Conor Sloan
61 lines
2.7 KiB
Markdown
61 lines
2.7 KiB
Markdown
<p align="center">
|
|
<a href="https://github.com/ruchika-org/package-action"></a>
|
|
</p>
|
|
|
|
# Package and Publish
|
|
|
|
This action packages your action repository as OCI artifacts and publishes it to [GHCR](ghcr.io), so your action can then be consumed as a package to make the actions ecosystem more secure.
|
|
|
|
The whole action repository is packaged by default. Set `path` input to specify which path you want to package if you want only a few folders (for eg. dist) to be packaged.
|
|
|
|
Make sure you use the [Starter Workflow] (https://github.com/actions-on-packages/.github) (TODO) to run the action and ensure you have the release trigger in the workflow where you use this action.
|
|
|
|
# Usage
|
|
|
|
<!-- start usage -->
|
|
```yaml
|
|
on:
|
|
release:
|
|
|
|
- uses: immutable-actions/publish-action-package@1.0.1
|
|
with:
|
|
|
|
# Personal access token (PAT) or GITHUB_TOKEN with write:package scope used to upload the package to GHCR. The GITHUB_TOKEN is taken by default.
|
|
#
|
|
# We recommend using a service account with the least permissions necessary. Also
|
|
# when generating a new PAT, select the least scopes necessary.
|
|
#
|
|
# [Learn more about creating and using encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)
|
|
#
|
|
# Default: ${{ github.token }}
|
|
token: ''
|
|
|
|
# Relative path of the working directory of the repository to be tar archived
|
|
# and uploaded as OCI Artifact layer. You can mention multiple files/folders
|
|
# by mentioning relative paths as space separated values.
|
|
#
|
|
# This defaults to the entire action repository contents if not explicitly defined.
|
|
# Default: '.'
|
|
path: 'src/ action.yml dist/'
|
|
|
|
|
|
```
|
|
<!-- end usage -->
|
|
|
|
# License
|
|
|
|
The scripts and documentation in this project are released under the [MIT License](LICENSE)
|
|
|
|
|
|
# [Internal] Differences from previous implementation
|
|
|
|
This is a new implementation of an Action which publishes a given release to ghcr.io (GitHub Packages). It will eventually be moved to https://github.com/actions-on-packages/package-action and replace the existing implementation.
|
|
|
|
The key differences are:
|
|
* This Action goes directly to GitHub Packages rather than using an API endpoint to pass a bundle to.
|
|
* This Action uses Node.js libraries to create both a `zip` and `tar.gz` of the content as layers.
|
|
* This Action creates and publishes the OCI manifest which houses those archives, which was previously done on the backend.
|
|
* This Action has the goal of generating provenance attestations for any release that is created.
|
|
* This Action parses and validates that the release tag which triggered it is in a valid semver format, either `1.0.3-prerelease` or `v1.0.0-prerelease`.
|
|
|