Build and push images to your registry from GitHub Actions
A complete CI pipeline: build a Docker image on every push, push it to your ByteNests registry, and let App Platform deploy it, even from a private repository.
App Platform builds straight from public GitHub and GitLab repositories. For private code, the usual pattern is to build the image in your own CI and push it to your registry. App Platform then picks up each new image on its own.
Step 1: a token for CI
Create a separate registry token for the pipeline, so you can revoke it without affecting anyone else. In the console use Container Registry → Access tokens, or:
bn registry token create --name github-actions --expires-in-days 365
Copy the username and secret; the secret is shown only once.
Step 2: store the secrets in GitHub
In your repository, open Settings → Secrets and variables → Actions and add three repository secrets:
REGISTRY_HOST: Your registry host, from the registry page or bn registry get.
REGISTRY_USER: The token username (starts with robot$).
REGISTRY_TOKEN: The token secret.
Step 3: the workflow
Add this file to the repository. It builds the image from your Dockerfile on every push to main, and tags it with both the commit hash and latest.
name: Build and push
on:
push:
branches: [main]
jobs:
image:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: docker/login-action@v3
with:
registry: ${{ secrets.REGISTRY_HOST }}
username: ${{ secrets.REGISTRY_USER }}
password: ${{ secrets.REGISTRY_TOKEN }}
- uses: docker/build-push-action@v6
with:
push: true
tags: |
${{ secrets.REGISTRY_HOST }}/acme/my-app:${{ github.sha }}
${{ secrets.REGISTRY_HOST }}/acme/my-app:latest
Replace acme with your registry name and my-app with the repository name you want.
Step 4: deploy it
Create an app with Your container registry as the source and the latest tag. From now on, every push to main builds a new image, and pushing it to the tag redeploys the app. The image is scanned on the way in, so the registry page shows if a new build brought in a known vulnerability.
If something goes wrong after a deploy, Roll back on the app’s Deployments tab returns to the previous image. Because every image is also tagged with its commit hash, you can always see which commit is running.
Tips
Keep the Dockerfile small: a slim base image builds faster, pushes less and has fewer vulnerabilities.
Add a .dockerignore so node_modules, .git and local files are not sent to the build.
Cleanup rules keep the newest tags per repository, so commit-hash tags do not pile up forever.
The same login works for GitLab CI or any other system: run docker login with the token, then docker build and docker push.