GitHub Actions workflow generator for Docker

Get a ci.yml that tests your code, builds the image and pushes it to a registry, with the security options you pick. You choose the triggers, nothing is fixed for you.

Generate your files

What you get

Test job per stack with lint, tests, build and dependency audit steps, and an optional runtime-version and OS matrix.
Image job with multi-arch builds, tags from the branch, the git tag, a semantic version or latest, and a push to GHCR, Docker Hub, Quay, Artifact Registry, ECR, ACR or your own registry.
Triggers you switch on one by one: push branches, tags, pull requests, manual runs that ask which steps to run, releases and cron schedules.
Third-party actions are pinned to commit SHAs, token permissions are limited, and concurrency cancels superseded pull-request runs.
Optional Trivy scan that fails on HIGH and CRITICAL, SBOM and provenance attestations, cosign keyless signing, Hadolint and CodeQL.
Deploy to Kubernetes, over SSH, Cloud Run, ECS, Azure or Fly, with several environments if you need them.

Sample output

.github/workflows/ci.yml

name: CI

on:
  push:
    branches: ["main"]
    tags: ["v*"]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: "false"
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "24"
          cache: "npm"
      - run: npm ci
      - run: npm run build

  image:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      image: ${{ steps.ref.outputs.image }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: "false"
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - if: "github.event_name != 'pull_request'"
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: "ghcr.io"
          username: "${{ github.actor }}"
          password: "${{ secrets.GITHUB_TOKEN }}"
      - id: ref
        run: |
          name=$(printf '%s' "$IMAGE_NAME" | tr '[:upper:]' '[:lower:]')
          echo "name=$name" >> "$GITHUB_OUTPUT"
          echo "image=$name:sha-$GITHUB_SHA" >> "$GITHUB_OUTPUT"
        env:
          IMAGE_NAME: "ghcr.io/${{ github.repository }}"
      - id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: "${{ steps.ref.outputs.name }}"
          tags: |
            type=ref,event=branch
            type=ref,event=tag
            type=sha,format=long
            type=raw,value=latest,enable={{is_default_branch}}
      - id: build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: "."
          push: "${{ github.event_name != 'pull_request' }}"
          tags: "${{ steps.meta.outputs.tags }}"
          labels: "${{ steps.meta.outputs.labels }}"
          cache-from: "type=gha"
          cache-to: "type=gha,mode=max"

GitHub Actions workflow for a Node.js project (actions pinned to commit SHAs). Generated by Dockcrate.

How it works

Pick a stack and the options you need.
Preview every file, and edit or switch off any block.
Copy the files or download them as a zip.

Questions

Why are the actions pinned to commit SHAs?

A tag such as v4 can be moved to different code later. A commit SHA cannot, so the workflow keeps running the exact version that was reviewed. Turn pinning off if you prefer tags.

Has the workflow been run on my repository?

No. Pipelines are checked as text but not run on your CI, and deploy files are templates never run against a real account. Read the notes and expect small edits to secret names and commands.

Can it deploy as well as build?

Yes: Kubernetes (with generated manifests), SSH with docker compose, Cloud Run, ECS, Azure Web App for Containers and Fly. Or stop after pushing the image.

Does it work for a repository with several services?

Yes. Services with identical test steps share a matrix job, and images are built per service. You can limit runs to the services whose folder changed.