67 lines
2.5 KiB
YAML
67 lines
2.5 KiB
YAML
name: Docker
|
|
# Canonical Node base image (Node 24 + sqlite3) for all Hanzo Node services.
|
|
# Self-contained build on the Hanzo self-hosted ARC pool (hanzo-build-linux-amd64).
|
|
# Semver only: a `v*` git tag publishes ghcr.io/hanzoai/nodejs:<tag> + the moving
|
|
# major tag :v24. NEVER :latest / :sha (per Hanzo semver-only policy).
|
|
# amd64-only — DOKS has no arm64 droplets (LLM.md, 2026-04-27).
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
tags: ['v*']
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
jobs:
|
|
docker:
|
|
# ARC v0.14 routes by scale-set NAME, not labels — name the pool directly.
|
|
runs-on: hanzo-build-linux-amd64
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Compute tags
|
|
id: tags
|
|
run: |
|
|
set -euo pipefail
|
|
REF="${GITHUB_REF_NAME}"
|
|
case "$REF" in
|
|
v[0-9]*) VER="$REF" ;; # tag push: v24.18.0
|
|
*) VER="v$(grep -oE 'node:[0-9]+\.[0-9]+\.[0-9]+' Dockerfile | head -1 | cut -d: -f2)" ;;
|
|
esac # dispatch: derive from FROM pin
|
|
MAJOR="$(echo "$VER" | grep -oE '^v[0-9]+')"
|
|
echo "ver=$VER" >> "$GITHUB_OUTPUT"
|
|
echo "major=$MAJOR" >> "$GITHUB_OUTPUT"
|
|
echo "Publishing: ghcr.io/hanzoai/nodejs:$VER + :$MAJOR"
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Login to GHCR
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build and push (linux/amd64)
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64
|
|
push: true
|
|
# No attestation/SBOM manifest — its extra blob push 403s on a new
|
|
# GHCR package's first publish (matches the canonical shared workflow).
|
|
provenance: false
|
|
sbom: false
|
|
tags: |
|
|
ghcr.io/hanzoai/nodejs:${{ steps.tags.outputs.ver }}
|
|
ghcr.io/hanzoai/nodejs:${{ steps.tags.outputs.major }}
|
|
cache-from: type=gha,scope=hanzoai-nodejs
|
|
cache-to: type=gha,scope=hanzoai-nodejs,mode=max
|
|
|
|
- name: Verify sqlite3 in the published image
|
|
run: |
|
|
set -euo pipefail
|
|
IMG="ghcr.io/hanzoai/nodejs:${{ steps.tags.outputs.ver }}"
|
|
docker pull "$IMG"
|
|
docker run --rm "$IMG" node -v
|
|
docker run --rm "$IMG" node -e "require('node:sqlite');console.log('node:sqlite loads on '+process.version)"
|