cloudinary-image/.github/workflows/release.yml at dev · weaponsforge/cloudinary-image · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
name: Deploy Release

# This workflow will trigger on any tag/release created from the `main` branch
on:
  release:
    types: [published]

jobs:
  lint-test-app:
    name: Lint and Test App
    if: github.event.release.target_commitish == 'main'
    runs-on: ubuntu-latest
    permissions:
      checks: write
      pull-requests: write
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v6

      - name: Use NodeJS v24.11.0
        uses: actions/setup-node@v6
        with:
          node-version: 24.11.0
          registry-url: https://registry.npmjs.org/

      - name: Install Dependencies
        run: |
          cd app
          npm ci

      - name: Lint
        run: |
          cd app
          npm run lint

      - name: Check types
        run: |
          cd app
          npm run types:check

  publish-npm:
    name: Publish to NPM registry
    if: github.event.release.target_commitish == 'main'
    needs: [lint-test-app]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Use NodeJS v24.11.0
        uses: actions/setup-node@v6
        with:
          node-version: 24.11.0
          registry-url: https://registry.npmjs.org/

      - name: Build distribution package
        run: |
          cd app
          npm ci
          npm run build

      - name: Publish package
        run: |
          cp LICENSE app/
          cp docs/README_NPM.md app/README.md
          cd app
          npm publish --provenance --access public

  docker-build-push:
    name: Build and Push Docker Image
    if: github.event.release.target_commitish == 'main' && vars.DOCKERHUB_USERNAME != ''
    needs: [lint-test-app]
    runs-on: ubuntu-latest
    env:
      REGISTRY: docker.io
      IMAGE_NAME: weaponsforge/cloudinary-cli
    permissions:
      contents: read
      security-events: write
      packages: write
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Generate Docker Image Tags and Labels
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            # type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and Push Docker Image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: ./app
          file: ./app/Dockerfile
          target: production
          platforms: linux/amd64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            BUILDKIT_INLINE_CACHE=1
            CACHEBUST=${{ github.run_id }}

      - name: Scan Image for Vulnerabilities
        uses: aquasecurity/trivy-action@v0.35.0
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy Scan Results to GitHub Security Tab
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'