Skip to content

Missed a permission

Missed a permission #8

name: Build books-universium
on:
push:
branches: ["main"]
paths:
- "books-universium/**"
pull_request:
branches: ["main"]
paths:
- "books-universium/**"
env:
REGISTRY: ghcr.io
IMAGE_NAME: middlewaregruppen/books-universium
APP_PATH: books-universium
jobs:
build-and-push-image:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
id-token: write
attestations: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Log in to the Container registry
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Get version from __version__.py
id: get_version
run: |
VERSION=$(python -c 'exec(open("${{ env.APP_PATH }}/__version__.py").read()); print(__version__)')
echo "IMAGE_VERSION=$VERSION" >> $GITHUB_ENV
echo "Current version will be v$VERSION"
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=ref,event=branch,branch=main
type=raw,value=${{ env.IMAGE_VERSION }}
- name: Build and push Docker image
id: push
uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
with:
context: ${{ env.APP_PATH }}
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
- name: Generate artifact attestation
uses: actions/attest-build-provenance@v1
with:
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
subject-digest: ${{ steps.push.outputs.digest }}
push-to-registry: true