fix(headless-chrome): hermetic package tests for publish CI #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publish the digest-pinned basecrawl CVM image to GHCR. | |
| # Uses GITHUB_TOKEN only (no embedded registry secrets). | |
| # Cargo quality gate remains .github/workflows/ci.yml (unchanged). | |
| name: Image | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| IMAGE_NAME: ghcr.io/baseintelligence/basecrawl-cvm | |
| # Match image/reproducibility.py DEFAULT_SOURCE_DATE_EPOCH / Dockerfile ARG. | |
| SOURCE_DATE_EPOCH: "1700000000" | |
| jobs: | |
| build-and-publish: | |
| runs-on: ubuntu-latest | |
| # linux/amd64 only: CVM Dockerfile is pinned to amd64 manifests (rust + puppeteer). | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE_NAME }} | |
| # Immutable sha always; latest only on default-branch push / manual dispatch on main. | |
| tags: | | |
| type=sha,prefix=sha-,format=long | |
| type=sha,prefix=sha-,format=short | |
| type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }} | |
| labels: | | |
| org.opencontainers.image.title=basecrawl-cvm | |
| org.opencontainers.image.description=Digest-pinned basecrawl CVM image (ghcr.io/baseintelligence/basecrawl-cvm). Prefer immutable sha tags or digests for verification; :latest is convenience only. | |
| org.opencontainers.image.source=https://github.com/BaseIntelligence/basecrawl | |
| - name: Build CVM image (and push when not a PR) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| # Repository root is the build context; Dockerfile lives under image/. | |
| # (Matches image/reproducibility.py build_command: context=REPO_ROOT, -f image/Dockerfile.) | |
| context: . | |
| file: image/Dockerfile | |
| platforms: linux/amd64 | |
| # PR: load-free dry build with no registry publish. | |
| # main push / workflow_dispatch: publish sha (+ optional latest) tags. | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| # Reproducibility-oriented BuildKit flags (as far as practical in GHA): | |
| # fixed SOURCE_DATE_EPOCH, linux/amd64 only, provenance/sbom off to match local | |
| # image/reproducibility.py framework used for measurement builds. | |
| # Cache is accepted on GHA for speed; formal bit-repro builds still use | |
| # image/reproducibility.py --no-cache locally / offline. | |
| build-args: | | |
| SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }} | |
| provenance: false | |
| sbom: false | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |