Publishing of packages which are Docker images

[tuler]

We have some "packages" which are Docker images.
Build of those uses Docker bake.
Publishing should push to registry.

I'm wondering how people is handling the publishing of artifacts like these.
The documentation suggests that:

Changesets only versions NPM package.json files, you can trigger releases for other package formats by creating workflows which trigger on tags/releases being created by changesets.

The main problem here is that the tags created by the release workflow and changesets action do not trigger other workflows, because GitHub Actions prevents recursive runs, so the suggestion doesn't really work that well.

if a workflow run pushes code using the repository's GITHUB_TOKEN, a new workflow will not run even when the repository contains a workflow configured to run when push events occur

To workaround this we are using workflow_dispatch, as suggested by GitHub. But it looks quite complex. So I'm wondering how others are doing this.

[stijnvanderlaan]

We have the same problem/question, and it's really strange that there is no solution to be found for this. The fakt the documentation suggests something which can't work is frustrating.

[getanwar]

Man, I have been fighting with this for two days and came across this discussion. I assumed that Github is somehow blocking my workflow to run after changeset pushed a tag, but didn't look for GH documentation since changeset says this 👇 in their documentation.

Changesets only versions NPM package.json files, you can trigger releases for other package formats by creating workflows which trigger on tags/releases being created by changesets.

The entire goal for this part of the documentation is, how to handle release for non-npm packages, but they messed it up.

[getanwar]

I have found a easier and cleaner solution after tinkering for a while. In the same github workflow I have two jobs, one for changeset to create and push versions of my packages, another for publishing versioned images to docker registry. Here is a working version of it that contains both of the jobs. I hope this will help you and the future readers.

name: Release
on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

env:
  REGISTRY: ghcr.io
  IMAGE: ghcr.io/MY_ORG/MY_REPOSITORY

jobs:
  release:
    name: Release Changeset
    runs-on: ubuntu-latest
    outputs:
      published: ${{ steps.changesets.outputs.published }}
      publishedPackages: ${{ steps.changesets.outputs.publishedPackages }}
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v3

      - name: Setup Node.js 20
        uses: actions/setup-node@v3
        with:
          node-version: 20.10.0

      - name: Install Dependencies
        run: npm install

      - name: Create Release Pull Request
        id: changesets
        uses: changesets/action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          # this npm script triggers `changeset publish`
          publish: npm run release

  publish-docker:
    name: Publish Docker Images
    runs-on: ubuntu-latest
    needs: release
    if: needs.release.outputs.published == 'true'
    strategy:
      fail-fast: true
      matrix:
        package: ${{ fromJson(needs.release.outputs.publishedPackages) }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE }}
          tags: |
            # use custom value instead of git tag
            type=semver,pattern={{version}},value=${{ matrix.package.version }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker Login
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker Image Publish
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

[Trugamr]

I was able to achieve the result I wanted using two workflows, one for creating a release and other for publishing image when new release is created.

One gotcha was that releases created by github-actions won't triggering docker image build workflow so I had to use personal access token instead of GITHUB_TOKEN. You can read more about that in this discussion.

name: Create Release Pull Request or Publish

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  create-release-pull-request-or-publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js 20
        uses: actions/setup-node@v4
        with:
          node-version: 20.11.0

      - name: Setup pnpm
        uses: pnpm/action-setup@v2
        with:
          version: 8

      - name: Install changesets CLI
        run: pnpm install -D @changesets/cli

      - name: Create Release Pull Request or Publish
        uses: changesets/action@v1
        id: changesets
        # GITHUB_TOKEN doesn't trigger workflow on automated release
        # https://github.com/orgs/community/discussions/26875
        env:
          GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
        with:
          publish: pnpm changeset publish

name: Build and Publish Docker Image

on:
  release:
    types:
      - published

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-publish:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          pull: true
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

Here is the repository using these workflows if anyone wants to dig any deeper
https://github.com/Trugamr/changesets-docker-playground

[anbraten]

Did you used a classic token or a new Fine-grained personal access token?

[Trugamr]

I used classic token.

[anbraten]

Thanks got it to work with a fine grained one now as well.