build-mediawiki.yaml (5328B)
1 name: Build MediaWiki Image 2 3 on: 4 push: 5 branches: ["main"] 6 paths: 7 - "apps/talos_cluster/mediawiki/Dockerfile" 8 - "apps/talos_cluster/mediawiki/php-custom.ini" 9 - "apps/talos_cluster/mediawiki/apache-vhost.conf" 10 - "apps/talos_cluster/mediawiki/apache-fpm.conf" 11 - "apps/talos_cluster/mediawiki/fpm-pool.conf" 12 - "apps/talos_cluster/mediawiki/docker-entrypoint.sh" 13 - ".github/workflows/build-mediawiki.yaml" 14 schedule: 15 # Check for new upstream releases daily at 04:30 UTC 16 - cron: "30 4 * * *" 17 workflow_dispatch: 18 inputs: 19 version: 20 description: "MediaWiki version to build (e.g. 1.45.3). Leave empty to use latest upstream release." 21 required: false 22 force: 23 description: "Force rebuild even if tag already exists in registry" 24 required: false 25 default: "false" 26 27 permissions: 28 contents: read 29 30 jobs: 31 check: 32 name: Check for new version 33 runs-on: ubuntu-latest 34 outputs: 35 new_version: ${{ steps.versions.outputs.new_version }} 36 needs_build: ${{ steps.versions.outputs.needs_build }} 37 steps: 38 - name: Determine versions 39 id: versions 40 env: 41 GH_TOKEN: ${{ github.token }} 42 INPUT_VERSION: ${{ inputs.version }} 43 INPUT_FORCE: ${{ inputs.force }} 44 run: | 45 if [ -n "$INPUT_VERSION" ]; then 46 NEW="$INPUT_VERSION" 47 else 48 # wikimedia/mediawiki on GitHub is a mirror with no releases; query Docker Hub instead 49 NEW=$(curl -sf "https://hub.docker.com/v2/repositories/library/mediawiki/tags/?page_size=100&ordering=last_updated" \ 50 | jq -r '.results[].name' \ 51 | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \ 52 | sort -t. -k1,1n -k2,2n -k3,3n \ 53 | tail -1) 54 if [ -z "$NEW" ]; then 55 echo "Could not determine latest MediaWiki version from Docker Hub" >&2 56 exit 1 57 fi 58 fi 59 echo "new_version=$NEW" >> "$GITHUB_OUTPUT" 60 61 if [ "$INPUT_FORCE" = "true" ]; then 62 echo "needs_build=true" >> "$GITHUB_OUTPUT" 63 echo "Force rebuild requested for version ${NEW}" 64 else 65 TAGS=$(curl -sf "https://registry.midnightthoughts.space/v2/mtrnord/mediawiki/tags/list" \ 66 | grep -o '"tags":\[[^]]*\]' || echo "") 67 if echo "$TAGS" | grep -q "\"${NEW}\""; then 68 echo "needs_build=false" >> "$GITHUB_OUTPUT" 69 echo "Version ${NEW} already exists in registry, skipping build" 70 else 71 echo "needs_build=true" >> "$GITHUB_OUTPUT" 72 echo "Version ${NEW} not found in registry, will build" 73 fi 74 fi 75 76 build: 77 name: Build, Push and Sign 78 needs: check 79 if: needs.check.outputs.needs_build == 'true' 80 runs-on: ubuntu-latest 81 environment: registry 82 steps: 83 - name: Checkout 84 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 85 with: 86 persist-credentials: false 87 88 - name: Set up QEMU 89 uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4 90 91 - name: Set up Docker Buildx 92 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 93 94 - name: Log in to self-hosted registry 95 uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4 96 with: 97 registry: registry.midnightthoughts.space 98 username: ${{ secrets.REGISTRY_USERNAME }} 99 password: ${{ secrets.REGISTRY_PASSWORD }} 100 101 - name: Install cosign 102 uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 103 with: 104 cosign-release: v3.0.5 105 106 - name: Build and push 107 id: build 108 uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7 109 with: 110 context: apps/talos_cluster/mediawiki 111 file: apps/talos_cluster/mediawiki/Dockerfile 112 push: true 113 build-args: | 114 MEDIAWIKI_VERSION=${{ needs.check.outputs.new_version }} 115 tags: | 116 registry.midnightthoughts.space/mtrnord/mediawiki:${{ needs.check.outputs.new_version }} 117 registry.midnightthoughts.space/mtrnord/mediawiki:latest 118 labels: | 119 org.opencontainers.image.description=MediaWiki personal wiki — custom image with bundled extensions 120 org.opencontainers.image.title=mediawiki 121 org.opencontainers.image.vendor=MTRNord 122 org.opencontainers.image.version=${{ needs.check.outputs.new_version }} 123 cache-from: type=gha 124 cache-to: type=gha,mode=max 125 platforms: linux/amd64,linux/arm64 126 127 - name: Sign image 128 env: 129 COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} 130 COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} 131 COSIGN_OCI_EXPERIMENTAL: "1" 132 COSIGN_EXPERIMENTAL: "1" 133 DIGEST: ${{ steps.build.outputs.digest }} 134 run: | 135 cosign sign --yes --key env://COSIGN_PRIVATE_KEY \ 136 --new-bundle-format=false \ 137 --use-signing-config=false \ 138 --registry-referrers-mode=oci-1-1 \ 139 "registry.midnightthoughts.space/mtrnord/mediawiki@${DIGEST}"