# GitHub Actions — .github/workflows/build.yml
on:
  push:
    branches: [main]
permissions:
  contents: read
  packages: write          # GITHUB_TOKEN is minted per job and expires with it,
                           # so there is no stored registry password. This is NOT
                           # OIDC - see the FAQ for federating to a cloud role.
jobs:
  build:
    runs-on: ubuntu-latest
    # Pin actions by commit digest in production (uses: owner/repo@<sha>).
    # Tags are mutable and are shown here only for readability.
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        with:
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

# ---------------------------------------------------------------

# GitLab CI — .gitlab-ci.yml
build:
  stage: build
  image: docker:27
  services: [docker:27-dind]
  variables:
    # Without these the client looks for a unix socket while dind is
    # listening on TLS 2376, and docker login cannot connect at all.
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"
    DOCKER_TLS_VERIFY: 1
    DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
    # CI_REGISTRY_* are injected; no secret to configure
    - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
    - docker build -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA" .
    - docker push "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA"

# ---------------------------------------------------------------

# Jenkins — Jenkinsfile
pipeline {
  agent { label 'docker' }        // an agent you provision and maintain
  stages {
    stage('Build') {
      when { branch 'main' }
      steps {
        script {
          docker.withRegistry('https://registry.example.com', 'registry-creds') {
            docker.build("app:${env.GIT_COMMIT}").push()
          }
        }
      }
    }
  }
}