csi-driver-rclone/.github/workflows/docker-ghcr-release.yaml at 75f0fa8ec34f1e2324d09623ba7d8c15e51c5790 · veloxpack/csi-driver-rclone · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: Build and push Docker image to GHCR

# Trigger on tags and releases for production builds
on:
  push:
    tags:
      - 'v*'
  release:
    types: [published]
  pull_request:
    branches:
      - main
    paths:
      - 'Dockerfile'
      - 'cmd/**'
      - 'pkg/**'
      - 'internal/**'
      - '.github/workflows/docker-ghcr-release.yaml'

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          labels: |
            org.opencontainers.image.title=CSI Driver Rclone
            org.opencontainers.image.description=CSI Rclone Driver for Kubernetes - Mount cloud storage as persistent volumes
            org.opencontainers.image.vendor=VeloxPack

      - name: Build and push Docker image
        id: push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          platforms: ${{ github.event_name == 'pull_request' && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: false
          sbom: false
          build-args: |
            GIT_COMMIT=${{ github.sha }}
            BUILD_DATE=${{ github.event.repository.updated_at }}
            DRIVER_VERSION=${{ github.ref_name }}

      - name: Generate artifact attestation
        if: github.event_name != 'pull_request' && github.actor != 'nektos/act'
        continue-on-error: true
        uses: actions/attest-build-provenance@v3
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

      - name: Summary
        if: github.event_name != 'pull_request'
        run: |
          cat >> "${GITHUB_STEP_SUMMARY}" <<EOF
          ## 🐳 Docker Image Published to GHCR

          **Image:** \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}\`
          **Tags:**
          \`\`\`
          ${{ steps.meta.outputs.tags }}
          \`\`\`
          **Digest:** \`${{ steps.push.outputs.digest }}\`

          ### Pull Image

          \`\`\`bash
          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          \`\`\`

          ### Specific Version

          \`\`\`bash
          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}
          \`\`\`

          ### Verify Attestation

          \`\`\`bash
          gh attestation verify \\
            oci://${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \\
            --owner ${{ github.repository_owner }}
          \`\`\`

          ### Make Package Public

          📝 **Important:** By default, packages are private. To make this image publicly accessible:

          1. Go to: https://github.com/${{ github.repository_owner }}?tab=packages
          2. Click on the \`csi-driver-rclone\` package
          3. Click "Package settings"
          4. Scroll to "Danger Zone"
          5. Click "Change visibility" → Select "Public"

          ### Kubernetes Deployment

          Update your values.yaml:
          \`\`\`yaml
          image:
            rclone:
              repository: ghcr.io/${{ github.repository }}
              tag: ${{ github.ref_name }}
          \`\`\`
          EOF