Skip to content

Docker Build and Push #14

Docker Build and Push

Docker Build and Push #14

Workflow file for this run

name: Docker Build and Push
on:
schedule:
- cron: '30 2 * * *'
push:
branches:
- main
- release-*
tags:
- 'v*.*.*'
- 'v*.*.*-*'
workflow_dispatch:
jobs:
build-voiceflow:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Docker Buildx
uses: docker/[email protected]
# 改进的缓存配置
- name: Cache Docker layers
uses: actions/cache@v4
with:
path: /tmp/.buildx-cache
key: ${{ runner.os }}-buildx-${{ github.sha }}
restore-keys: |
${{ runner.os }}-buildx-
# 添加 Trivy 缓存
- name: Cache Trivy vulnerability database
uses: actions/cache@v4
with:
path: ~/.cache/trivy
key: trivy-${{ github.sha }}
restore-keys: |
trivy-
- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Log in to AliYun Docker Hub
uses: docker/login-action@v3
with:
registry: registry.cn-hangzhou.aliyuncs.com
username: ${{ secrets.ALIREGISTRY_USERNAME }}
password: ${{ secrets.ALIREGISTRY_TOKEN }}
- name: Log in to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Get Docker metadata
id: metadata
uses: docker/[email protected]
with:
images: |
docker.io/telepace/voiceflow
registry.cn-hangzhou.aliyuncs.com/telepace/voiceflow
ghcr.io/telepace/voiceflow
tags: |
type=ref,event=tag
type=schedule
type=ref,event=branch
type=ref,event=pr
type=semver,pattern={{version}}
type=semver,pattern=v{{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
type=sha
# 改进的构建步骤
- name: Build and push Docker image for voiceflow
uses: docker/build-push-action@v5
with:
context: .
file: ./build/images/voiceflow/Dockerfile
platforms: linux/amd64,linux/arm64
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.metadata.outputs.tags }}
labels: ${{ steps.metadata.outputs.labels }}
cache-from: type=local,src=/tmp/.buildx-cache
cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
build-args: |
VERSION=${{ steps.metadata.outputs.version }}
provenance: true
# 修改缓存路径
- name: Move cache
run: |
rm -rf /tmp/.buildx-cache
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
# 改进的 Trivy 扫描配置
- name: Scan Docker image for vulnerabilities
uses: aquasecurity/[email protected]
with:
image-ref: docker.io/telepace/voiceflow:${{ steps.metadata.outputs.version }}
format: 'table'
exit-code: '1'
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
timeout: '5m'
cache-dir: ~/.cache/trivy
- name: Clean up Docker
if: always()
run: docker system prune -f