name: Build, test, and publish a Docker image
on:
push:
branches: ['main']
tags: ['v*']
env:
REGISTRY: ghcr.io
IMAGE_NAME: x402-rs/x402-facilitator
IMAGE_NAME_DH: ukstv/x402-facilitator
jobs:
metadata:
name: Docker Metadata
runs-on: ubuntu-24.04
outputs:
tags: ${{ steps.meta_main.outputs.tags || steps.meta_tag.outputs.tags }}
labels: ${{ steps.meta_main.outputs.labels || steps.meta_tag.outputs.labels }}
annotations: ${{ steps.meta_main.outputs.annotations || steps.meta_tag.outputs.annotations }}
json: ${{ steps.meta_main.outputs.json || steps.meta_tag.outputs.json }}
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Prepare Metadata (main)
if: github.ref == 'refs/heads/main'
id: meta_main
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=raw,value=dev
labels: true
annotations: true
- name: Prepare Metadata (release tag)
if: startsWith(github.ref, 'refs/tags/v')
id: meta_tag
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=raw,value=latest
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
labels: true
annotations: true
build-amd64:
name: Build (amd64)
runs-on: ubuntu-latest
needs: metadata
permissions:
contents: read
packages: write
attestations: write
id-token: write
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Docker login
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push amd64 image
id: build-and-push
uses: docker/build-push-action@v5
with:
context: .
push: true
provenance: mode=max
platforms: linux/amd64
tags: ${{ join(fromJSON(needs.metadata.outputs.json).tags, '-amd64,') }}-amd64
labels: ${{ needs.metadata.outputs.labels }}
annotations: ${{ needs.metadata.outputs.annotations }}
cache-from: type=gha,scope=amd64
cache-to: type=gha,mode=max,scope=amd64
- name: Generate image attestation
uses: actions/attest-build-provenance@v2
with:
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
subject-digest: ${{ steps.build-and-push.outputs.digest }}
push-to-registry: true
build-arm64:
name: Build (arm64)
runs-on: ubuntu-24.04-arm
needs: metadata
permissions:
contents: read
packages: write
attestations: write
id-token: write
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Docker login
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push arm64 image
id: build-and-push
uses: docker/build-push-action@v5
with:
context: .
push: true
provenance: mode=max
platforms: linux/arm64
tags: ${{ join(fromJSON(needs.metadata.outputs.json).tags, '-arm64,') }}-arm64
labels: ${{ needs.metadata.outputs.labels }}
annotations: ${{ needs.metadata.outputs.annotations }}
cache-from: type=gha,scope=arm64
cache-to: type=gha,mode=max,scope=arm64
- name: Generate image attestation
uses: actions/attest-build-provenance@v2
with:
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
subject-digest: ${{ steps.build-and-push.outputs.digest }}
push-to-registry: true
merge-manifest:
name: Merge amd64 and arm64 Docker manifests
runs-on: ubuntu-latest
needs: [build-amd64, build-arm64, metadata]
permissions:
contents: read
packages: write
attestations: write
id-token: write
outputs:
digests_matrix: ${{ steps.merge-manifest.outputs.digests_matrix }}
steps:
- name: Log in to GHCR
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
registry: docker.io
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Export description
run: |
DESCRIPTION=$(echo "${{ needs.metadata.outputs.annotations }}" | grep 'org.opencontainers.image.description=' | cut -d= -f2-)
echo "DESCRIPTION=$DESCRIPTION"
echo "DESCRIPTION=$DESCRIPTION" >> "$GITHUB_ENV"
- name: Merge all tags and capture digests
id: merge-manifest
run: |
echo "Merging tags: ${{ needs.metadata.outputs.tags }}"
readarray -t FULL_TAGS <<< "${{ needs.metadata.outputs.tags }}"
digests_matrix="["
for full in "${FULL_TAGS[@]}"; do
tag="${full##*:}"
echo "Merging manifest for: $tag"
docker buildx imagetools create \
--tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$tag \
--tag docker.io/${{ env.IMAGE_NAME_DH }}:$tag \
--annotation "index:org.opencontainers.image.description=$DESCRIPTION" \
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$tag-amd64 \
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$tag-arm64
digest=$(docker buildx imagetools inspect --format '{{json .Manifest}}' ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$tag | jq -r '.digest')
digests_matrix+="{\"tag\":\"$tag\",\"digest\":\"$digest\"},"
done
digests_matrix="${digests_matrix%,}]"
echo "digests_matrix=$digests_matrix" >> $GITHUB_OUTPUT
attest-digests:
name: Attest merged manifests
needs: merge-manifest
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
attestations: write
id-token: write
strategy:
matrix:
digest_entry: ${{ fromJson(needs.merge-manifest.outputs.digests_matrix) }}
steps:
- name: Docker login
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
registry: docker.io
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Attest ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.digest_entry.tag }}
uses: actions/attest-build-provenance@v2
with:
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
subject-digest: ${{ matrix.digest_entry.digest }}
push-to-registry: true
- name: Attest docker.io/${{ env.IMAGE_NAME_DH }}:${{ matrix.digest_entry.tag }}
uses: actions/attest-build-provenance@v2
with:
subject-name: docker.io/${{ env.IMAGE_NAME_DH }}
subject-digest: ${{ matrix.digest_entry.digest }}
push-to-registry: true