Image #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build and publish the production container image to GHCR. | |
| # | |
| # The image at packages/api/Dockerfile is the single deployable artefact: | |
| # Express + bundled SPA + /v1/traces ingest, all served on one port. This | |
| # workflow is the upstream side of any deployment — downstream operators | |
| # can pull from GHCR and re-tag into their own private registry if their | |
| # policy requires it. | |
| # | |
| # Triggers: | |
| # - manual workflow_dispatch only (intentional — operator runs builds | |
| # when they want them, not on every push). Once the build path has | |
| # been exercised a few times and a release cadence is in place, a | |
| # `push: branches: [main]` and/or `push: tags: ['v*']` block can be | |
| # added back so :latest moves automatically. | |
| name: Image | |
| on: | |
| workflow_dispatch: | |
| concurrency: | |
| group: image-${{ github.ref }} | |
| cancel-in-progress: false # don't cancel in-flight pushes | |
| permissions: | |
| contents: read | |
| packages: write # required for GHCR push via GITHUB_TOKEN | |
| jobs: | |
| build-and-push: | |
| name: Build + push to GHCR | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Compute image metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| # Image namespace = ghcr.io/<owner-lowercase>/<repo>. | |
| # For vilosource/token-tracker that resolves to | |
| # ghcr.io/vilosource/token-tracker. | |
| images: ghcr.io/${{ github.repository }} | |
| # Manual builds always tag :latest + :sha-<short>. When push | |
| # triggers come back, the type=ref/type=tag entries will fire | |
| # branch- and tag-based names too. | |
| tags: | | |
| type=sha,prefix=sha-,format=short | |
| type=raw,value=latest | |
| labels: | | |
| org.opencontainers.image.title=token-tracker | |
| org.opencontainers.image.description=Per-developer agent token-usage telemetry dashboard. Single Express+SPA binary serving /api/me, /v1/traces ingest, OIDC auth. | |
| org.opencontainers.image.source=https://github.com/${{ github.repository }} | |
| org.opencontainers.image.licenses=MIT | |
| - name: Build + push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: packages/api/Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| # Buildx cache via GH Actions cache backend; speeds up rebuilds | |
| # of the npm-install / SPA-build layers. | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # Provenance attestations on by default in build-push-action v6; | |
| # OK to keep — GHCR understands them. Disable here only if a | |
| # downstream registry chokes on them. | |
| provenance: true | |
| - name: Print pushed tags | |
| run: | | |
| echo "Pushed:" | |
| echo "${{ steps.meta.outputs.tags }}" |