Skip to content

fix: update modules for security #751

fix: update modules for security

fix: update modules for security #751

name: Publish nightly Docker image
on:
push:
branches:
- main
jobs:
push_to_registry:
name: Push nightly Docker image to Docker Hub
runs-on: ubuntu-latest
strategy:
matrix:
variant: [root, nonroot, debug]
permissions:
packages: write
contents: read
env:
REGISTRY: arizephoenix
IMAGE_NAME: phoenix
steps:
- name: Check out the repo
uses: actions/checkout@v4
- name: Set BASE_IMAGE environment variable
id: set-base-image
run: |
if [ "${{ matrix.variant }}" == "root" ]; then
echo "BASE_IMAGE=gcr.io/distroless/python3-debian12" >> $GITHUB_ENV
elif [ "${{ matrix.variant }}" == "debug" ]; then
echo "BASE_IMAGE=gcr.io/distroless/python3-debian12:debug" >> $GITHUB_ENV
elif [ "${{ matrix.variant }}" == "nonroot" ]; then
echo "BASE_IMAGE=gcr.io/distroless/python3-debian12:nonroot" >> $GITHUB_ENV
else
echo "BASE_IMAGE=gcr.io/distroless/python3-debian12" >> $GITHUB_ENV
fi
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_PASSWORD }}
- name: Extract commit hash
id: extract_commit
run: echo "COMMIT_HASH=${GITHUB_SHA::7}" >> $GITHUB_ENV
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
${{ matrix.variant == 'root' && 'nightly' || '' }}
${{ matrix.variant == 'nonroot' && 'nightly-nonroot' || '' }}
${{ matrix.variant == 'debug' && 'nightly-debug' || '' }}
- name: Build and push Docker image
id: push
uses: docker/build-push-action@v6
with:
platforms: linux/amd64,linux/arm64
context: .
file: ./Dockerfile
push: true
sbom: true
provenance: mode=max
tags: |
${{ matrix.variant == 'root' && format('{0}/{1}:nightly', env.REGISTRY, env.IMAGE_NAME) || '' }}
${{ matrix.variant == 'root' && format('{0}/{1}:commit-{2}', env.REGISTRY, env.IMAGE_NAME, env.COMMIT_HASH) || '' }}
${{ matrix.variant == 'nonroot' && format('{0}/{1}:nightly-nonroot', env.REGISTRY, env.IMAGE_NAME) || '' }}
${{ matrix.variant == 'debug' && format('{0}/{1}:nightly-debug', env.REGISTRY, env.IMAGE_NAME) || '' }}
labels: ${{ steps.meta.outputs.labels }}
build-args: |
BASE_IMAGE=${{ env.BASE_IMAGE }}