cluster

commit a4b3abe4fb941ab37ec89b5b19777fe03f5e9382
parent 4d841d6c38bfe2d269bb6da3ff2750a391a992eb
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Wed, 25 Mar 2026 21:41:43 +0100

build bookwyrm automatically

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
A
.github/workflows/build-bookwyrm.yaml
 | 
100
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 100 insertions(+), 0 deletions(-)
diff --git a/.github/workflows/build-bookwyrm.yaml b/.github/workflows/build-bookwyrm.yaml
@@ -0,0 +1,100 @@
+name: Build Bookwyrm Image
+
+on:
+  schedule:
+    # Check for new upstream releases daily at 04:00 UTC
+    - cron: "0 4 * * *"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Bookwyrm version to build (e.g. v0.8.3). Leave empty to use latest upstream release."
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Check for new version
+    runs-on: ubuntu-latest
+    outputs:
+      new_version: ${{ steps.versions.outputs.new_version }}
+      needs_build: ${{ steps.versions.outputs.needs_build }}
+    steps:
+      - name: Determine versions
+        id: versions
+        env:
+          GH_TOKEN: ${{ github.token }}
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          if [ -n "$INPUT_VERSION" ]; then
+            NEW="$INPUT_VERSION"
+          else
+            NEW=$(gh api repos/bookwyrm-social/bookwyrm/releases/latest --jq '.tag_name')
+          fi
+          echo "new_version=$NEW" >> "$GITHUB_OUTPUT"
+
+          # Check if this tag already exists in the registry (anonymous read)
+          TAGS=$(curl -sf "https://registry.midnightthoughts.space/v2/mtrnord/bookwyrm/tags/list" \
+            | grep -o '"tags":\[[^]]*\]' || echo "")
+          if echo "$TAGS" | grep -q "\"${NEW}\""; then
+            echo "needs_build=false" >> "$GITHUB_OUTPUT"
+            echo "Tag ${NEW} already exists in registry, skipping build"
+          else
+            echo "needs_build=true" >> "$GITHUB_OUTPUT"
+            echo "Tag ${NEW} not found in registry, will build"
+          fi
+
+  build:
+    name: Build, Push and Sign
+    needs: check
+    if: needs.check.outputs.needs_build == 'true'
+    runs-on: ubuntu-latest
+    environment: registry
+    steps:
+      - name: Checkout bookwyrm source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: bookwyrm-social/bookwyrm
+          ref: ${{ needs.check.outputs.new_version }}
+          persist-credentials: false
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+
+      - name: Log in to self-hosted registry
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
+        with:
+          registry: registry.midnightthoughts.space
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
+
+      - name: Build and push
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
+        with:
+          context: .
+          push: true
+          tags: |
+            registry.midnightthoughts.space/mtrnord/bookwyrm:${{ needs.check.outputs.new_version }}
+            registry.midnightthoughts.space/mtrnord/bookwyrm:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64,linux/arm64
+
+      - name: Sign image
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+          COSIGN_OCI_EXPERIMENTAL: "1"
+          COSIGN_EXPERIMENTAL: "1"
+          NEW_VERSION: ${{ needs.check.outputs.new_version }}
+        run: |
+          cosign sign --yes --key env://COSIGN_PRIVATE_KEY \
+            --registry-referrers-mode=oci-1-1 \
+            "registry.midnightthoughts.space/mtrnord/bookwyrm:${NEW_VERSION}"