1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# Docker build + push
# Third-party Actions are pinned to immutable commit SHAs (Aikido supply-chain policy).
# Uses local Docker Buildx + Docker Hub login (no Build Cloud dependency).
name: Docker Build & Push
on:
push:
branches:
pull_request:
branches:
types:
jobs:
docker:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Log in to Docker Hub
# Dependabot PRs lack secrets; same-repo human PRs keep authenticated pulls.
if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]')
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
with:
username: ${{ vars.DOCKER_USER }}
password: ${{ secrets.DOCKER_PAT }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
- name: Set image tag
id: image
run: |
if [ "${{ github.event_name }}" = "pull_request" ]; then
echo "tag=neuromod:pr-${{ github.sha }}" >> "$GITHUB_OUTPUT"
else
echo "tag=${{ vars.DOCKER_USER }}/neuromod:${{ github.sha }}" >> "$GITHUB_OUTPUT"
fi
- name: Build and push
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
load: ${{ github.event_name == 'pull_request' }}
tags: ${{ steps.image.outputs.tag }}
outputs: ${{ github.event_name == 'pull_request' && 'type=docker' || 'type=registry' }}
- name: Verify image builds example binary
if: github.event_name == 'pull_request'
run: |
docker run --rm "${{ steps.image.outputs.tag }}" ls /usr/local/bin/