diff --git a/.github/workflows/docker-registry.yml b/.github/workflows/docker-registry.yml new file mode 100644 index 00000000..957fb389 --- /dev/null +++ b/.github/workflows/docker-registry.yml @@ -0,0 +1,154 @@ +name: Build and Publish Docker Image + +on: + push: + branches: + - main + - dev + tags: + - 'v*' + pull_request: + branches: + - main + - dev + +env: + REGISTRY: ghcr.io + IMAGE_NAME: fr1ngg/remnawave-bedolaga-telegram-bot + +jobs: + build-and-push: + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + with: + driver-opts: | + network=host + + - name: Log in to Container Registry + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Get version info + id: version + run: | + echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT + echo "build_date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT + + if [[ $GITHUB_REF == refs/tags/* ]]; then + VERSION=${GITHUB_REF#refs/tags/} + echo "🏷️ Собираем релизную версию: $VERSION" + elif [[ $GITHUB_REF == refs/heads/main ]]; then + VERSION="v2.3.4" + echo "🚀 Собираем версию из main: $VERSION" + elif [[ $GITHUB_REF == refs/heads/dev ]]; then + VERSION="v2.3.4-dev-$(git rev-parse --short HEAD)" + echo "🧪 Собираем dev версию: $VERSION" + else + VERSION="v2.3.4-pr-$(git rev-parse --short HEAD)" + echo "🔀 Собираем PR версию: $VERSION" + fi + echo "version=$VERSION" >> $GITHUB_OUTPUT + + # Определяем, нужно ли пушить образ + if [[ "${{ github.event_name }}" == "pull_request" ]]; then + if [[ "${{ github.event.pull_request.head.repo.full_name }}" == "${{ github.repository }}" ]]; then + echo "should_push=true" >> $GITHUB_OUTPUT + echo "✅ PR из того же репозитория - будем пушить" + else + echo "should_push=false" >> $GITHUB_OUTPUT + echo "⚠️ PR из внешнего форка - только build без push" + fi + else + echo "should_push=true" >> $GITHUB_OUTPUT + echo "✅ Push/Tag - будем пушить" + fi + + - name: Extract metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=raw,value=latest,enable={{is_default_branch}} + type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }} + type=raw,value=${{ steps.version.outputs.version }} + + - name: Build and push Docker image + uses: docker/build-push-action@v5 + with: + context: . + file: ./Dockerfile + platforms: linux/amd64 + push: ${{ steps.version.outputs.should_push }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + build-args: | + VERSION=${{ steps.version.outputs.version }} + BUILD_DATE=${{ steps.version.outputs.build_date }} + VCS_REF=${{ steps.version.outputs.short_sha }} + cache-from: | + type=gha + type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache + cache-to: | + type=gha,mode=max + type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max + build-contexts: | + alpine=docker-image://alpine:latest + + - name: Generate security report + uses: docker/scout-action@v1 + if: github.event_name == 'pull_request' && steps.version.outputs.should_push == 'true' + with: + command: quickview,compare + image: ${{ steps.meta.outputs.tags }} + to: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest + ignore-unchanged: true + only-severities: critical,high + write-comment: true + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Build Summary + if: steps.version.outputs.should_push == 'true' + run: | + echo "## 🚀 Docker Build Summary" >> $GITHUB_STEP_SUMMARY + echo "| Параметр | Значение |" >> $GITHUB_STEP_SUMMARY + echo "|----------|----------|" >> $GITHUB_STEP_SUMMARY + echo "| **Версия** | \`${{ steps.version.outputs.version }}\` |" >> $GITHUB_STEP_SUMMARY + echo "| **Коммит** | \`${{ steps.version.outputs.short_sha }}\` |" >> $GITHUB_STEP_SUMMARY + echo "| **Дата сборки** | \`${{ steps.version.outputs.build_date }}\` |" >> $GITHUB_STEP_SUMMARY + echo "| **Registry** | \`${{ env.REGISTRY }}\` |" >> $GITHUB_STEP_SUMMARY + echo "| **Образ** | \`${{ env.IMAGE_NAME }}\` |" >> $GITHUB_STEP_SUMMARY + echo "| **Ветка** | \`${{ github.ref_name }}\` |" >> $GITHUB_STEP_SUMMARY + echo "| **Статус** | ✅ Опубликован |" >> $GITHUB_STEP_SUMMARY + + - name: Build Summary (No Push) + if: steps.version.outputs.should_push == 'false' + run: | + echo "## 🔨 Docker Build Summary (Test Only)" >> $GITHUB_STEP_SUMMARY + echo "| Параметр | Значение |" >> $GITHUB_STEP_SUMMARY + echo "|----------|----------|" >> $GITHUB_STEP_SUMMARY + echo "| **Версия** | \`${{ steps.version.outputs.version }}\` |" >> $GITHUB_STEP_SUMMARY + echo "| **Коммит** | \`${{ steps.version.outputs.short_sha }}\` |" >> $GITHUB_STEP_SUMMARY + echo "| **Дата сборки** | \`${{ steps.version.outputs.build_date }}\` |" >> $GITHUB_STEP_SUMMARY + echo "| **Статус** | ✅ Собран успешно (без публикации) |" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "⚠️ **Примечание:** Образ собран но не опубликован, так как это PR из внешнего форка." >> $GITHUB_STEP_SUMMARY