1name: Build and publish images
 2
 3on:
 4  push:
 5    branches:
 6      - main
 7    paths:
 8      - flake.nix
 9      - flake.lock
10      - package.nix
11      - publish.nix
12      - .forgejo/workflows/publish.yml
13  workflow_dispatch:
14
15concurrency:
16  group: publish
17  cancel-in-progress: false
18
19jobs:
20  publish:
21    runs-on: nixos-latest-high
22    steps:
23      - name: Checkout repository
24        uses: actions/checkout@v4
25      - name: Setup Nix
26        run: |
27          set -euo pipefail
28          echo 'extra-platforms = aarch64-linux' >> /etc/nix/nix.conf
29          echo "substituters = https://mirrors.ustc.edu.cn/nix-channels/store?priority=39 \
30          https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store?priority=39 \
31          https://cache.nixos.org?priority=40" >> /etc/nix/nix.conf
32      - name: Log in to the registries
33        env:
34          DOCKERHUB_USER: ${{ vars.DOCKERHUB_USER }}
35          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
36          GOI_USER: ${{ vars.GOI_USER }}
37          GOI_TOKEN: ${{ secrets.GOI_TOKEN }}
38        run: |
39          set -euo pipefail
40          install -d -m 700 /run/ci
41          echo "Login to Docker Hub..."
42          echo "$DOCKERHUB_TOKEN" |
43            podman login --compat-auth-file /run/ci/config.json \
44              --username "$DOCKERHUB_USER" --password-stdin docker.io
45          echo "Login to Gate Of Infinity..."
46          echo "$GOI_TOKEN" |
47            podman login --compat-auth-file /run/ci/config.json \
48              --username "$GOI_USER" --password-stdin git.trin.one
49      - name: Build and publish
50        env:
51          DOCKER_CONFIG: /run/ci
52        run: nix run .#publish