126 lines
4.7 KiB
YAML
126 lines
4.7 KiB
YAML
name: Release 镜像
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
tags: ["v*", "26.*", "27.*"]
|
||
workflow_dispatch:
|
||
|
||
env:
|
||
REGISTRY: registry.cn-hangzhou.aliyuncs.com
|
||
IMAGE: registry.cn-hangzhou.aliyuncs.com/skymirror/fileshare
|
||
|
||
jobs:
|
||
test:
|
||
name: 测试（推送前置门禁）
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: golang:1.27.1-alpine
|
||
timeout-minutes: 30
|
||
steps:
|
||
- name: 安装工具并检出
|
||
env:
|
||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||
run: |
|
||
sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
|
||
apk add --no-cache git curl bash >/dev/null
|
||
SCHEME="${GITHUB_SERVER_URL%%://*}"
|
||
SRV="${GITHUB_SERVER_URL#*://}"
|
||
echo "clone from ${SCHEME}://${SRV}"
|
||
git clone --depth=1 --branch "$GITHUB_REF_NAME" \
|
||
"${SCHEME}://oauth2:${GITHUB_TOKEN}@${SRV}/${GITHUB_REPOSITORY}.git" .
|
||
|
||
- name: go vet + go test
|
||
working-directory: server
|
||
env:
|
||
GOCACHE: /tmp/.gocache
|
||
GOMODCACHE: /tmp/.gomodcache
|
||
CGO_ENABLED: "0"
|
||
run: |
|
||
go vet ./...
|
||
go test ./... -count=1
|
||
|
||
build-push:
|
||
name: 多架构构建并推送 ACR
|
||
needs: test
|
||
runs-on: ubuntu-latest
|
||
# dind 自带独立 daemon：不依赖 runner 宿主机 docker.sock 转发配置
|
||
container:
|
||
image: docker:27-dind
|
||
options: --privileged
|
||
env:
|
||
DOCKER_HOST: unix:///var/run/docker.sock
|
||
DOCKER_TLS_CERTDIR: ""
|
||
timeout-minutes: 120
|
||
steps:
|
||
- name: 启动 dind daemon 并检出
|
||
env:
|
||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||
run: |
|
||
sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
|
||
apk add --no-cache git bash >/dev/null
|
||
# dind daemon 配置国内 registry mirror（docker.io 直连不可达）
|
||
mkdir -p /etc/docker
|
||
printf '{"registry-mirrors":["https://docker.m.daocloud.io","https://docker.1ms.run"]}' \
|
||
> /etc/docker/daemon.json
|
||
dockerd --host=unix:///var/run/docker.sock >/tmp/dockerd.log 2>&1 &
|
||
for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 1; done
|
||
docker info --format 'dind 就绪: {{.ServerVersion}}'
|
||
SCHEME="${GITHUB_SERVER_URL%%://*}"
|
||
SRV="${GITHUB_SERVER_URL#*://}"
|
||
git clone --depth=1 --branch "$GITHUB_REF_NAME" \
|
||
"${SCHEME}://oauth2:${GITHUB_TOKEN}@${SRV}/${GITHUB_REPOSITORY}.git" .
|
||
|
||
- name: 安装 QEMU binfmt（跨架构）
|
||
run: |
|
||
docker run --rm --privileged tonistiigi/binfmt:latest --install all 2>/dev/null \
|
||
|| docker run --rm --privileged docker.m.daocloud.io/tonistiigi/binfmt:latest --install all
|
||
|
||
- name: 计算 tag（以 APP_VERSION 为唯一版本源）
|
||
id: meta
|
||
env:
|
||
REF: ${{ gitea.ref }}
|
||
run: |
|
||
VER=$(sed -n 's/.*APP_VERSION = "\(.*\)".*/\1/p' server/cmd/server/main.go | head -1)
|
||
[ -n "$VER" ] || { echo "无法从 main.go 解析 APP_VERSION" >&2; exit 1; }
|
||
echo "APP_VERSION=$VER"
|
||
if [[ "$REF" == refs/tags/* ]]; then
|
||
# tag 触发：要求 tag 名与 APP_VERSION 一致，防错版发布
|
||
TAG_VER="${REF#refs/tags/}"
|
||
TAG_VER="${TAG_VER#v}"
|
||
[ "$TAG_VER" = "$VER" ] || { echo "tag($TAG_VER) != APP_VERSION($VER)，拒绝发布" >&2; exit 1; }
|
||
fi
|
||
echo "version=$VER" >> "$GITHUB_OUTPUT"
|
||
echo "tags=${IMAGE}:${VER} ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: 登录阿里云 ACR
|
||
env:
|
||
ACR_USER: ${{ secrets.ACR_USERNAME }}
|
||
ACR_PASS: ${{ secrets.ACR_PASSWORD }}
|
||
run: |
|
||
echo "ACR 用户: $ACR_USER (密码 ${#ACR_PASS} 位)"
|
||
printf '%s' "$ACR_PASS" | docker login "$REGISTRY" -u "$ACR_USER" --password-stdin
|
||
|
||
- name: buildx 多架构构建并推送
|
||
env:
|
||
TAGS: ${{ steps.meta.outputs.tags }}
|
||
run: |
|
||
docker buildx create --name ci --driver docker-container --use 2>/dev/null || docker buildx use ci
|
||
ARGS=""
|
||
for t in $TAGS; do ARGS="$ARGS -t $t"; done
|
||
# provenance/sbom 必须关：阿里云 ACR 不识别 OCI empty manifest（attestation）
|
||
docker buildx build \
|
||
--platform linux/amd64,linux/arm64 \
|
||
--provenance=false --sbom=false \
|
||
--push \
|
||
-f deploy/Dockerfile \
|
||
$ARGS \
|
||
.
|
||
|
||
- name: 校验远程 manifest（双架构）
|
||
env:
|
||
VERSION: ${{ steps.meta.outputs.version }}
|
||
run: |
|
||
docker buildx imagetools inspect "${IMAGE}:${VERSION}" | grep -E "linux/amd64|linux/arm64"
|
||
echo "推送完成: ${IMAGE}:${VERSION} + ${IMAGE}:latest"
|