# CI CD

> CI/CD pipeline for haven-docker including the GitHub Actions workflow for GHCR publishing, Makefile-driven DockerHub release, cosign image signing, and version management. Use when modifying build automation, release processes, or image signing. Use when this capability is needed.

- Skill: `tomevault-io/ci-cd-22` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/ci-cd-22`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/ci-cd-22/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/ci-cd-22

---


# CI/CD

## GitHub Actions — `docker-publish.yml`

Located at `.github/workflows/docker-publish.yml`.

### Triggers

- **Schedule**: daily at 12:28 UTC
- **Push**: to `main` branch or semver tags (`v*.*.*`)
- **Pull request**: against `main`

### Pipeline steps

1. Checkout repo
2. Install cosign (skipped on PRs)
3. Set up Docker Buildx
4. Log into GHCR (`ghcr.io`) using `GITHUB_TOKEN`
5. Extract Docker metadata (tags, labels)
6. Build and push image (push skipped on PRs, uses GHA cache)
7. Sign image with cosign (skipped on PRs, uses Sigstore/Fulcio)

### Registry

- **GHCR**: `ghcr.io/sudocarlos/haven-docker` (automated via Actions)
- **DockerHub**: `sudocarlos/haven` (manual via `make release`)

## Manual DockerHub Release — `Makefile`

```bash
make release
```

This runs the `push` and `tag` targets:
1. Extracts version from the `TAG=` line in `Dockerfile`
2. Builds with `docker buildx` (no cache), pushes `latest` + version tags
3. Commits all changes, creates an annotated git tag `dockerhub-<version>`
4. Pushes commits and tags

Individual steps can be run separately with `make push` or `make tag`.

### Prerequisites
- Logged into DockerHub (`docker login`)
- Docker Buildx configured

## Version Management

The Haven version is pinned in `Dockerfile`:

```dockerfile
ARG TAG=v1.2.0-rc2
ARG COMMIT=986c21b79c93779a449a52f6414ea267c83428bb
```

The Makefile extracts the version with:
```makefile
VERSION := $(shell awk -F '=' '/TAG=/{print $$NF}' Dockerfile)
```

**To bump**: update `TAG` and `COMMIT` in `Dockerfile`, then run `make release`.

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/sudocarlos) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->