deps(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.9 #125
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push Docker Images | |
| on: | |
| push: | |
| branches: [ main ] | |
| tags: [ 'v*' ] | |
| paths: | |
| - 'cmd/**' | |
| - 'pkg/**' | |
| - 'SteamBridge/**' | |
| - 'go.mod' | |
| - 'go.sum' | |
| - 'Dockerfile' | |
| - 'docker-compose.yml' | |
| - 'build.sh' | |
| - 'generate-protos.sh' | |
| - '.github/workflows/docker.yml' | |
| pull_request: | |
| branches: [ main ] | |
| paths: | |
| - 'cmd/**' | |
| - 'pkg/**' | |
| - 'SteamBridge/**' | |
| - 'go.mod' | |
| - 'go.sum' | |
| - 'Dockerfile' | |
| - 'docker-compose.yml' | |
| - 'build.sh' | |
| - 'generate-protos.sh' | |
| - '.github/workflows/docker.yml' | |
| workflow_dispatch: | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build: | |
| strategy: | |
| matrix: | |
| include: | |
| - runner: ubuntu-latest | |
| platform: linux/amd64 | |
| arch: amd64 | |
| - runner: [self-hosted, Linux, ARM64] | |
| platform: linux/arm64 | |
| arch: arm64 | |
| runs-on: ${{ matrix.runner }} | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to Container Registry | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=branch,suffix=-${{ matrix.arch }} | |
| type=ref,event=pr,prefix=pr-,suffix=-${{ matrix.arch }} | |
| type=semver,pattern={{version}},suffix=-${{ matrix.arch }} | |
| type=semver,pattern={{major}}.{{minor}},suffix=-${{ matrix.arch }} | |
| type=semver,pattern={{major}},suffix=-${{ matrix.arch }} | |
| type=raw,value=latest-${{ matrix.arch }},enable={{is_default_branch}} | |
| labels: | | |
| org.opencontainers.image.title=Matrix Steam Bridge | |
| org.opencontainers.image.description=A Matrix bridge for Steam Chat using mautrix-go bridgev2 | |
| org.opencontainers.image.vendor=Jason La Guidice | |
| org.opencontainers.image.url=https://github.com/${{ github.repository }} | |
| org.opencontainers.image.source=https://github.com/${{ github.repository }} | |
| - name: Build and push Docker image | |
| id: build | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| platforms: ${{ matrix.platform }} | |
| push: ${{ github.event_name != 'pull_request' }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=${{ matrix.arch }} | |
| cache-to: type=gha,mode=max,scope=${{ matrix.arch }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| build-args: | | |
| BUILDTIME=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }} | |
| VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }} | |
| create-manifest: | |
| if: github.event_name != 'pull_request' | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata for manifest | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - name: Create manifest list from arch-specific tags | |
| run: | | |
| set -e | |
| echo "Creating manifest list from architecture-specific tags..." | |
| # Extract base tag (without architecture suffix) from metadata | |
| BASE_TAG=$(echo '${{ steps.meta.outputs.tags }}' | head -n1 | sed 's/.*://') | |
| # Create manifest list using arch-specific tags | |
| docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${BASE_TAG}-amd64 \ | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${BASE_TAG}-arm64 | |
| echo "Manifest list created successfully for base tag: ${BASE_TAG}" | |
| - name: Inspect created manifest | |
| run: | | |
| echo "Inspecting created manifest..." | |
| for tag in $(jq -r '.tags[]' <<< "$DOCKER_METADATA_OUTPUT_JSON"); do | |
| echo "Checking manifest for tag: $tag" | |
| docker buildx imagetools inspect "$tag" || echo "Failed to inspect $tag" | |
| done | |
| security-scan: | |
| runs-on: ubuntu-latest | |
| needs: create-manifest | |
| if: github.event_name != 'pull_request' | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Extract metadata for scan | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: '${{ fromJSON(steps.meta.outputs.json).tags[0] }}' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-results.sarif' |