Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
@semantic-release-plus/docker
Advanced tools
A semantic-release-plus or semantic-release plugin for publishing a docker images to a docker registry.
Step | Description |
---|---|
verifyConditions | Verify that all needed configuration and DOCKER_USERNAME and DOCKER_PASSWORD environment variables are present and logs into the Docker registry unless skipped. |
addChannel | Tag an existing image with a new channel. Run only if there are releases that have been merged from a higher branch but not added on the channel of the current branch. |
publish | Tag the image specified by name as {registry}/{name}:{version} and {registry}/{name}:{channel} (based on configuration) and push it to the Docker registry. |
$ npm install @semantic-release/npm -D
The plugin can be configured in the semantic-release-plus configuration file:
{
"release": {
"plugins": [
[
"@semantic-release-plus/docker",
{
"name": "my-cool-docker-app"
}
]
]
}
}
Option | Description | Type | Default |
---|---|---|---|
name | Required config associated with the tag name assigned to the image during build docker build -t name . | string | |
registry | The docker registry to login and push images to, this will be pre-pended to the name field when tagging | string | docker.io |
publishChannelTag | Will publish a channel (dist) tag such as latest , next , beta , alpha , 1 , and 1.1 , that always points to the most recent release on the channel. 1 , 1.1 tags will only be created on maintenance branches. See Publishing maintenance releases | boolean | true |
skipLogin | Skips logging in to docker hub in the verifyConditions step, used if you log in separately in your CI job. Removes requirement for DOCKER_USERNAME and DOCKER_PASSWORD environment variables | boolean | false |
The following is an example github action configuration, the source repo can be found at https://github.com/JoA-MoS/srp-docker-example
name: CI
on:
push:
branches:
- master
- next
- beta
- alpha
- '*.x'
pull_request:
types:
- opened
- synchronize
jobs:
build_release:
runs-on: ubuntu-latest
steps:
- name: Build
uses: actions/checkout@v2
with:
fetch-depth: 0
- run: docker build --tag joa-mos/srp-docker-example .
- name: Release
uses: actions/setup-node@v2
with:
cache: npm
- run: npm ci
- run: npx semantic-release-plus
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
DOCKER_USERNAME: joa-mos
DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
jobs:
include:
- stage: release
language: node_js
node_js: '8'
services:
- docker
script:
- docker build -t username/imagename .
- npm run semantic-release
stages:
- test
- name: release
if: branch = master AND type = push AND fork = false
branches:
except:
- /^v\d+\.\d+\.\d+$/
version: 2
jobs:
release:
docker:
- image: circleci/node:8
steps:
- setup_remote_docker:
docker_layer_caching: true
- run:
name: release
command: |
docker build -t username/imagename .
npm run semantic-release
workflows:
version: 2
pipeline:
jobs:
- test
- release:
requires:
- test
filters:
branches:
only: master
Note that
setup_remote_docker
step is required for this plugin to work in Circle CI environment
It is best to let semantic-release focus on releasing your built artifact and not extend semantic-release to also do the build. I recommend using semantic-release-plus to get the next version without creating a tag then using that durning your build process. An example of this can be found in the semantic-release-plus Expected next version recipe.
FAQs
semantic-release plugin to release a docker container
The npm package @semantic-release-plus/docker receives a total of 882 weekly downloads. As such, @semantic-release-plus/docker popularity was classified as not popular.
We found that @semantic-release-plus/docker demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.