Repository navigation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI OpenCode image (build, test, release) | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v*" | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: ci-opencode-image-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| IMAGE_LOCAL_TAG: sdlc-opencode:ci | |
| REGISTRY: quay.io | |
| DEFAULT_QUAY_IMAGE: quay.io/sshaaf/sdlc-opencode | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: container/Dockerfile | |
| push: false | |
| load: true | |
| tags: ${{ env.IMAGE_LOCAL_TAG }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Save image artifact | |
| run: docker save "${IMAGE_LOCAL_TAG}" -o opencode-image.tar | |
| - name: Upload image artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: opencode-image | |
| path: opencode-image.tar | |
| retention-days: 1 | |
| test: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Download image artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: opencode-image | |
| - name: Load image | |
| run: docker load -i opencode-image.tar | |
| - name: Smoke test | |
| run: bash container/scripts/smoke-test.sh "${IMAGE_LOCAL_TAG}" | |
| publish: | |
| needs: test | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| env: | |
| IMAGE: ${{ vars.QUAY_IMAGE_NAME || 'quay.io/sshaaf/sdlc-opencode' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to Quay.io | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: quay.io | |
| username: ${{ secrets.QUAY_USERNAME }} | |
| password: ${{ secrets.QUAY_PASSWORD }} | |
| - name: Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE }} | |
| tags: | | |
| type=sha,format=short,prefix=sha- | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: container/Dockerfile | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| release: | |
| needs: publish | |
| if: github.event_name != 'pull_request' && startsWith(github.ref, 'refs/tags/v') | |
| runs-on: ubuntu-latest | |
| env: | |
| IMAGE: ${{ vars.QUAY_IMAGE_NAME || 'quay.io/sshaaf/sdlc-opencode' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| generate_release_notes: true | |
| body: | | |
| ## Container image (Quay) | |
| **Image:** `${{ env.IMAGE }}` | |
| **Tags published for this release:** `${{ github.ref_name }}`, and semver aliases per CI metadata. | |
| ### Promotion policy | |
| Production OpenShift deployments MUST use an **immutable** reference: | |
| - `${{ env.IMAGE }}:sha-${{ github.sha }}` (short SHA tag from CI), or | |
| - `${{ env.IMAGE }}:<semver>` matching this git tag | |
| Do **not** rely on floating `latest` alone in production. | |
| See [spec.md](spec.md) §8 and [README.md](README.md#container-image-ci). |