vaultvulp/gp-docker-action

GitHub Action to build and publish Docker Images to GitHub Container Registry

GitHub Action to build and publish Docker Images to GitHub Container registry

Usage examples:

Build and publish Docker Image with the head tag for the develop branch

Complete workflow example

name: Build and publish

on: 
  push:
    branches:
    - "develop" # Running this workflow only for develop branch

jobs:
  build-and-publish-head:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/[email protected] # Checking out the repo

    - name: Build and publish "head" Docker image
      uses: VaultVulp/[email protected]
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }} # Provide GITHUB_TOKEN to login into the GitHub Packages
        image-name: my-cool-service # Provide Docker image name
        image-tag: head # Provide Docker image tag

Build and publish Docker Image with a latest tag for the master branch with different dockerfile

Complete workflow example

name: Build and publish

on: 
  push:
    branches:
    - "master" # Running this workflow only for master branch

jobs:
  build-and-publish-latest:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/[email protected] # Checking out the repo

    - name: Build and publish "latest" Docker image
      uses: VaultVulp/[email protected]
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }} # Provide GITHUB_TOKEN to login into the GitHub Packages
        image-name: my-cool-service # Provide only Docker image name, tag will be automatically set to latest
        dockerfile: Alternative.Dockerfile # Provide custom Dockerfile name

Build and publish Docker Image with a tag equal to a git tag

Complete workflow example

name: Build and publish

on: 
  push:
    tags:
    - "*" # Running this workflow for any tag

jobs:
  build-and-publish-tag:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/[email protected] # Checking out the repo
    
    - name: Build and publish Docker image tagged according to a git-tag
      uses: VaultVulp/[email protected]
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }} # Provide GITHUB_TOKEN to login into the GitHub Packages
        image-name: my-cool-service # Provide only Docker image name
        extract-git-tag: true # Provide flag to extract Docker image tag from git reference

Build and publish Docker Image with a different build context

Complete workflow example

name: Build and publish

on: push

jobs:
  build-and-publish-context:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/[email protected] # Checking out the repo
    
    - name: Build and publish Docker image from a different context
      uses: VaultVulp/[email protected]
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }} # Provide GITHUB_TOKEN to login into the GitHub Packages
        image-name: my-cool-service # Provide Docker image name
        build-context: ./dev # Provide path to the folder with a Dockerfile

Pulling an image before building it

Complete workflow example

name: Build and publish

on: push

jobs:
  pull-and-build-and-publish:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/[email protected] # Checking out the repo

    - name: Pull, build and publish Docker image
      uses: VaultVulp/[email protected]
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }} # Provide GITHUB_TOKEN to login into the GitHub Packages
        image-name: my-cool-service # Provide Docker image name
        pull-image: true # Provide the flag to pull image

Passing additional image tags

NB, additional-image-tags will not replace image-tag argument - additional tags will be appended to the list. If no image-tag was specified, then image will be tagged with the latest tag.

Examples

image-tag was specified:

image-name: my-cool-service
image-tags: first
additional-image-tags: second third

Action will produce one image with three tags:

• my-cool-service:first
• my-cool-service:second
• my-cool-service:third

No image-tag was specified:

In this case action will use the default latest tag.

image-name: my-cool-service
additional-image-tags: second third

Action will produce one image with three tags:

• my-cool-service:latest
• my-cool-service:second
• my-cool-service:third

Complete workflow example

name: Build and publish 

on: push

jobs:
  build-with-multiple-tags:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/[email protected] # Checking out the repo
 
    - name: Build and publish Docker image with multiple tags
      uses: VaultVulp/[email protected]
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }} # Provide GITHUB_TOKEN to login into the GitHub Packages
        image-name: my-cool-service # Provide Docker image name
        image-tags: first # if ommitted will be replaced with "latest"
        additional-image-tags: second third # two additional tags for an image

Cross-platform builds

It's possible to leverage custom-args to build images for different architectures.

Examples

One architeture

custom-args: --platform=linux/arm64 # target architecture

Multiple architetures

custom-args: --platform=linux/arm64,linux/amd64 # multiple target architectures

Complete workflow example

name: Build and publish

on: push

jobs:
  cross-platform-builds:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/[email protected] # Checking out the repo
 
    - name: Build and publish Docker image for ARM64 and AMD64 architectures at the same time
      uses: VaultVulp/[email protected]
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }} # Provide GITHUB_TOKEN to login into the GitHub Packages
        image-name: my-cool-service # Provide Docker image name
        custom-args: --platform=linux/arm64,linux/amd64 # specify target architectures via the `custom-args` agrument

Passing additional arguments to the docker build command

NB, additional arguments should be passed with the = sign istead of a (space) between argument name and values.

Correct example:

custom-args: --build-arg=some="value" 
                      # ^ this "=" is mandatory

Incorrect example:

custom-args: --build-arg some="value" 
                      # ^ this space might break the action

Complete workflow example

name: Build and publish

on: push

jobs:
  build-with-custom-args:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/[email protected] # Checking out the repo
 
    - name: Build and publish Docker image with arbitrary --build-arg(s)
      uses: VaultVulp/[email protected]
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }} # Provide GITHUB_TOKEN to login into the GitHub Packages
        image-name: my-cool-service # Provide Docker image name
        custom-args: --build-arg=some="value" --build-arg=some_other="value" # Pass some additional arguments to the docker build command

My own repo with examples

VaultVulp/test-gp-docker-action

Security considerations

You will encounter the following log message in your GitHub Actions Pipelines:

WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /github/home/.docker/config.json.
Login Succeeded

I would like to ensure you, that I do not store your secrets, passwords, token, or any other information.

This warning informs you about the fact, that this Action passes your GitHub token via the command line argument:

docker login -u publisher -p ${DOCKER_TOKEN} ghcr.io

In a non-safe environment, this could raise a security issue, but this is not the case. We are passing a temporary authorization token, which will expire once the pipeline is completed. It would also require additional code to extract this token from the environment or docker internals, that this Action does not have.

This is the detailed explanation about the ${{ secrets.GITHUB_TOKEN }} and it's relations with the GCR.

gp-docker-action's Issues

Allow using the repository name as the image name

Currently, the full name of the image is <repo><image name>:<image tag>. However, my repository produces a single docker image. As a result, I would like for it to be <repo>:<tag>, so, I do not need the extra image name.

Can we make the image name parameter optional? Or maybe a flag to indicate this requirement which makes process not use the image name?

Add logic to build different architectures

Is it currently possible to build Containers for different architectures? or are you able to add that logic?

Building a node project with dependency inside docker image

Hi.

I have a node project that depends on a module (Github Packages) from another repo in the same organization.
I do npm install in the docker image to make sure it installs the same all the time.
I use .npmrc and my personal token to authenticate the other repo to npm install the module that my project depends on.

Any alternatives?

build-context does not work

I sued to have my Dockerfile in the root of the project, but now I'm organizing my project into subfolders, so I moved the Dockerfile and all my app source into a subfolder docker-app.
So on my github action I added the param build-context: ./docker-app/ but now the CI is not working. I always get an error:

ERROR: failed to solve: failed to read dockerfile: open /tmp/buildkit-mount1250393087/Dockerfile: no such file or directory

(Question) Possibility or using mutliple tags for a single build

Is it possible to run a build and tag it with multiple tags?

The use case would be to use extract-git-tag: true while also updating a latest tag up to date.

Thanks in advance!

ERROR: invalid tag

I know this quite possibly something I have misconfigured but I'm pulling my hair out trying to find it.

This is the content of my workflow file:

name: Docker CI/CD - Unstable
on:
  push:
    branches: [ unstable ]
  pull_request:
    branches: [ unstable ]

jobs:
  build-docker:
    name: Build Docker image
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/unstable'
    steps:
      - uses: actions/checkout@v3
      - name: Build and Publish head Docker image
        uses: VaultVulp/[email protected]
        with:
          image: npp-orchestrator-unstable
          github-token: ${{ secrets.GH_TOKEN }}
          extract-git-tag: true
          additional-image-tags: unstable
          custom-args: --platform=linux/arm64,linux/amd64

  deploy:
    name: Call web hook to deploy container
    runs-on: ubuntu-latest
    needs: [build-docker]
    steps:
      - name: Deploy container
        uses: distributhor/workflow-webhook@v2
        env:
          webhook_url: ${{ secrets.DEPLOY_WEBHOOK_URL }}
          webhook_secret: ${{ secrets.DEPLOY_WEBHOOK_SIGNATURE }}

When running the workflow I get the following error:

ERROR: invalid tag "ghcr.io/agent-squirrel/npp-app-test/:unstable": invalid reference format

Is there something I'm missing or is this a bug perhaps?

Thanks

It looks like the version is wrong in the marketplace

In the marketplace there is this code to copy and paste which claims to use "GitHub Packages" but it uses the old "GitHub docker".
When I change "VaultVulp/[email protected]" into "VaultVulp/[email protected]" everything works.
So I think you need to update the "template".

Build Args do not work

I am trying to pass build args to this action and it does not seem to want to work. I have tried with quotes, without quotes, nothing I try seems to be working.

Build here shows using linx-x86: https://github.com/parkeradam/DDNSUpdate/runs/5602781210?check_suite_focus=true
Action file has build arg specified as linux-arm : https://github.com/parkeradam/DDNSUpdate/blob/4683dbd1d51be6ec0c41cd98a5c421ba3be29044/.github/workflows/arm-build.yml

Am i missing something?

Thanks in advance.

publisher user

question:
is publisher user a special user to publish stuff of github?
do you have documentation on this?
Thans

Support for Docker build-args

It does not appear as though support for providing build-time arguments before publishing the image exists. Is there a plan to introduce it?

Password stored warning

I'm getting this warning when running the action:

WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Login Succeeded
WARNING! Your password will be stored unencrypted in /github/home/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Is that expected?