Update Github Actions #none major

Reviewed-on: #49

.github/workflows/docker-build.yml

@@ -1,42 +1,46 @@
-name: Docker Build
+name: 'Tag Build and Push Docker image'
 
-on: 
+on:
   workflow_call:
     inputs:
       registry:  # id of input
         description: 'docker regisry host name'
-        required: true
+        type: string
         default: 'gitea.phadric.de'
       cache-registry:  # id of input
         description: 'docker regisry host name'
-        required: true
         default: 'imagecache.phadric.de'
+        type: string
       image_name:
         description: 'name of the dockerimage'
         required: true
-        default: ${{ github.repository }}
-      token:
-        description: 'repo auth token'
-        required: true
-
+        type: string
+      checkout:
+        description: 'checkout repo first'
+        default: 'true'
+        type: string
+      tag:
+        description: 'checkout repo first'
+        default: 'true'
+        type: string
+   # secrets:
+   #   TOKEN:
+   #     description: 'repo auth token'
+   #     required: true
 
 jobs:
   build:
     runs-on: slim
     steps:
-      - run: echo "::group::Checkout repository"
-        if: ${{ always() }}
       - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        if: ${{ inputs.checkout == 'true' }}
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: '0'
-      - run: echo "::endgroup::"
-        if: ${{ always() }}
-      - run: echo "::group::Bump version and push tag"
-        if: ${{ always() }}
       - name: Bump version and push tag
         id: tag
-        uses: phadric/github-tag-action@a5250a59655e9f4b0350407380a92c73948f2aec # master
+        if: ${{ inputs.tag == 'true' }}
+        uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # 1.75.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # if you don't want to set write permissions use a PAT token
           DEFAULT_BUMP: patch
@@ -44,13 +48,9 @@ jobs:
           WITH_V: true
           PRERELEASE: true
           PRERELEASE_SUFFIX: ${{ github.ref_name }}
-      - run: echo "::endgroup::"
-        if: ${{ always() }}
-      - run: echo "::group::Extract Docker metadata"
-        if: ${{ always() }}
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           flavor: |
             latest=${{ github.ref_name == 'main' || github.ref_name == 'master' }}                                                       
@@ -62,38 +62,22 @@ jobs:
             # disabled if major zero
             type=semver,pattern={{major}},value=${{steps.tag.outputs.tag}},enable=${{ !startsWith(steps.tag.outputs.tag, 'v0.') }}                                                
           images: ${{ inputs.registry }}/${{ inputs.image_name }}
-      - run: echo "::endgroup::"
-        if: ${{ always() }}
-      - run: echo "::group::Configure build Cache"
-        if: ${{ always() }}
-      - uses: int128/docker-build-cache-config-action@338206c80bf9eeb2b9694b7b4fc8c247c317e2a8 # v1.38.0
+      - uses: int128/docker-build-cache-config-action@5a7737d035432c268b2b5bfbbcb32e02804c3729 # v1.63.0
         id: cache
         with:
           image: ${{ inputs.cache-registry }}/${{ inputs.image_name }}-cache
           extra-cache-to: image-manifest=true
-      - run: echo "::endgroup::"
-        if: ${{ always() }}
-      - run: echo "::group::Setup Buildx"
-        if: ${{ always() }}
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
-      - run: echo "::endgroup::"
-        if: ${{ always() }}
-      - run: echo "::group::Log into Registry ${{ inputs.registry }}"
-        if: ${{ always() }}
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Log into registry ${{ inputs.registry }}
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4.5.0
         with:
           registry: ${{ inputs.registry }}
           username: ${{ github.actor }}
-          password: ${{ inputs.token }}
-      - run: echo "::endgroup::"
-        if: ${{ always() }}
-      - run: echo "::group::Build and Push docker image"
-        if: ${{ always() }}
+          password: ${{ secrets.TOKEN }}
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: true
@@ -106,6 +90,4 @@ jobs:
             ${{ steps.cache.outputs.cache-from }}                                                
           cache-to: |
             ${{ steps.cache.outputs.cache-to }}
-            type=registry,ref=${{ inputs.cache-registry }}/${{ inputs.image_name }}-cache:latest,mode=max,image-manifest=true                                                
-      - run: echo "::endgroup::"
-        if: ${{ always() }}
+            type=registry,ref=${{ inputs.cache-registry }}/${{ inputs.image_name }}-cache:latest,mode=max,image-manifest=true                                                

.github/workflows/lint.yml

@@ -13,13 +13,15 @@ jobs:
   build:
     runs-on: slim
     permissions:
-      contents: read
+      contents: write
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Verify Action
       run: actionlint -ignore 'unexpected key "description" for "workflow" section' -ignore 'nexpected key "inputs" for "workflow" section.' -ignore 'unexpected key "runs" for "workflow" section.' -ignore '"on" section is missing in workflow' -ignore '"jobs" section is missing in workflow' action.yml
+    - name: Verify Workflow
+      run: actionlint -ignore 'label "slim" is unknown' .github/workflows/docker-build.yml
     - name: tag latest after success
       if: github.ref == 'refs/heads/main'
       id: tag

action.yml

@@ -0,0 +1,88 @@
+name: 'Tag Build and Push Docker image'
+description: 'Tags verion in current repo, builds docker image and pushes it to registry'
+inputs:
+  registry:  # id of input
+    description: 'docker regisry host name'
+    required: true
+    default: 'gitea.phadric.de'
+  cache-registry:  # id of input
+    description: 'docker regisry host name'
+    required: true
+    default: 'imagecache.phadric.de'
+  image_name:
+    description: 'name of the dockerimage'
+    required: true
+    default: ${{ github.repository }}
+  token:
+    description: 'repo auth token'
+    required: true
+  checkout:
+    description: 'checkout repo first'
+    default: 'true'
+  tag:
+    description: 'checkout repo first'
+    default: 'true'
+
+
+runs:
+  using: "composite"
+  steps:
+      - name: Checkout repository
+        if: ${{ inputs.checkout == 'true' }}
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: '0'
+      - name: Bump version and push tag
+        id: tag
+        if: ${{ inputs.tag == 'true' }}
+        uses: phadric/github-tag-action@a5250a59655e9f4b0350407380a92c73948f2aec # master
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # if you don't want to set write permissions use a PAT token
+          DEFAULT_BUMP: patch
+          GIT_API_TAGGING: false # dont use API
+          WITH_V: true
+          PRERELEASE: true
+          PRERELEASE_SUFFIX: ${{ github.ref_name }}
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          flavor: |
+            latest=${{ github.ref_name == 'main' || github.ref_name == 'master' }}                                                       
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}},value=${{steps.tag.outputs.tag}}
+            # output 0.1
+            type=semver,pattern={{major}}.{{minor}},value=${{steps.tag.outputs.tag}}
+            # disabled if major zero
+            type=semver,pattern={{major}},value=${{steps.tag.outputs.tag}},enable=${{ !startsWith(steps.tag.outputs.tag, 'v0.') }}                                                
+          images: ${{ inputs.registry }}/${{ inputs.image_name }}
+      - uses: int128/docker-build-cache-config-action@5a7737d035432c268b2b5bfbbcb32e02804c3729 # v1.63.0
+        id: cache
+        with:
+          image: ${{ inputs.cache-registry }}/${{ inputs.image_name }}-cache
+          extra-cache-to: image-manifest=true
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - name: Log into registry ${{ inputs.registry }}
+        uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4.5.0
+        with:
+          registry: ${{ inputs.registry }}
+          username: ${{ github.actor }}
+          password: ${{ inputs.token }}
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          platforms: linux/amd64
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: |
+            type=registry,ref=${{ inputs.cache-registry }}/${{ inputs.image_name }}-cache:latest
+            type=registry,ref=${{ inputs.cache-registry }}/${{ inputs.image_name }}-cache:${{ github.ref_name }}
+            ${{ steps.cache.outputs.cache-from }}                                                
+          cache-to: |
+            ${{ steps.cache.outputs.cache-to }}
+            type=registry,ref=${{ inputs.cache-registry }}/${{ inputs.image_name }}-cache:latest,mode=max,image-manifest=true