security: build with go 1.25.11 + microdnf update UBI9 base (#289) #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: write | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Verify tag is on main | |
| run: | | |
| git fetch origin main | |
| if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then | |
| echo "Tag ${GITHUB_REF} ($GITHUB_SHA) is not reachable from main." | |
| echo "Single-branch release policy: only tags on main may be released." | |
| exit 1 | |
| fi | |
| - uses: docker/setup-qemu-action@v4 | |
| - uses: docker/setup-buildx-action@v4 | |
| - uses: docker/login-action@v4 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: docker/metadata-action@v6 | |
| id: meta | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| - uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| VERSION=${{ steps.meta.outputs.version }} | |
| - name: extract amd64 binary from the image | |
| run: | | |
| docker create --platform linux/amd64 --name amd64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} | |
| docker cp amd64:/usr/bin/nudgebee-node-agent /tmp/nudgebee-node-agent-${{ steps.meta.outputs.version }}-amd64 | |
| - name: extract arm64 binary from the image | |
| run: | | |
| docker create --platform linux/arm64 --name arm64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} | |
| docker cp arm64:/usr/bin/nudgebee-node-agent /tmp/nudgebee-node-agent-${{ steps.meta.outputs.version }}-arm64 | |
| - name: Create GitHub release with binaries | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| name: ${{ github.ref_name }} | |
| make_latest: true | |
| files: | | |
| /tmp/nudgebee-node-agent-${{ steps.meta.outputs.version }}-amd64 | |
| /tmp/nudgebee-node-agent-${{ steps.meta.outputs.version }}-arm64 |