Repository navigation
Watch #2693
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Watch | |
| on: | |
| schedule: | |
| - cron: '30 */4 * * *' | |
| push: | |
| branches: | |
| - master | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: mbinorg/psalm-security-scan | |
| jobs: | |
| docker: | |
| name: Publish Psalm image | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: write | |
| packages: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.event.repository.default_branch }} | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Find latest stable Psalm version | |
| id: fetch_version | |
| run: | | |
| set -euo pipefail | |
| version=$(curl --fail --silent --show-error --location \ | |
| https://packagist.org/packages/vimeo/psalm.json \ | |
| | jq --raw-output \ | |
| '[.package.versions[] | select(.version | test("^\\d+\\.\\d+\\.\\d+$")) | .version] | |
| | max_by(split(".") | map(tonumber))') | |
| if [[ -z "$version" || "$version" == "null" ]]; then | |
| echo "Unable to determine the latest stable Psalm version" >&2 | |
| exit 1 | |
| fi | |
| echo "Latest Psalm version is $version" | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| sed -i -E "s|require vimeo/psalm(:[^ ]+)?|require vimeo/psalm:$version|" Dockerfile | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Build and publish image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| push: true | |
| tags: | | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.fetch_version.outputs.version }} | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest | |
| - name: Update action metadata | |
| env: | |
| VERSION: ${{ steps.fetch_version.outputs.version }} | |
| run: | | |
| set -euo pipefail | |
| yq -i ".runs.image = \"docker://${REGISTRY}/${IMAGE_NAME}:${VERSION}\"" action.yml | |
| if git diff --quiet -- action.yml; then | |
| echo "action.yml already references Psalm ${VERSION}" | |
| exit 0 | |
| fi | |
| git config user.name "psalmbot" | |
| git config user.email "bot@noreply.psalm.dev" | |
| git add action.yml | |
| git commit -m "Add newer psalm docker image version ${VERSION}" | |
| git push origin "HEAD:${{ github.event.repository.default_branch }}" |