Github操作:构建和推送docker镜像失败.服务器消息:不足范围:授权失败

Question

我正在使用GitHub操作"构建并推送Docker镜像"；因为它来自Docker和一个顶级的验证动作。

我的YAML文件的相关片段如下

- name: Set up QEMU
uses: docker/setup-qemu-action@v1
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v1
- name: Login to DockerHub
uses: docker/login-action@v1
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
- name: Build and push
id: docker_build
uses: docker/build-push-action@v2
with:
push: true
tags: user/app:latest
- name: Image digest
run: echo ${{ steps.docker_build.outputs.digest }}

正如示例中所示。当工作流程运行时，我总是看到错误

10 [stage-1 2/2] COPY --from=build /workspace/target/*.jar app.jar
#10 DONE 0.9s
#12 exporting to image
#12 exporting layers
#12 exporting layers 4.3s done
#12 exporting manifest sha256:dafb0869387b325491aed0cdc10c2d0206aca28006b300554f48e4c389fc3bf1 done
#12 exporting config sha256:f64316c3b529b43a6cfcc933656c77e556fea8e5600b6d0cce8dc09f775cf107 done
#12 pushing layers
#12 pushing layers 0.8s done
#12 ERROR: server message: insufficient_scope: authorization failed
------
> exporting to image:
------
failed to solve: rpc error: code = Unknown desc = server message: insufficient_scope: authorization failed
Error: The process '/usr/bin/docker' failed with exit code 1

标准spring-boot应用程序的Dockerfile内容如下所示

FROM maven:3.6.3-jdk-11-slim AS build
RUN mkdir -p /workspace
WORKDIR /workspace
COPY pom.xml /workspace
COPY src /workspace/src
RUN mvn -B -f pom.xml clean package -DskipTests
FROM openjdk:11-jdk-slim
COPY --from=build /workspace/target/*.jar app.jar
EXPOSE 8080
ENTRYPOINT ["java","-jar","app.jar"]

有什么线索可以解决吗？

我可以在使用不同的GitHub操作时发布到DockerHub，如下所示

- name: Build and push docker image
uses: elgohr/Publish-Docker-Github-Action@master
with:
name: bloque/sales-lead-management
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}

Answer 1

在使用Docker的build-push-action时，需要设置一个路径上下文。它应该看起来像这样：

- name: Build and push
id: docker_build
uses: docker/build-push-action@v2
with:
context: .
file: Dockerfile
push: true
tags: user/app:latest

file选项完全是可选的，但如果省略，它将在根目录中找到Dockerfile。

还建议使用元数据操作，为Docker映像提供更相关的元数据和标记。

以下是我在几个项目中如何为Spring Boot应用程序做到这一点的示例：https://github.com/moja-global/FLINT.Reporting/blob/d7504909f8f101054e503a2993f4f70ca92c2577/.github/workflows/docker.yml#L153