cluster

Infrastructure files for Nordgedanken and Midnightthoughts.
git clone git://archive.git.mtrnord.blog/MTRNord/cluster.git
Log | Files | Refs | README

build-blog.yaml (2867B)

      1 name: Build Blog Image
      2 
      3 on:
      4   push:
      5     branches: ["main"]
      6     paths:
      7       - "apps/talos_cluster/blog/docker/**"
      8       - ".github/workflows/build-blog.yaml"
      9   workflow_dispatch:
     10 
     11 permissions:
     12   contents: read
     13 
     14 jobs:
     15   build:
     16     #if: false  # disabled — replaced by in-cluster image-builder cronjob
     17     name: Build and Push
     18     runs-on: ubuntu-latest
     19     environment: registry
     20     steps:
     21       - name: Checkout
     22         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
     23         with:
     24           persist-credentials: false
     25 
     26       - name: Set up QEMU
     27         uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
     28 
     29       - name: Set up Docker Buildx
     30         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
     31 
     32       - name: Log in to self-hosted registry
     33         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
     34         with:
     35           registry: registry.midnightthoughts.space
     36           username: ${{ secrets.REGISTRY_USERNAME }}
     37           password: ${{ secrets.REGISTRY_PASSWORD }}
     38 
     39       - name: Install cosign
     40         uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
     41         with:
     42           cosign-release: v3.0.5
     43 
     44       - name: Extract metadata
     45         id: meta
     46         uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
     47         with:
     48           images: registry.midnightthoughts.space/mtrnord/blog
     49           labels: |
     50             org.opencontainers.image.description=MTRNord's personal blog (WordPress-based) — custom image
     51             org.opencontainers.image.title=blog
     52             org.opencontainers.image.vendor=MTRNord
     53           tags: |
     54             type=raw,value=latest
     55             type=raw,value={{date 'YYYYMMDD-HHmmss'}}
     56             type=sha,prefix=sha-
     57 
     58       - name: Build and push
     59         id: build
     60         uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
     61         with:
     62           context: apps/talos_cluster/blog/docker
     63           file: apps/talos_cluster/blog/docker/Dockerfile
     64           push: true
     65           tags: ${{ steps.meta.outputs.tags }}
     66           labels: ${{ steps.meta.outputs.labels }}
     67           cache-from: type=gha
     68           cache-to: type=gha,mode=max
     69           platforms: linux/amd64,linux/arm64
     70 
     71       - name: Sign image
     72         env:
     73           COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
     74           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
     75           COSIGN_OCI_EXPERIMENTAL: "1"
     76           COSIGN_EXPERIMENTAL: "1"
     77           DIGEST: ${{ steps.build.outputs.digest }}
     78         run: |
     79           cosign sign --yes --key env://COSIGN_PRIVATE_KEY \
     80             --new-bundle-format=false \
     81             --use-signing-config=false \
     82             --registry-referrers-mode=oci-1-1 \
     83             "registry.midnightthoughts.space/mtrnord/blog@${DIGEST}"