Docker

Name: semrel
Author: SemRels

semrel is available as an official Docker image at ghcr.io/SemRels/semrel.

Image variants

Tag	Base	Includes	Notes
`ghcr.io/SemRels/semrel:latest`	distroless (Debian 12)	git, ca-certificates	No shell, no package manager. Recommended default.
`ghcr.io/SemRels/semrel:1.0.0`	distroless (Debian 12)	git, ca-certificates	Version-pinned
`ghcr.io/SemRels/semrel:latest-alpine`	Alpine 3.22	git, ca-certificates, openssh-client, shell	Use when SSH or shell scripting is needed
`ghcr.io/SemRels/semrel:1.0.0-alpine`	Alpine 3.22	git, ca-certificates, openssh-client, shell	Version-pinned Alpine
`ghcr.io/SemRels/semrel:latest-action`	Alpine 3.22	git, ca-certificates, openssh-client, shell	GitHub Docker container actions only
`ghcr.io/SemRels/semrel:1.0.0-action`	Alpine 3.22	git, ca-certificates, openssh-client, shell	Version-pinned GitHub Actions image

Quickstart

docker run --rm \
  -v "$(pwd):/workspace" \
  -w /workspace \
  -e SEMREL_PLUGIN_TOKEN="$GITHUB_TOKEN" \
  ghcr.io/SemRels/semrel:latest release --dry-run

GitHub Actions

jobs:
  release:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/SemRels/semrel:latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Restore semrel plugins
        run: semrel plugin restore

      - name: Run semrel
        run: semrel release
        env:
          SEMREL_PLUGIN_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Or use it as a Docker action step:

- name: Run semrel
  uses: docker://ghcr.io/SemRels/semrel:latest-action
  with:
    args: release
  env:
    SEMREL_PLUGIN_TOKEN: ${{ secrets.GITHUB_TOKEN }}

GitHub mounts the action workspace with the runner’s ownership and requires Docker container actions to run as root. Use the dedicated -action tag only with uses: docker://...; the regular images deliberately remain non-root.

GitLab CI

semrel:
  image: ghcr.io/SemRels/semrel:latest
  stage: release
  script:
    - semrel plugin restore
    - semrel release --gitlab-dotenv semrel.env
  artifacts:
    reports:
      dotenv: semrel.env

Gitea Actions

jobs:
  release:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/SemRels/semrel:latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Restore semrel plugins
        run: semrel plugin restore
      - name: Run semrel
        run: semrel release
        env:
          SEMREL_PLUGIN_TOKEN: ${{ secrets.GITEA_TOKEN }}

Environment variables

Variable	Required	Description
`SEMREL_PLUGIN_TOKEN`	Yes (most providers)	API token passed to provider/hook plugins
`SEMREL_DRY_RUN`	No	Set to `true` to simulate without making changes
`SEMREL_REGISTRY_URL`	No	Override the plugin registry URL

Workspace mounting

semrel operates on the current working directory. When using docker run, mount your repository to /workspace:

docker run --rm \
  -v "$(pwd):/workspace" \
  -w /workspace \
  -e SEMREL_PLUGIN_TOKEN="$GITHUB_TOKEN" \
  ghcr.io/SemRels/semrel:latest release

Version pinning

Pin to a specific version for reproducible builds:

ghcr.io/SemRels/semrel:1.0.0         # distroless
ghcr.io/SemRels/semrel:1.0.0-alpine  # Alpine

Security notes

Both regular images run as a non-root user by default.
The opt-in -action image runs as root solely for GitHub Docker container actions. Do not use it for general container workloads.
The latest (distroless) image has no shell or package manager — minimal attack surface.
The Alpine image is pinned to 3.22 and built with apk upgrade --no-cache to apply all security patches at build time.
Images are signed with cosign and include an SBOM attestation.