Bump the distroless group in /baseimages with 5 updates (#2732) #2164
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| workflow_dispatch: | |
| inputs: | |
| plugins: | |
| description: "Plugins to build and publish (i.e. connect-go:latest, connect-go, grpc/java:v1.53.0)" | |
| default: '' | |
| type: string | |
| env: | |
| DOCKER_ORG: "ghcr.io/bufbuild" | |
| # Ref: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#permissions | |
| permissions: | |
| actions: read | |
| contents: read | |
| packages: write | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| # Queue pending runs instead of replacing them, so we build every commit. | |
| # Ref: https://github.blog/changelog/2026-05-07-github-actions-concurrency-groups-now-allow-larger-queues/ | |
| queue: max | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| ci: | |
| runs-on: ubuntu-latest-4-cores | |
| steps: | |
| - name: set PLUGINS from workflow inputs | |
| if: ${{ inputs.plugins }} | |
| run: echo "PLUGINS=${{ inputs.plugins }}" >> $GITHUB_ENV | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - name: Calculate changed plugins and set PLUGINS env var from the commit being built | |
| if: ${{ inputs.plugins == '' }} | |
| run: | | |
| # We only allow squash merges to main, so we only need to look one commit back. | |
| # Combined with concurrency `queue: max`, we should build every commit to main. | |
| # We have to do this because `base_sha` from the GitHub API is no longer reliable. | |
| # Ref: https://github.com/orgs/community/discussions/206725 | |
| # | |
| # In a break glass scenario, run this workflow manually and specify the PLUGINS input. | |
| # This will force a rebuild and publish of the selected plugins. | |
| val=$(go run ./internal/cmd/changed-plugins --base-ref HEAD~1) | |
| if [[ -n "${val}" && -z "${PLUGINS}" ]]; then | |
| echo "PLUGINS=${val}" >> $GITHUB_ENV | |
| fi | |
| - name: Get buf version | |
| shell: bash | |
| run: | | |
| echo BUF_VERSION=$(go list -m -f '{{.Version}}' github.com/bufbuild/buf | cut -c2-) >> $GITHUB_ENV | |
| - uses: bufbuild/buf-action@v1 | |
| with: | |
| setup_only: true | |
| - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Set up Docker Buildx | |
| id: buildx | |
| uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 | |
| - name: Login to GitHub Container Registry | |
| if: github.repository == 'bufbuild/plugins' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Test | |
| run: make test | |
| - name: Push to GHCR | |
| if: github.repository == 'bufbuild/plugins' | |
| run: make dockerpush |