Improve runner launching - IAM Bindings, Disable Agent Service, Fix Generated Certificate #62
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Runme Image | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - 'v*' | |
| pull_request: | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: ">=1.25" | |
| - name: Set up ko | |
| uses: ko-build/setup-ko@v0.6 | |
| - name: Login to GitHub Container Registry | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Download static app assets. | |
| # This relies on assets.go embedding the contents of dist/* into the go binary | |
| # The advantage of embedding directly in the go binary is that we can then make the binary serve the static | |
| # assets without needing to manage the assets separately. This could be useful if we want to use the | |
| # web app as an "admin" panel for bootstrapping the UI. | |
| # For a docker container it might make sense to package the assets on the filesystem but then we'd have two | |
| # different mechanisms for the docker image vs. standalone binary. | |
| # Right now the static assets are only around 3.4Mb | |
| - name: Pull app assets (OCI) | |
| run: | | |
| rm -rf ./kodata | |
| go run . agent download-assets --assets-dir ./kodata | |
| - name: Compute image tags | |
| id: tags | |
| shell: bash | |
| run: | | |
| if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then | |
| tags="${GITHUB_REF_NAME}" | |
| else | |
| tags="sha-${GITHUB_SHA::7}" | |
| if [[ "${GITHUB_REF_NAME}" == "main" ]]; then | |
| tags="${tags},latest" | |
| fi | |
| fi | |
| echo "tags=${tags}" >> "$GITHUB_OUTPUT" | |
| - name: Build and publish image | |
| if: github.event_name != 'pull_request' | |
| env: | |
| KO_DOCKER_REPO: ghcr.io/runmedev/runme | |
| run: | | |
| ko build ./ \ | |
| --bare \ | |
| --platform=linux/amd64,linux/arm64 \ | |
| --tags "${{ steps.tags.outputs.tags }}" \ | |
| --sbom=none | |
| - name: Build image (PR) | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| ko build ./ --bare --local --sbom=none |