mfwadejr
afa8da647f
Publish container / publish (push) Successful in 49s
Gitea's own auto-injected GITHUB_TOKEN isn't authorized to write packages on this instance even with packages:write declared, so the Gitea-side publish kept failing at login despite targeting the right registry. Added a REGISTRY_TOKEN repo secret (Gitea PAT scoped to package: read/write only) and use it when the runner is Gitea; GitHub keeps using its own real GITHUB_TOKEN for ghcr.io.
56 lines
1.6 KiB
YAML
56 lines
1.6 KiB
YAML
name: Publish container
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ["v*"]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Determine target registry
|
|
id: registry
|
|
run: |
|
|
if [ "${{ github.server_url }}" = "https://github.com" ]; then
|
|
echo "registry=ghcr.io" >> "$GITHUB_OUTPUT"
|
|
echo "image=ghcr.io/mfwadejr/vboxstock" >> "$GITHUB_OUTPUT"
|
|
else
|
|
host="$(printf '%s' '${{ github.server_url }}' | sed -E 's#^https?://##')"
|
|
echo "registry=$host" >> "$GITHUB_OUTPUT"
|
|
echo "image=$host/marvin/vboxstock" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Sign in to container registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ steps.registry.outputs.registry }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ github.server_url == 'https://github.com' && secrets.GITHUB_TOKEN || secrets.REGISTRY_TOKEN }}
|
|
|
|
- name: Generate image tags
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ steps.registry.outputs.image }}
|
|
tags: |
|
|
type=raw,value=latest,enable={{is_default_branch}}
|
|
type=ref,event=tag
|
|
type=sha
|
|
|
|
- name: Build and publish image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|