public/once-campfire
1
0 Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-10-17 19:56:30 +09:00
Code Issues Packages Projects Releases Wiki Activity

Build only into once-campfire-edge; release-images promotes releases

Browse Source 
This repository's token now writes only the edge package. basecamp/release-images copies an approved edge digest into the release package, so the release environment and the publish token are no longer used here.
This commit is contained in:
Jeremy Daer committed 2026-10-07 22:55:31 -07:00
1 parent 9ea475a386
commit 5b28b3106a
1 file changed
+6 -24
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/publish-image.yml
+6 -24
View File
@@ -41,8 +41,7 @@ jobs:
arch: arm64
env:
REGISTRY: ghcr.io
# Per-arch images always go to <repo>-edge, with this repository's own token;
# the release package receives them only through the manifest job below.
# Everything goes to <repo>-edge, with this repository's own token.
IMAGE_NAME: ${{ github.repository }}-edge
steps:
- name: Checkout
@@ -89,9 +88,6 @@ jobs:
type=ref,event=branch
type=ref,event=tag
type=sha,format=short,prefix=sha-
type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
type=semver,pattern={{major}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
flavor: |
latest=false
suffix=-${{ matrix.arch }}
@@ -130,7 +126,8 @@ jobs:
name: Create multi-arch manifest and sign
needs: build
if: github.event_name != 'pull_request'
environment: ${{ startsWith(github.ref, 'refs/tags/v') && 'release' || 'edge' }}
# Multi-platform tags, signed, in <repo>-edge only. basecamp/release-images
# promotes v* tags from there into the release package after a reviewer approves.
runs-on: ubuntu-latest
permissions:
contents: read
@@ -139,8 +136,7 @@ jobs:
timeout-minutes: 20
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ startsWith(github.ref, 'refs/tags/v') && github.repository || format('{0}-edge', github.repository) }}
EDGE_IMAGE_NAME: ${{ github.repository }}-edge
IMAGE_NAME: ${{ github.repository }}-edge
steps:
- name: Set up Docker Buildx (for imagetools)
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
@@ -149,12 +145,8 @@ jobs:
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: ${{ env.REGISTRY }}
# GHCR_PUBLISH_TOKEN (classic PAT, write:packages, machine user) exists only in
# the `release` environment. Once the release package's Actions access is locked
# to read, this repository's GITHUB_TOKEN cannot push to it; until then the
# fallback keeps releases working.
username: ${{ secrets.GHCR_PUBLISH_TOKEN && vars.GHCR_PUBLISH_USER || github.actor }}
password: ${{ secrets.GHCR_PUBLISH_TOKEN || secrets.GITHUB_TOKEN }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Compute canonical image name (lowercase)
id: vars
@@ -174,10 +166,6 @@ jobs:
type=ref,event=branch
type=ref,event=tag
type=sha,format=short,prefix=sha-
type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
type=semver,pattern={{major}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
flavor: |
latest=false
labels: |
@@ -196,12 +184,6 @@ jobs:
[ -z "$tag" ] && continue
echo "Creating manifest for $tag"
src_tag="$tag"
if [[ "$tag" == *:latest && "${GITHUB_REF}" == refs/tags/* ]]; then
ref="${GITHUB_REF#refs/tags/}"
src_tag="${tag%:latest}:$ref"
fi
# The per-arch sources always live in the edge package.
src_tag="${REGISTRY}/${EDGE_IMAGE_NAME,,}:${src_tag##*:}"
if [ -n "${IMAGE_DESCRIPTION:-}" ]; then
docker buildx imagetools create \
--tag "$tag" \