Skip to content

Only tag images as latest on main branch #11

Only tag images as latest on main branch

Only tag images as latest on main branch #11

name: Build and Push Backend Image on Tag
on:
push:
tags:
- '*'
env:
REGISTRY_IMAGE: ghcr.io/stackhpc/danswer/danswer-backend
jobs:
build-and-push:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Backend Image Docker Build and Push
uses: docker/build-push-action@v5
with:
context: ./backend
file: ./backend/Dockerfile
platforms: linux/amd64,linux/arm64
push: true
tags: |
${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}
${{ github.ref == 'refs/heads/main' && format('type=raw,value={0}:latest', env.REGISTRY_IMAGE) }}
build-args: |
DANSWER_VERSION=${{ github.ref_name }}
cache-from: type=registry,ref=${{ env.REGISTRY_IMAGE }}:buildcache
cache-to: type=registry,ref=${{ env.REGISTRY_IMAGE}}:buildcache,mode=max
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
# To run locally: trivy image --severity HIGH,CRITICAL danswer/danswer-backend
image-ref: ${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}
severity: 'CRITICAL,HIGH'
trivyignores: ./backend/.trivyignore