Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions .dockerignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
.git
**/.git
.env
.env.*
**/.env
**/.env.*
.npmrc
**/.npmrc
credentials.json
**/credentials.json
node_modules
**/node_modules
dist
output
.agents
.mcpregistry_*
.mcp.json
61 changes: 61 additions & 0 deletions .github/workflows/docker.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
name: Build and publish Docker image

on:
push:
branches: [main]
tags: ['v*.*.*']
workflow_dispatch:

env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}

concurrency:
group: docker-${{ github.ref }}
cancel-in-progress: true

jobs:
docker:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write

steps:
- name: Check out repository
uses: actions/checkout@v4
with:
persist-credentials: false

- name: Log in to GHCR
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
flavor: |
latest=false
tags: |
type=raw,value=latest,enable={{is_default_branch}}
type=ref,event=branch
Comment on lines +48 to +49

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Prevent older runs from overwriting latest

When two pushes to main are processed concurrently, both runs publish the mutable latest and main tags, so a slower run for the older commit can finish last and move those tags backward. This repository's release workflow also pushes a release commit after ordinary main pushes, routinely creating overlapping Docker runs; add ref-scoped concurrency with cancellation or otherwise ensure only the newest main run can update these tags.

Useful? React with 👍 / 👎.

type=ref,event=tag
type=sha

- name: Build and push image
uses: docker/build-push-action@v6
with:
context: .

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Exclude checkout credentials from the image context

Because this uses a local path context, the repository has no .dockerignore, and Dockerfile:10 runs COPY . ., the image includes .git/config. actions/checkout defaults to persist-credentials: true, so that config contains the job's authenticated Git extraheader until post-job cleanup; every pushed image can therefore contain the active GITHUB_TOKEN. Set persist-credentials: false and exclude .git from the build context before publishing.

Useful? React with 👍 / 👎.

push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
9 changes: 9 additions & 0 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ jobs:
permissions:
contents: write
id-token: write
actions: write
steps:
- uses: actions/checkout@v4
with:
Expand Down Expand Up @@ -119,3 +120,11 @@ jobs:
gh release create "v${VERSION}" --title "v${VERSION}" --notes "$NOTES"
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Publish release Docker images
run: |
VERSION=$(node -p "require('./package.json').version")
gh workflow run docker.yml --ref main
gh workflow run docker.yml --ref "v${VERSION}"
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Loading