Skip to content

Commit 109b918

Browse files
MatrixSevenMatrixSeven
committed
feat:修复github action
1 parent 055deea commit 109b918

File tree

2 files changed

+164
-70
lines changed

2 files changed

+164
-70
lines changed

‎.github/workflows/docker-publish.yml‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
12
name: 🐳 Build and Push Docker Image
23

34
on:
@@ -37,15 +38,20 @@ jobs:
3738
build:
3839
name: 🏗️ Build & Push Docker Image
3940
runs-on: ubuntu-latest
40-
41+
4142
permissions:
4243
contents: read
4344
packages: write
44-
45+
4546
steps:
4647
- name: 📥 Checkout code
4748
uses: actions/checkout@v4
48-
49+
50+
- name: 🚀 Set up QEMU
51+
uses: docker/setup-qemu-action@v3
52+
with:
53+
platforms: linux/amd64,linux/arm64
54+
4955
- name: 🏷️ Extract metadata
5056
id: meta
5157
uses: docker/metadata-action@v5
@@ -64,6 +70,10 @@ jobs:
6470
uses: docker/setup-buildx-action@v3
6571
with:
6672
platforms: linux/amd64,linux/arm64
73+
driver-opts: |
74+
network=host
75+
buildkitd-flags: |
76+
--allow-insecure-entitlement=network.host
6777
6878
- name: 🔑 Login to Docker Hub
6979
if: github.event_name != 'pull_request'
@@ -84,11 +94,15 @@ jobs:
8494
labels: ${{ steps.meta.outputs.labels }}
8595
cache-from: type=gha
8696
cache-to: type=gha,mode=max
97+
build-args: |
98+
BUILDKIT_INLINE_CACHE=1
99+
provenance: false
100+
sbom: false
87101

88102
- name: 📊 Image digest
89103
if: github.event_name != 'pull_request'
90104
run: echo ${{ steps.build.outputs.digest }}
91-
105+
92106
- name: 🎉 Build Summary
93107
if: always()
94108
run: |
@@ -110,20 +124,21 @@ jobs:
110124
runs-on: ubuntu-latest
111125
needs: build
112126
if: github.event_name != 'pull_request'
113-
127+
114128
steps:
115129
- name: 📥 Checkout code
116130
uses: actions/checkout@v4
117-
131+
118132
- name: 🔍 Run Trivy vulnerability scanner
119133
uses: aquasecurity/trivy-action@master
120134
with:
121135
image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest'
122136
format: 'sarif'
123137
output: 'trivy-results.sarif'
124-
138+
125139
- name: 📤 Upload Trivy scan results
126140
uses: github/codeql-action/upload-sarif@v3
127141
if: always()
128142
with:
129143
sarif_file: 'trivy-results.sarif'
144+

‎Dockerfile‎

Lines changed: 142 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,144 @@
1-
# ==============================================
2-
# 最简 Dockerfile - 专为 Docker 环境优化
3-
# ==============================================
41

5-
FROM node:20-alpine AS builder
2+
name: 🐳 Build and Push Docker Image
3+
4+
on:
5+
# 手动触发
6+
workflow_dispatch:
7+
inputs:
8+
version:
9+
description: '版本号 (例如: v1.0.5)'
10+
required: true
11+
default: 'v1.0.5'
12+
type: string
13+
push_to_hub:
14+
description: '推送到 Docker Hub'
15+
required: true
16+
default: true
17+
type: boolean
18+
build_multiarch:
19+
description: '构建多架构镜像 (amd64 + arm64)'
20+
required: true
21+
default: true
22+
type: boolean
23+
24+
# 推送标签时触发
25+
push:
26+
tags:
27+
- 'v*.*.*'
28+
29+
# PR 时构建测试（不推送）
30+
pull_request:
31+
branches: [ main ]
32+
33+
env:
34+
REGISTRY: docker.io
35+
IMAGE_NAME: matrixseven/file-transfer-go
36+
37+
jobs:
38+
build:
39+
name: 🏗️ Build & Push Docker Image
40+
runs-on: ubuntu-latest
41+
42+
permissions:
43+
contents: read
44+
packages: write
45+
46+
steps:
47+
- name: 📥 Checkout code
48+
uses: actions/checkout@v4
49+
50+
- name: 🚀 Set up QEMU
51+
uses: docker/setup-qemu-action@v3
52+
with:
53+
platforms: linux/amd64,linux/arm64
54+
55+
- name: 🏷️ Extract metadata
56+
id: meta
57+
uses: docker/metadata-action@v5
58+
with:
59+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
60+
tags: |
61+
type=ref,event=branch
62+
type=ref,event=pr
63+
type=semver,pattern={{version}}
64+
type=semver,pattern={{major}}.{{minor}}
65+
type=semver,pattern={{major}}
66+
type=raw,value=latest,enable={{is_default_branch}}
67+
type=raw,value=${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' }}
68+
69+
- name: 🔧 Set up Docker Buildx
70+
uses: docker/setup-buildx-action@v3
71+
with:
72+
platforms: linux/amd64,linux/arm64
73+
driver-opts: |
74+
network=host
75+
buildkitd-flags: |
76+
--allow-insecure-entitlement=network.host
77+
78+
- name: 🔑 Login to Docker Hub
79+
if: github.event_name != 'pull_request'
80+
uses: docker/login-action@v3
81+
with:
82+
registry: ${{ env.REGISTRY }}
83+
username: ${{ secrets.DOCKER_HUB_USERNAME }}
84+
password: ${{ secrets.DOCKER_HUB_TOKEN }}
85+
86+
- name: 🐳 Build and push Docker image
87+
uses: docker/build-push-action@v5
88+
with:
89+
context: .
90+
file: ./Dockerfile
91+
platforms: ${{ (github.event_name == 'workflow_dispatch' && inputs.build_multiarch == true) || github.event_name == 'push' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
92+
push: ${{ github.event_name != 'pull_request' && (inputs.push_to_hub != false) }}
93+
tags: ${{ steps.meta.outputs.tags }}
94+
labels: ${{ steps.meta.outputs.labels }}
95+
cache-from: type=gha
96+
cache-to: type=gha,mode=max
97+
build-args: |
98+
BUILDKIT_INLINE_CACHE=1
99+
provenance: false
100+
sbom: false
101+
102+
- name: 📊 Image digest
103+
if: github.event_name != 'pull_request'
104+
run: echo ${{ steps.build.outputs.digest }}
105+
106+
- name: 🎉 Build Summary
107+
if: always()
108+
run: |
109+
echo "## 🐳 Docker Build Summary" >> $GITHUB_STEP_SUMMARY
110+
echo "" >> $GITHUB_STEP_SUMMARY
111+
echo "### 📦 Image Details" >> $GITHUB_STEP_SUMMARY
112+
echo "- **Registry**: ${{ env.REGISTRY }}" >> $GITHUB_STEP_SUMMARY
113+
echo "- **Image**: ${{ env.IMAGE_NAME }}" >> $GITHUB_STEP_SUMMARY
114+
echo "- **Tags**: ${{ steps.meta.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
115+
echo "- **Platforms**: ${{ (github.event_name == 'workflow_dispatch' && inputs.build_multiarch == true) || github.event_name == 'push' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}" >> $GITHUB_STEP_SUMMARY
116+
echo "" >> $GITHUB_STEP_SUMMARY
117+
echo "### 🚀 Usage" >> $GITHUB_STEP_SUMMARY
118+
echo '```bash' >> $GITHUB_STEP_SUMMARY
119+
echo "docker run -d -p 8080:8080 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.version || 'latest' }}" >> $GITHUB_STEP_SUMMARY
120+
echo '```' >> $GITHUB_STEP_SUMMARY
121+
122+
security-scan:
123+
name: 🔍 Security Scan
124+
runs-on: ubuntu-latest
125+
needs: build
126+
if: github.event_name != 'pull_request'
127+
128+
steps:
129+
- name: 📥 Checkout code
130+
uses: actions/checkout@v4
131+
132+
- name: 🔍 Run Trivy vulnerability scanner
133+
uses: aquasecurity/trivy-action@master
134+
with:
135+
image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest'
136+
format: 'sarif'
137+
output: 'trivy-results.sarif'
138+
139+
- name: 📤 Upload Trivy scan results
140+
uses: github/codeql-action/upload-sarif@v3
141+
if: always()
142+
with:
143+
sarif_file: 'trivy-results.sarif'
6144

7-
# 国内镜像源优化
8-
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories && \
9-
npm config set registry https://registry.npmmirror.com
10-
11-
# 安装必要工具
12-
RUN apk add --no-cache bash git curl wget make ca-certificates tzdata
13-
14-
# 安装 Go
15-
ENV GO_VERSION=1.21.5
16-
RUN wget https://mirrors.aliyun.com/golang/go${GO_VERSION}.linux-amd64.tar.gz && \
17-
tar -C /usr/local -xzf go${GO_VERSION}.linux-amd64.tar.gz && \
18-
rm go${GO_VERSION}.linux-amd64.tar.gz
19-
20-
# Go 环境
21-
ENV PATH=/usr/local/go/bin:$PATH
22-
ENV GOPROXY=https://goproxy.cn,direct
23-
24-
WORKDIR /app
25-
26-
# Go 依赖
27-
COPY go.mod go.sum ./
28-
RUN go mod download
29-
30-
# 前端依赖和构建
31-
COPY chuan-next/package.json ./chuan-next/
32-
RUN cd chuan-next && npm install
33-
34-
COPY chuan-next/ ./chuan-next/
35-
# 临时移除 API 目录进行 SSG 构建（模仿 build-fullstack.sh）
36-
RUN cd chuan-next && \
37-
if [ -d "src/app/api" ]; then mv src/app/api /tmp/api-backup; fi && \
38-
NEXT_EXPORT=true npm run build && \
39-
if [ -d "/tmp/api-backup" ]; then mv /tmp/api-backup src/app/api; fi
40-
41-
# Go 源码和构建
42-
COPY cmd/ ./cmd/
43-
COPY internal/ ./internal/
44-
45-
# 嵌入前端文件
46-
RUN mkdir -p internal/web/frontend && \
47-
cp -r chuan-next/out/* internal/web/frontend/
48-
49-
# 构建 Go 应用
50-
RUN CGO_ENABLED=0 go build -ldflags='-w -s' -o server ./cmd
51-
52-
# ==============================================
53-
54-
FROM alpine:3.18
55-
56-
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories && \
57-
apk add --no-cache ca-certificates tzdata && \
58-
adduser -D -s /bin/sh appuser
59-
60-
WORKDIR /app
61-
COPY --from=builder --chown=appuser:appuser /app/server ./
62-
USER appuser
63-
64-
EXPOSE 8080
65-
CMD ["./server"]

0 commit comments

Comments
 (0)