Repository navigation
release: v1.3.1 - 修复 Outlook OAuth 复用授权结果与 RefreshToken 明文写入 #20
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ============================================================================ | |
| # Magicmail Docker 镜像 CI/CD | |
| # 多架构构建 (linux/amd64 + linux/arm64 + linux/arm/v7) 并同步推送至 Docker Hub + GitHub Container Registry | |
| # 触发条件: 推送 tag (v*) 或手动触发 | |
| # | |
| # 分支约定: 与 release.yml 一致，所有 v* tag（含 rc）都必须打在 main 上， | |
| # 否则直接失败，避免在 dev 上误打 tag 时把镜像推到公共仓库。 | |
| # ============================================================================ | |
| name: Docker Image CI | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| inputs: | |
| push_image: | |
| description: '是否推送到镜像仓库' | |
| required: true | |
| default: 'true' | |
| type: choice | |
| options: | |
| - 'true' | |
| - 'false' | |
| image_tag: | |
| description: '镜像标签 (留空则自动获取最新 git tag)' | |
| required: false | |
| default: '' | |
| env: | |
| # Docker Hub | |
| REGISTRY_HUB: docker.io | |
| IMAGE_NAME_HUB: ${{ github.repository }} | |
| # GitHub Container Registry (ghcr.io) | |
| REGISTRY_GHCR: ghcr.io | |
| IMAGE_NAME_GHCR: ${{ github.repository }} | |
| jobs: | |
| build-and-push: | |
| name: Build & Push Multi-Arch | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| # ─── 1. 检出代码 ────────────────────────────── | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # 获取完整历史，包含 tags | |
| # ─── 1b. 校验 tag 归属（尽早失败，别浪费多架构构建时间） ─── | |
| - name: 校验 tag 位置 | |
| if: github.event_name == 'push' | |
| run: | | |
| # tag 推送时 checkout 只拉了这一个 ref，main 分支的引用需要手动补 | |
| git fetch --no-tags origin '+refs/heads/main:refs/remotes/origin/main' | |
| if ! git merge-base --is-ancestor HEAD origin/main; then | |
| echo "::error::tag ${GITHUB_REF_NAME} 指向的提交 $(git rev-parse --short HEAD) 不在 main 分支上，拒绝构建镜像" | |
| exit 1 | |
| fi | |
| echo "OK: ${GITHUB_REF_NAME} @ $(git rev-parse --short HEAD) 位于 main" | |
| # ─── 2. 配置 QEMU (支持多架构) ──────────────── | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| # ─── 3. 配置 Buildx ────────────────────────── | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # ─── 4. 自动获取最新 git tag ───────────────── | |
| - name: Get latest git tag | |
| id: tag | |
| run: | | |
| LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "") | |
| if [ -z "$LATEST_TAG" ]; then | |
| echo "tag=latest" >> $GITHUB_OUTPUT | |
| else | |
| # 去掉 v 前缀 (v1.2.3 → 1.2.3) | |
| CLEAN_TAG="${LATEST_TAG#v}" | |
| echo "tag=$CLEAN_TAG" >> $GITHUB_OUTPUT | |
| fi | |
| echo "latest_tag=$LATEST_TAG" >> $GITHUB_OUTPUT | |
| # 仅「正式版 tag 推送」才允许生成 latest / 1.2 / 1 这类浮动标签， | |
| # 避免 rc 版 (v1.2.0-rc.1) 把 latest 指向预发布镜像。 | |
| if [[ "${GITHUB_REF}" == refs/tags/v* && "${GITHUB_REF_NAME}" != *-* ]]; then | |
| echo "is_release=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "is_release=false" >> $GITHUB_OUTPUT | |
| fi | |
| # ─── 5a. 登录 Docker Hub ───────────────────── | |
| - name: Log in to Docker Hub | |
| if: github.event_name == 'push' || inputs.push_image == 'true' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY_HUB }} | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| # ─── 5b. 登录 GitHub Container Registry ────── | |
| - name: Log in to GitHub Container Registry | |
| if: github.event_name == 'push' || inputs.push_image == 'true' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY_GHCR }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # ─── 6. 提取元数据 (双仓库标签) ────────────── | |
| - name: Extract Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: | | |
| ${{ env.REGISTRY_HUB }}/${{ env.IMAGE_NAME_HUB }} | |
| ${{ env.REGISTRY_GHCR }}/${{ env.IMAGE_NAME_GHCR }} | |
| tags: | | |
| # tag 推送: v1.2.3 → 1.2.3, 1.2, 1, latest | |
| type=semver,pattern={{version}} | |
| # 浮动标签只在正式版生成，rc/alpha 等预发布不参与 | |
| type=semver,pattern={{major}}.{{minor}},enable=${{ steps.tag.outputs.is_release }} | |
| type=semver,pattern={{major}},enable=${{ steps.tag.outputs.is_release }} | |
| # 注意: is_default_branch 在 tag 推送时恒为 false (ref 为 refs/tags/v*)， | |
| # 之前的写法导致 latest 标签从未被打上，这里改为按「正式版 tag 事件」启用 | |
| type=raw,value=latest,enable=${{ steps.tag.outputs.is_release }} | |
| # 手动触发: 使用自定义标签或自动获取最新 git tag | |
| type=raw,value=${{ inputs.image_tag }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.image_tag != '' }} | |
| type=raw,value=${{ steps.tag.outputs.tag }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.image_tag == '' }} | |
| # ─── 7. 构建并推送 (双仓库同步) ───────────── | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64,linux/arm/v7 | |
| push: ${{ github.event_name == 'push' || inputs.push_image == 'true' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| provenance: true | |
| sbom: true |