feat: auto deployment with Github Actions, use semver for tags - #4
Open
soodoh wants to merge 1 commit into
Open
Conversation
soodoh
commented
Aug 7, 2025
Comment on lines
+78
to
+94
| scan: | ||
| needs: docker | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout Code | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Run Trivy Vulnerability Scan | ||
| uses: aquasecurity/trivy-action@0.28.0 | ||
| with: | ||
| scan-type: 'image' | ||
| image-ref: ghcr.io/${{ github.repository }}:${{ needs.semver.outputs.new_version }} | ||
| format: 'table' | ||
| exit-code: '1' | ||
| ignore-unfixed: true | ||
| vuln-type: 'os,library' |
Author
There was a problem hiding this comment.
Optional, but probably a nice to have since this image is intended to be distributed to many users.
soodoh
force-pushed
the
use-semver
branch
3 times, most recently
from
August 7, 2025 19:15
80b2cfa to
c154b18
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Imo, I find SemVer much easier to follow for Docker tags, as it is an industry standard (although not as consistently used for Docker tags).
I find this makes it easier to communicate the impact of any future changes (i.e. any environment variables that need to be changed/added eventually). Also, I like to use Renovate to automatically update my docker compose version tags, and sometimes Renovate can get confused as to which version tag is the
latest(without hardcoding the image tags in my compose files to:latest, I like to use a specific version and update explicitly).This avoids the need to ever run
push.shmanually. Github actions will auto bump the version tag & push to ghcr.io. This can be updated to push to Dockerhub as well (see documented example), but I believe auth would needed to be added to this repo's secrets. Should be straightforward if wanted though.Tested in my fork, and this seems to be working without any issues. But lmk if there are concerns.
I think this is a nice to have, so just sharing in case others want this automation here.