vishnu-prasad-wdt
21e961d4f0
All checks were successful
Self-test kaniko-build / build-without-push (push) Successful in 7s
Lets any repository on git.scotty-world.com build a Docker/OCI image from its checked-out code and push it to the registry it chooses (scotty-git's own container registry, Artifact Registry, Docker Hub, GHCR, ...). Kaniko instead of docker build: the runner is a shared, long-lived VM, so giving workflows the Docker daemon would mean root on that machine and image layers left on its disk. Kaniko builds inside the step's own container: no root, no privileged mode, nothing left behind. Kaniko v1.23.2 is pinned by digest. The action stores no credentials; each repository passes its own secret. A self-test workflow builds a small image (without pushing) on every change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
68 lines
2.2 KiB
YAML
68 lines
2.2 KiB
YAML
name: Kaniko build and push
|
|
description: >-
|
|
Build a container image from the checked-out repository with Kaniko and push it to any
|
|
registry. Needs no Docker daemon, no root on the runner and no privileged mode, and leaves
|
|
nothing behind on the runner's disk.
|
|
author: scotty-git
|
|
|
|
inputs:
|
|
destination:
|
|
description: >-
|
|
Image reference(s) to push, separated by commas or new lines,
|
|
e.g. "git.scotty-world.com/my-org/my-app:1.2.3". Required unless push is "false".
|
|
required: false
|
|
default: ""
|
|
context:
|
|
description: Build context, relative to the repository root.
|
|
required: false
|
|
default: "."
|
|
dockerfile:
|
|
description: Path to the Dockerfile, relative to the repository root.
|
|
required: false
|
|
default: "Dockerfile"
|
|
push:
|
|
description: '"false" builds the image but does not push it (useful for PR checks).'
|
|
required: false
|
|
default: "true"
|
|
registry:
|
|
description: >-
|
|
Registry host the credentials below are for, e.g. "git.scotty-world.com",
|
|
"asia-south1-docker.pkg.dev", "ghcr.io". Defaults to the host of the first destination.
|
|
required: false
|
|
default: ""
|
|
username:
|
|
description: Registry username. Use with password.
|
|
required: false
|
|
default: ""
|
|
password:
|
|
description: Registry password or token. Pass it from a secret, never as plain text.
|
|
required: false
|
|
default: ""
|
|
gcp_key_json:
|
|
description: >-
|
|
Google service-account key JSON for Artifact Registry, instead of username/password.
|
|
Pass it from a secret.
|
|
required: false
|
|
default: ""
|
|
cache_repo:
|
|
description: >-
|
|
Registry repository for Kaniko's layer cache, e.g. "git.scotty-world.com/my-org/my-app-cache".
|
|
Makes rebuilds fast without storing anything on the runner. Leave empty for no cache.
|
|
required: false
|
|
default: ""
|
|
build_args:
|
|
description: Build arguments, one KEY=VALUE per line.
|
|
required: false
|
|
default: ""
|
|
extra_args:
|
|
description: Extra Kaniko executor flags, space-separated (advanced).
|
|
required: false
|
|
default: ""
|
|
|
|
outputs:
|
|
digest:
|
|
description: The sha256 digest of the pushed image (empty when push is "false").
|
|
|
|
runs:
|
|
using: docker
|
|
image: Dockerfile
|