label the pull request head commit, not the merge commit.
          DOCKER_METADATA_PR_HEAD_SHA: 'true'
        with:
          images: ${{ steps.image.outputs.name }}
          tags: |
            type=sha,format=long,prefix=,enable=${{ github.event_name != 'pull_request' }}
            type=raw,value=pr-${{ github.event.pull_request.head.sha }},enable=${{ github.event_name == 'pull_request' }}
      - id: build
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        with:
          context: .
          # The ADR requires a multi-platform image index. The cluster is amd64
          # only, so the index holds one platform plus its provenance
          # attestation. It exists so arm64 can be added here without changing
          # any tag or path.
          platforms: linux/amd64
          provenance: mode=min
          push: ${{ env.PUSH == 'true' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          build-args: |
            VERSION=${{ github.ref_name }}
            COMMIT=${{ github.event.pull_request.head.sha || github.sha }}
      - if: env.PUSH == 'true'
        env:
          REF: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }}
        run: mise run github:workflows:trogonstack-image:summary

  release:
    needs: image
    if: github.event_name == 'workflow_dispatch' && inputs.release && github.ref == 'refs/heads/main'
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/trogonstack-release.yml
    with:
      commit: ${{ github.sha }}