Daniel Sutton
e9c459fb8d
## Summary
The container publish workflows hardcoded `ghcr.io/triggerdotdev/...` as
the image destination. As a result, a fork that builds on push-to-`main`
(or on the worker publish tags) would attempt to push to — and attest —
the upstream packages rather than its own, which fails on permissions
and is surprising besides.
This makes the image destination configurable via a single
`IMAGE_REGISTRY` repository variable, while leaving the upstream
defaults byte-identical:
- **Single source of truth** (`publish.yml`): a `resolve-registry` job
resolves the target registry namespace once — `IMAGE_REGISTRY`
repository variable, defaulting to `ghcr.io/${{ github.repository_owner
}}` — and passes it down to every publish job as an `image_registry`
input. So a fork publishes to its own namespace automatically with no
configuration.
- **Webapp** (`publish-webapp.yml`): the image now lives at
`<registry>/<repo-name>` (e.g. `ghcr.io/<owner>/trigger.dev`). The
provenance attestation and the downstream Trivy scan follow the same
computed repo via the `image_repo` workflow output.
- **Workers** (`publish-worker.yml`, `publish-worker-v4.yml`): build
under `<registry>/<worker-name>`. They keep a `vars.IMAGE_REGISTRY ||
ghcr.io/<owner>` fallback so they still resolve correctly on their
direct `infra-*` / `re2-*` push triggers (which bypass the parent
workflow).
A single `IMAGE_REGISTRY` namespace variable now governs both webapp and
workers (the earlier `WEBAPP_IMAGE_REPO` full-path override is dropped,
removing the full-path/namespace asymmetry). When `IMAGE_REGISTRY` is
unset, every resolved image name is exactly what it is today, so there
is no change for this repo.
## Test plan
- [x] `actionlint` passes on all four workflows
- [ ] On merge, confirm the webapp publish still pushes
`ghcr.io/triggerdotdev/trigger.dev:main` + the commit-SHA tag (defaults
unchanged)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
115 lines
3.2 KiB
YAML
115 lines
3.2 KiB
YAML
name: 🚀 Publish Trigger.dev Docker
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
workflow_call:
|
|
inputs:
|
|
image_tag:
|
|
description: The image tag to publish
|
|
required: true
|
|
type: string
|
|
secrets:
|
|
DOCKERHUB_USERNAME:
|
|
required: false
|
|
DOCKERHUB_TOKEN:
|
|
required: false
|
|
SENTRY_AUTH_TOKEN:
|
|
required: false
|
|
push:
|
|
branches:
|
|
- main
|
|
tags:
|
|
- "v.docker.*"
|
|
- "build-*"
|
|
paths:
|
|
- ".github/actions/**/*.yml"
|
|
- ".github/workflows/publish.yml"
|
|
- ".github/workflows/typecheck.yml"
|
|
- ".github/workflows/unit-tests.yml"
|
|
- ".github/workflows/e2e.yml"
|
|
- ".github/workflows/publish-webapp.yml"
|
|
- ".github/workflows/publish-worker.yml"
|
|
- "packages/**"
|
|
- "!packages/**/*.md"
|
|
- "!packages/**/*.eslintrc"
|
|
- "internal-packages/**"
|
|
- "apps/**"
|
|
- "!apps/**/*.md"
|
|
- "!apps/**/*.eslintrc"
|
|
- "pnpm-lock.yaml"
|
|
- "pnpm-workspace.yaml"
|
|
- "turbo.json"
|
|
- "docker/Dockerfile"
|
|
- "docker/scripts/**"
|
|
- "tests/**"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
|
|
env:
|
|
AWS_REGION: us-east-1
|
|
|
|
jobs:
|
|
typecheck:
|
|
uses: ./.github/workflows/typecheck.yml
|
|
|
|
units:
|
|
uses: ./.github/workflows/unit-tests.yml
|
|
secrets:
|
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
publish-webapp:
|
|
needs: [typecheck]
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
uses: ./.github/workflows/publish-webapp.yml
|
|
secrets:
|
|
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
with:
|
|
image_tag: ${{ inputs.image_tag }}
|
|
# Target registry namespace. Defaults to ghcr.io/<owner> so a fork publishes
|
|
# to its own namespace; set the IMAGE_REGISTRY repository variable to override.
|
|
image_registry: ${{ vars.IMAGE_REGISTRY || format('ghcr.io/{0}', github.repository_owner) }}
|
|
|
|
publish-worker:
|
|
needs: [typecheck]
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
uses: ./.github/workflows/publish-worker.yml
|
|
secrets:
|
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
with:
|
|
image_tag: ${{ inputs.image_tag }}
|
|
image_registry: ${{ vars.IMAGE_REGISTRY || format('ghcr.io/{0}', github.repository_owner) }}
|
|
|
|
publish-worker-v4:
|
|
needs: [typecheck]
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
uses: ./.github/workflows/publish-worker-v4.yml
|
|
with:
|
|
image_tag: ${{ inputs.image_tag }}
|
|
image_registry: ${{ vars.IMAGE_REGISTRY || format('ghcr.io/{0}', github.repository_owner) }}
|
|
|
|
# OS-level CVE scan of the image just published above. Report-only (writes to
|
|
# the run summary); runs alongside the worker publishes and never blocks them.
|
|
scan-webapp:
|
|
needs: [publish-webapp]
|
|
permissions:
|
|
contents: read
|
|
packages: read # pull the just-published image from GHCR
|
|
uses: ./.github/workflows/trivy-image-webapp.yml
|
|
with:
|
|
image-ref: ${{ needs.publish-webapp.outputs.image_repo }}:${{ needs.publish-webapp.outputs.version }}
|