mirror of
https://github.com/suitenumerique/messages.git
synced 2026-08-17 21:25:41 +02:00
137 lines
3.8 KiB
YAML
137 lines
3.8 KiB
YAML
name: Build and publish OCI images
|
|
|
|
"on":
|
|
push:
|
|
branches:
|
|
- main
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
|
|
# Shared base (debian-trixie + uv + managed CPython 3.14.6), built + pushed once
|
|
# from deploy/python-uv/Dockerfile, then referenced by digest via
|
|
# PYTHON_UV_IMAGE in the backend and MTA builds below.
|
|
docker-publish-python-uv:
|
|
uses: ./.github/workflows/docker-publish.yml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
secrets: inherit
|
|
with:
|
|
image_name: "python-uv"
|
|
context: "deploy/python-uv"
|
|
|
|
docker-publish-mta-in:
|
|
needs: docker-publish-python-uv
|
|
uses: ./.github/workflows/docker-publish.yml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
secrets: inherit
|
|
with:
|
|
image_name: "mta-in"
|
|
context: "src/mta-in"
|
|
target: runtime-prod
|
|
build_args: |
|
|
PYTHON_UV_IMAGE=${{ needs.docker-publish-python-uv.outputs.image_ref }}
|
|
|
|
# Pure-Python (aiosmtpd) inbound MTA — built from Dockerfile.pymta, published
|
|
# alongside the Postfix mta-in image while the two run side-by-side.
|
|
docker-publish-mta-in-py:
|
|
needs: docker-publish-python-uv
|
|
uses: ./.github/workflows/docker-publish.yml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
secrets: inherit
|
|
with:
|
|
image_name: "mta-in-py"
|
|
context: "src/mta-in"
|
|
dockerfile: "src/mta-in/Dockerfile.pymta"
|
|
target: runtime-prod
|
|
build_args: |
|
|
PYTHON_UV_IMAGE=${{ needs.docker-publish-python-uv.outputs.image_ref }}
|
|
|
|
docker-publish-mta-out:
|
|
needs: docker-publish-python-uv
|
|
uses: ./.github/workflows/docker-publish.yml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
secrets: inherit
|
|
with:
|
|
image_name: "mta-out"
|
|
context: "src/mta-out"
|
|
target: runtime-prod
|
|
build_args: |
|
|
PYTHON_UV_IMAGE=${{ needs.docker-publish-python-uv.outputs.image_ref }}
|
|
|
|
docker-publish-socks-proxy:
|
|
uses: ./.github/workflows/docker-publish.yml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
secrets: inherit
|
|
with:
|
|
image_name: "socks-proxy"
|
|
context: "src/socks-proxy"
|
|
|
|
docker-publish-frontend:
|
|
uses: ./.github/workflows/docker-publish.yml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
secrets: inherit
|
|
with:
|
|
image_name: "frontend"
|
|
context: "src/frontend"
|
|
target: runtime-prod
|
|
arm64_reuse_amd64_build_arg: "FRONTEND_IMAGE"
|
|
# Bakes the commit SHA into the build as the asset cache-buster
|
|
# (vite.config.ts → __SOURCE_VERSION__); without it the build falls back to a
|
|
# timestamp. The src/frontend context ships no .git, so this is the only
|
|
# way the image gets the real SHA. SOURCE_VERSION matches the var name
|
|
# Scalingo's buildpack sets natively, so both deploy paths agree.
|
|
build_args: "SOURCE_VERSION=${{ github.sha }}"
|
|
|
|
docker-publish-backend:
|
|
needs: docker-publish-python-uv
|
|
uses: ./.github/workflows/docker-publish.yml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
secrets: inherit
|
|
with:
|
|
image_name: "backend"
|
|
context: "src/backend"
|
|
target: runtime-prod
|
|
build_args: |
|
|
PYTHON_UV_IMAGE=${{ needs.docker-publish-python-uv.outputs.image_ref }}
|
|
|
|
docker-publish-keycloak:
|
|
uses: ./.github/workflows/docker-publish.yml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
secrets: inherit
|
|
with:
|
|
image_name: "keycloak"
|
|
context: "src/keycloak"
|