Docker Cheatsheet 16 — CI/CD with Docker

name: Build
on:
  push:
    branches: [main]
    tags: ["v*"]

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      
      - uses: docker/setup-buildx-action@v3
      
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=ref,event=tag
            type=sha
            type=raw,value=latest,enable={{is_default_branch}}
      
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64

- uses: docker/build-push-action@v6
  with:
    build-args: |
      VERSION=${{ github.sha }}
    secrets: |
      "npm_token=${{ secrets.NPM_TOKEN }}"

cache-from: |
  type=registry,ref=ghcr.io/me/myapp:buildcache
cache-to: |
  type=registry,ref=ghcr.io/me/myapp:buildcache,mode=max

- uses: docker/setup-qemu-action@v3
- uses: docker/setup-buildx-action@v3
- uses: docker/build-push-action@v6
  with:
    platforms: linux/amd64,linux/arm64

strategy:
  matrix:
    include:
      - runner: ubuntu-latest
        platform: linux/amd64
      - runner: ubuntu-latest-arm
        platform: linux/arm64

runs-on: ${{ matrix.runner }}
steps:
  - uses: docker/build-push-action@v6
    with:
      platforms: ${{ matrix.platform }}
      outputs: type=image,push-by-digest=true,name-canonical=true,push=true

- run: docker compose up -d db redis
- run: docker compose exec -T web pytest
- run: docker compose down -v

- run: docker build -t myapp:test .
- run: docker run --rm myapp:test pytest

jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env: { POSTGRES_PASSWORD: x }
        ports: [5432:5432]
        options: --health-cmd pg_isready

- uses: appleboy/ssh-action@v1
  with:
    host: ${{ secrets.HOST }}
    username: deploy
    key: ${{ secrets.SSH_KEY }}
    script: |
      cd /srv/app
      docker compose pull
      docker compose up -d
      docker image prune -f

- run: |
    echo "${{ secrets.SSH_KEY }}" > ~/.ssh/id_ed25519
    chmod 600 ~/.ssh/id_ed25519
    docker context create remote --docker host=ssh://deploy@server
    docker --context remote compose up -d

- uses: aquasecurity/trivy-action@master
  with:
    image-ref: ghcr.io/me/myapp:${{ github.sha }}
    exit-code: "1"
    severity: "CRITICAL,HIGH"
    ignore-unfixed: true

- run: |
    docker scout cves --exit-code --only-severity critical,high \
      ghcr.io/me/myapp:${{ github.sha }}

build:
  image: docker:latest
  services:
    - docker:dind
  variables:
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_CERTDIR: ""
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker buildx build --push -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .

# Per-commit: ghcr.io/me/myapp:sha-abc1234
# Per-branch: ghcr.io/me/myapp:main, :feature-x
# Per-tag:    ghcr.io/me/myapp:v1.2.3
# Latest:     ghcr.io/me/myapp:latest

jobs:
  build:
    outputs:
      image: ${{ steps.meta.outputs.tags }}
  
  test:
    needs: build
    runs-on: ubuntu-latest
    container: ${{ needs.build.outputs.image }}
    steps:
      - run: pytest