music-assistant-server

1name: Build base image
2
3on:
4  workflow_dispatch:
5    inputs:
6      version:
7        description: "Version number"
8        required: true
9        type: string
10
11env:
12  EXPECTED_APP_SLUG: musicassistant-bot
13  EXPECTED_APP_INSTALLATION_ID: "146062122"
14
15jobs:
16  build-base-image:
17    name: Builds and pushes the Music Assistant base container to ghcr.io
18    runs-on: ubuntu-latest
19    permissions:
20      contents: read
21      packages: write
22    steps:
23      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
24      - name: Read Python version
25        id: python
26        run: echo "version=$(cat .python-version)" >> "$GITHUB_OUTPUT"
27
28      - name: Create appvars token
29        id: appvars_token
30        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
31        with:
32          client-id: ${{ vars.MUSIC_ASSISTANT_BOT_CLIENT_ID }}
33          private-key: ${{ secrets.MUSIC_ASSISTANT_BOT_PRIVATE_KEY }}
34          owner: ${{ github.repository_owner }}
35          repositories: appvars
36          permission-contents: read
37
38      - name: Verify GitHub App identity
39        env:
40          APP_SLUG: ${{ steps.appvars_token.outputs.app-slug }}
41          INSTALLATION_ID: ${{ steps.appvars_token.outputs.installation-id }}
42        run: |
43          if [ "$APP_SLUG" != "$EXPECTED_APP_SLUG" ] || \
44             [ "$INSTALLATION_ID" != "$EXPECTED_APP_INSTALLATION_ID" ]; then
45            echo "Unexpected GitHub App installation: $APP_SLUG/$INSTALLATION_ID" >&2
46            exit 1
47          fi
48
49      - name: Download Widevine CDM client files from private repository
50        env:
51          GH_TOKEN: ${{ steps.appvars_token.outputs.token }}
52        run: |
53          mkdir -p widevine_cdm
54          gh api \
55            -H "Accept: application/vnd.github.raw+json" \
56            "repos/music-assistant/appvars/contents/widevine_cdm_client/private_key.pem" \
57            > widevine_cdm/private_key.pem
58          gh api \
59            -H "Accept: application/vnd.github.raw+json" \
60            "repos/music-assistant/appvars/contents/widevine_cdm_client/client_id.bin" \
61            > widevine_cdm/client_id.bin
62      - name: Log in to the GitHub container registry
63        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
64        with:
65          registry: ghcr.io
66          username: ${{ github.repository_owner }}
67          password: ${{ secrets.GITHUB_TOKEN }}
68      - name: Set up Docker Buildx
69        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
70
71      - name: Build and Push image
72        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
73        with:
74          context: .
75          platforms: linux/amd64,linux/arm64
76          file: Dockerfile.base
77          build-args: |
78            PYTHON_VERSION=${{ steps.python.outputs.version }}
79          tags: |-
80            ghcr.io/${{ github.repository_owner }}/base:${{ inputs.version }},
81            ghcr.io/${{ github.repository_owner }}/base:latest
82          push: true
83