/
/
/
1name: Build base image
2
3on:
4 workflow_dispatch:
5 inputs:
6 version:
7 description: "Version number"
8 required: true
9 type: string
10
11env:
12 EXPECTED_APP_SLUG: musicassistant-bot
13 EXPECTED_APP_INSTALLATION_ID: "146062122"
14
15jobs:
16 build-base-image:
17 name: Builds and pushes the Music Assistant base container to ghcr.io
18 runs-on: ubuntu-latest
19 permissions:
20 contents: read
21 packages: write
22 steps:
23 - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
24 - name: Read Python version
25 id: python
26 run: echo "version=$(cat .python-version)" >> "$GITHUB_OUTPUT"
27
28 - name: Create appvars token
29 id: appvars_token
30 uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
31 with:
32 client-id: ${{ vars.MUSIC_ASSISTANT_BOT_CLIENT_ID }}
33 private-key: ${{ secrets.MUSIC_ASSISTANT_BOT_PRIVATE_KEY }}
34 owner: ${{ github.repository_owner }}
35 repositories: appvars
36 permission-contents: read
37
38 - name: Verify GitHub App identity
39 env:
40 APP_SLUG: ${{ steps.appvars_token.outputs.app-slug }}
41 INSTALLATION_ID: ${{ steps.appvars_token.outputs.installation-id }}
42 run: |
43 if [ "$APP_SLUG" != "$EXPECTED_APP_SLUG" ] || \
44 [ "$INSTALLATION_ID" != "$EXPECTED_APP_INSTALLATION_ID" ]; then
45 echo "Unexpected GitHub App installation: $APP_SLUG/$INSTALLATION_ID" >&2
46 exit 1
47 fi
48
49 - name: Download Widevine CDM client files from private repository
50 env:
51 GH_TOKEN: ${{ steps.appvars_token.outputs.token }}
52 run: |
53 mkdir -p widevine_cdm
54 # the Accept header must not end in "+json": gh then runs the response
55 # through its JSON handling, which fails on the binary client_id.bin
56 gh api \
57 -H "Accept: application/vnd.github.raw" \
58 "repos/music-assistant/appvars/contents/widevine_cdm_client/private_key.pem" \
59 > widevine_cdm/private_key.pem
60 gh api \
61 -H "Accept: application/vnd.github.raw" \
62 "repos/music-assistant/appvars/contents/widevine_cdm_client/client_id.bin" \
63 > widevine_cdm/client_id.bin
64 # a request GitHub declines to serve raw comes back as the JSON metadata
65 # envelope with a 200, which would end up in the image unnoticed
66 for file in widevine_cdm/private_key.pem widevine_cdm/client_id.bin; do
67 if [ ! -s "$file" ] || [ "$(head -c 1 "$file")" = "{" ]; then
68 echo "Downloaded $file is empty or not the raw file content" >&2
69 exit 1
70 fi
71 done
72 - name: Log in to the GitHub container registry
73 uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
74 with:
75 registry: ghcr.io
76 username: ${{ github.repository_owner }}
77 password: ${{ secrets.GITHUB_TOKEN }}
78 - name: Set up Docker Buildx
79 uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
80
81 - name: Build and Push image
82 uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
83 with:
84 context: .
85 platforms: linux/amd64,linux/arm64
86 file: Dockerfile.base
87 build-args: |
88 PYTHON_VERSION=${{ steps.python.outputs.version }}
89 tags: |-
90 ghcr.io/${{ github.repository_owner }}/base:${{ inputs.version }},
91 ghcr.io/${{ github.repository_owner }}/base:latest
92 push: true
93