update web-vault to v2025.1.2 #510
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| permissions: {} | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - test | |
| tags: | |
| # https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet | |
| - '[1-2].[0-9]+.[0-9]+' | |
| jobs: | |
| # https://github.com/marketplace/actions/skip-duplicate-actions | |
| # Some checks to determine if we need to continue with building a new docker. | |
| # We will skip this check if we are creating a tag, because that has the same hash as a previous run already. | |
| skip_check: | |
| # Only run this in the upstream repo and not on forks | |
| if: ${{ github.repository == 'dani-garcia/vaultwarden' }} | |
| name: Cancel older jobs when running | |
| permissions: | |
| actions: write | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| should_skip: ${{ steps.skip_check.outputs.should_skip }} | |
| steps: | |
| - name: Skip Duplicates Actions | |
| id: skip_check | |
| uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1 | |
| with: | |
| cancel_others: 'true' | |
| # Only run this when not creating a tag | |
| if: ${{ github.ref_type == 'branch' }} | |
| docker-build: | |
| # needs: skip_check | |
| # if: ${{ needs.skip_check.outputs.should_skip != 'true' && github.repository == 'dani-garcia/vaultwarden' }} | |
| name: Build Vaultwarden containers | |
| permissions: | |
| packages: write | |
| contents: read | |
| attestations: write | |
| id-token: write | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 120 | |
| env: | |
| SOURCE_COMMIT: ${{ github.sha }} | |
| SOURCE_REPOSITORY_URL: "https://github.com/${{ github.repository }}" | |
| # The *_REPO variables need to be configured as repository variables | |
| # Append `/settings/variables/actions` to your repo url | |
| # DOCKERHUB_REPO needs to be 'index.docker.io/<user>/<repo>' | |
| # Check for Docker hub credentials in secrets | |
| HAVE_DOCKERHUB_LOGIN: ${{ vars.DOCKERHUB_REPO != '' && secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }} | |
| # GHCR_REPO needs to be 'ghcr.io/<user>/<repo>' | |
| # Check for Github credentials in secrets | |
| HAVE_GHCR_LOGIN: ${{ vars.GHCR_REPO != '' && github.repository_owner != '' && secrets.GITHUB_TOKEN != '' }} | |
| # QUAY_REPO needs to be 'quay.io/<user>/<repo>' | |
| # Check for Quay.io credentials in secrets | |
| HAVE_QUAY_LOGIN: ${{ vars.QUAY_REPO != '' && secrets.QUAY_USERNAME != '' && secrets.QUAY_TOKEN != '' }} | |
| PLATFORMS: "['linux/amd64', 'linux/amd64/v3', 'linux/arm64']" | |
| strategy: | |
| matrix: | |
| base_image: ["debian","alpine"] | |
| outputs: | |
| source-version: ${{ steps.determine-version.outputs.SOURCE_VERSION }} | |
| platforms: ${{ steps.extract-binaries.outputs.PLTF }} | |
| steps: | |
| - name: Initialize QEMU binfmt support | |
| uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0 | |
| with: | |
| platforms: "arm64" | |
| # Start Docker Buildx | |
| - name: Setup Docker Buildx | |
| uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0 | |
| # Set max parallelism to 3, the default of 4 breaks GitHub Actions and causes OOMKills | |
| with: | |
| cache-binary: false | |
| buildkitd-config-inline: | | |
| [worker.oci] | |
| max-parallelism = 3 | |
| # Checkout the repo | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2 | |
| # We need fetch-depth of 0 so we also get all the tag metadata | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| # Determine Base Tags and Source Version | |
| - name: Determine Base Tags and Source Version | |
| id: determine-version | |
| shell: bash | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| REF_TYPE: ${{ github.ref_type }} | |
| run: | | |
| # Check which main tag we are going to build determined by ref_type | |
| if [[ "${REF_TYPE}" == "tag" ]]; then | |
| echo "BASE_TAGS=latest,${GITHUB_REF#refs/*/}" | tee -a "${GITHUB_ENV}" | |
| elif [[ "${REF_TYPE}" == "branch" ]]; then | |
| if [[ "${REF_NAME}" == "main" ]]; then | |
| echo "BASE_TAGS=latest" | tee -a "${GITHUB_ENV}" | |
| else | |
| echo "BASE_TAGS=testing" | tee -a "${GITHUB_ENV}" | |
| fi | |
| fi | |
| # Get the Source Version for this release | |
| GIT_EXACT_TAG="$(git describe --tags --abbrev=0 --exact-match 2>/dev/null || true)" | |
| if [[ -n "${GIT_EXACT_TAG}" ]]; then | |
| echo "SOURCE_VERSION=${GIT_EXACT_TAG}" | tee -a "${GITHUB_OUTPUT}" | |
| else | |
| GIT_LAST_TAG="$(git describe --tags --abbrev=0)" | |
| echo "SOURCE_VERSION=${GIT_LAST_TAG}-${SOURCE_COMMIT:0:8}" | tee -a "${GITHUB_OUTPUT}" | |
| fi | |
| # End Determine Base Tags | |
| # Login to Docker Hub | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' }} | |
| - name: Add registry for DockerHub | |
| if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' }} | |
| shell: bash | |
| env: | |
| DOCKERHUB_REPO: ${{ vars.DOCKERHUB_REPO }} | |
| run: | | |
| echo "CONTAINER_REGISTRIES=${DOCKERHUB_REPO}" | tee -a "${GITHUB_ENV}" | |
| # Login to GitHub Container Registry | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| if: ${{ env.HAVE_GHCR_LOGIN == 'true' }} | |
| - name: Add registry for ghcr.io | |
| if: ${{ env.HAVE_GHCR_LOGIN == 'true' }} | |
| shell: bash | |
| env: | |
| GHCR_REPO: ${{ vars.GHCR_REPO }} | |
| run: | | |
| echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}${GHCR_REPO}" | tee -a "${GITHUB_ENV}" | |
| # Login to Quay.io | |
| - name: Login to Quay.io | |
| uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 | |
| with: | |
| registry: quay.io | |
| username: ${{ secrets.QUAY_USERNAME }} | |
| password: ${{ secrets.QUAY_TOKEN }} | |
| if: ${{ env.HAVE_QUAY_LOGIN == 'true' }} | |
| - name: Add registry for Quay.io | |
| if: ${{ env.HAVE_QUAY_LOGIN == 'true' }} | |
| shell: bash | |
| env: | |
| QUAY_REPO: ${{ vars.QUAY_REPO }} | |
| run: | | |
| echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}${QUAY_REPO}" | tee -a "${GITHUB_ENV}" | |
| - name: Configure build cache from/to | |
| shell: bash | |
| env: | |
| GHCR_REPO: ${{ vars.GHCR_REPO }} | |
| BASE_IMAGE: ${{ matrix.base_image }} | |
| run: | | |
| # | |
| # Check if there is a GitHub Container Registry Login and use it for caching | |
| if [[ -n "${HAVE_GHCR_LOGIN}" ]]; then | |
| echo "BAKE_CACHE_FROM=type=registry,ref=${GHCR_REPO}-buildcache:${BASE_IMAGE}" | tee -a "${GITHUB_ENV}" | |
| echo "BAKE_CACHE_TO=type=registry,ref=${GHCR_REPO}-buildcache:${BASE_IMAGE},compression=zstd,mode=max" | tee -a "${GITHUB_ENV}" | |
| else | |
| echo "BAKE_CACHE_FROM=" | |
| echo "BAKE_CACHE_TO=" | |
| fi | |
| # | |
| - name: Configure bake | |
| shell: bash | |
| run: | | |
| PLATFORMS=$(echo "${{ env.PLATFORMS }}" | tr -d "[' ]") | |
| echo "BAKE_PLATFORMS=$PLATFORMS" | tee -a "${GITHUB_ENV}" | |
| mkdir /tmp/vaultwarden | |
| - name: Bake ${{ matrix.base_image }} containers | |
| id: bake_vw | |
| uses: docker/bake-action@7bff531c65a5cda33e52e43950a795b91d450f63 # v6.3.0 | |
| env: | |
| BASE_TAGS: "${{ env.BASE_TAGS }}" | |
| SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}" | |
| SOURCE_VERSION: "${{ steps.determine-version.outputs.SOURCE_VERSION }}" | |
| SOURCE_REPOSITORY_URL: "${{ env.SOURCE_REPOSITORY_URL }}" | |
| CONTAINER_REGISTRIES: "${{ env.CONTAINER_REGISTRIES }}" | |
| with: | |
| pull: true | |
| source: . | |
| files: docker/docker-bake.hcl | |
| targets: "${{ matrix.base_image }}-multi" | |
| set: | | |
| *.cache-from=${{ env.BAKE_CACHE_FROM }} | |
| *.cache-to=${{ env.BAKE_CACHE_TO }} | |
| *.platform=${{ env.BAKE_PLATFORMS }} | |
| *.output=type=local,dest=/tmp/vaultwarden | |
| *.output=type=registry | |
| - name: Extract digest SHA | |
| shell: bash | |
| env: | |
| BAKE_METADATA: ${{ steps.bake_vw.outputs.metadata }} | |
| run: | | |
| GET_DIGEST_SHA="$(jq -r '.["${{ matrix.base_image }}-multi"]."containerimage.digest"' <<< "${BAKE_METADATA}")" | |
| echo "DIGEST_SHA=${GET_DIGEST_SHA}" | tee -a "${GITHUB_ENV}" | |
| # Attest container images | |
| - name: Attest - docker.io - ${{ matrix.base_image }} | |
| if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}} | |
| uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0 | |
| with: | |
| subject-name: ${{ vars.DOCKERHUB_REPO }} | |
| subject-digest: ${{ env.DIGEST_SHA }} | |
| push-to-registry: true | |
| - name: Attest - ghcr.io - ${{ matrix.base_image }} | |
| if: ${{ env.HAVE_GHCR_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}} | |
| uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0 | |
| with: | |
| subject-name: ${{ vars.GHCR_REPO }} | |
| subject-digest: ${{ env.DIGEST_SHA }} | |
| push-to-registry: true | |
| - name: Attest - quay.io - ${{ matrix.base_image }} | |
| if: ${{ env.HAVE_QUAY_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}} | |
| uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0 | |
| with: | |
| subject-name: ${{ vars.QUAY_REPO }} | |
| subject-digest: ${{ env.DIGEST_SHA }} | |
| push-to-registry: true | |
| # Extract the Alpine binaries from the containers | |
| - name: Extract binaries | |
| id: extract-binaries | |
| shell: bash | |
| run: | | |
| for dir in /tmp/vaultwarden/*/; do | |
| dirname=$(basename "$dir") | |
| mv "${dir}vaultwarden" "${dir}vaultwarden-${dirname}-${{ matrix.base_image }}" | |
| done | |
| PLATFORMS=$(echo "${{ env.PLATFORMS }}" | tr '/' '_') | |
| echo "PLTF=$PLATFORMS" | tee -a "$GITHUB_OUTPUT" | |
| # Attest the binaries | |
| - name: "Attest artifacts ${{ matrix.base_image }}" | |
| uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0 | |
| with: | |
| subject-path: /tmp/vaultwarden/*/vaultwarden-* | |
| - name: Cache between jobs ${{ matrix.base_image }} | |
| uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 | |
| with: | |
| path: /tmp/vaultwarden/ | |
| key: vaultwarden-binaries-${{ steps.determine-version.outputs.SOURCE_VERSION }}-${{ matrix.base_image }} | |
| upload-artifacts: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 120 | |
| needs: docker-build | |
| strategy: | |
| matrix: | |
| base_image: ["debian","alpine"] | |
| platforms: ${{ fromJSON(needs.docker-build.outputs.platforms) }} | |
| steps: | |
| - name: Cache between jobs ${{ matrix.base_image }} | |
| uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 | |
| with: | |
| path: /tmp/vaultwarden/ | |
| key: vaultwarden-binaries-${{ needs.docker-build.outputs.source-version }}-${{ matrix.base_image }} | |
| # Upload artifacts to Github Actions | |
| - name: "Upload artifacts ${{ matrix.base_image }}" | |
| uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 | |
| with: | |
| name: vaultwarden-${{ needs.docker-build.outputs.source-version }}-${{ matrix.platforms }}-${{ matrix.base_image }} | |
| path: /tmp/vaultwarden/${{ matrix.platforms }}/vaultwarden-* |