build-bookwyrm.yaml (5302B)
1 name: Build Bookwyrm Image 2 3 on: 4 push: 5 branches: ["main"] 6 paths: 7 - ".github/workflows/build-bookwyrm.yaml" 8 - "apps/talos_cluster/bookwyrm/dockerfile.patch" 9 schedule: 10 # Check for new upstream releases daily at 04:00 UTC 11 - cron: "0 4 * * *" 12 workflow_dispatch: 13 inputs: 14 version: 15 description: "Bookwyrm version to build (e.g. v0.8.3). Leave empty to use latest upstream release." 16 required: false 17 force: 18 description: "Force rebuild even if tag already exists in registry" 19 required: false 20 default: "false" 21 22 permissions: 23 contents: read 24 25 jobs: 26 check: 27 #if: false # disabled — replaced by in-cluster image-builder cronjob 28 name: Check for new version 29 runs-on: ubuntu-latest 30 outputs: 31 new_version: ${{ steps.versions.outputs.new_version }} 32 needs_build: ${{ steps.versions.outputs.needs_build }} 33 steps: 34 - name: Determine versions 35 id: versions 36 env: 37 GH_TOKEN: ${{ github.token }} 38 INPUT_VERSION: ${{ inputs.version }} 39 INPUT_FORCE: ${{ inputs.force }} 40 run: | 41 if [ -n "$INPUT_VERSION" ]; then 42 NEW="$INPUT_VERSION" 43 else 44 NEW=$(gh api repos/bookwyrm-social/bookwyrm/releases/latest --jq '.tag_name') 45 fi 46 echo "new_version=$NEW" >> "$GITHUB_OUTPUT" 47 48 if [ "$INPUT_FORCE" = "true" ]; then 49 echo "needs_build=true" >> "$GITHUB_OUTPUT" 50 echo "Force rebuild requested for tag ${NEW}" 51 else 52 # Check if this tag already exists in the registry (anonymous read) 53 TAGS=$(curl -sf "https://registry.midnightthoughts.space/v2/mtrnord/bookwyrm/tags/list" \ 54 | grep -o '"tags":\[[^]]*\]' || echo "") 55 if echo "$TAGS" | grep -q "\"${NEW}\""; then 56 echo "needs_build=false" >> "$GITHUB_OUTPUT" 57 echo "Tag ${NEW} already exists in registry, skipping build" 58 else 59 echo "needs_build=true" >> "$GITHUB_OUTPUT" 60 echo "Tag ${NEW} not found in registry, will build" 61 fi 62 fi 63 64 build: 65 name: Build, Push and Sign 66 needs: check 67 if: needs.check.outputs.needs_build == 'true' 68 runs-on: ubuntu-latest 69 environment: registry 70 steps: 71 - name: Checkout bookwyrm source 72 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 73 with: 74 repository: bookwyrm-social/bookwyrm 75 ref: ${{ needs.check.outputs.new_version }} 76 persist-credentials: false 77 78 - name: Checkout gitops for Dockerfile patch 79 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 80 with: 81 path: _gitops 82 persist-credentials: false 83 84 - name: Apply Dockerfile patch (if applicable) 85 run: | 86 if git apply --check _gitops/apps/talos_cluster/bookwyrm/dockerfile.patch 2>/dev/null; then 87 git apply _gitops/apps/talos_cluster/bookwyrm/dockerfile.patch 88 echo "Patch applied successfully" 89 else 90 echo "Patch does not apply cleanly — upstream Dockerfile likely already includes the needed changes, proceeding as-is" 91 fi 92 93 - name: Set up QEMU 94 uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4 95 96 - name: Set up Docker Buildx 97 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 98 99 - name: Log in to self-hosted registry 100 uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 101 with: 102 registry: registry.midnightthoughts.space 103 username: ${{ secrets.REGISTRY_USERNAME }} 104 password: ${{ secrets.REGISTRY_PASSWORD }} 105 106 - name: Install cosign 107 uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 108 with: 109 cosign-release: v3.0.5 110 111 - name: Build and push 112 id: build 113 uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 114 with: 115 context: . 116 push: true 117 tags: | 118 registry.midnightthoughts.space/mtrnord/bookwyrm:${{ needs.check.outputs.new_version }} 119 registry.midnightthoughts.space/mtrnord/bookwyrm:latest 120 labels: | 121 org.opencontainers.image.description=BookWyrm social reading and review platform 122 org.opencontainers.image.title=bookwyrm 123 org.opencontainers.image.vendor=MTRNord 124 org.opencontainers.image.version=${{ needs.check.outputs.new_version }} 125 cache-from: type=gha 126 cache-to: type=gha,mode=max 127 platforms: linux/amd64,linux/arm64 128 129 - name: Sign image 130 env: 131 COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} 132 COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} 133 COSIGN_OCI_EXPERIMENTAL: "1" 134 COSIGN_EXPERIMENTAL: "1" 135 DIGEST: ${{ steps.build.outputs.digest }} 136 run: | 137 cosign sign --yes --key env://COSIGN_PRIVATE_KEY \ 138 --new-bundle-format=false \ 139 --use-signing-config=false \ 140 --registry-referrers-mode=oci-1-1 \ 141 "registry.midnightthoughts.space/mtrnord/bookwyrm@${DIGEST}"