docker.yml

name: Docker

on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: Image tag
        required: true
        default: edge
      version:
        description: Software version
        required: true
        default: 0.1.0-dev
  push:
    tags:
      - "v*"

env:
  REGISTRY: ghcr.io

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      image_name: ${{ steps.meta.outputs.image_name }}
      version_major: ${{ steps.meta.outputs.version_major }}
      version_minor: ${{ steps.meta.outputs.version_minor }}
      version_patch: ${{ steps.meta.outputs.version_patch }}
      version_pre_release: ${{ steps.meta.outputs.version_pre_release }}
      image_tag: ${{ steps.meta.outputs.image_tag }}
      build_commit: ${{ steps.meta.outputs.build_commit }}
      build_timestamp: ${{ steps.meta.outputs.build_timestamp }}
      publish_latest: ${{ steps.meta.outputs.publish_latest }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Prepare metadata
        id: meta
        shell: bash
        run: |
          echo "image_name=${REGISTRY}/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
          if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
            version="${GITHUB_REF_NAME#v}"
            image_tag="$GITHUB_REF_NAME"
          else
            version="${{ inputs.version }}"
            image_tag="${{ inputs.image_tag }}"
          fi
          if [[ ! "$version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(-([0-9A-Za-z.-]+))?$ ]]; then
            echo "version must use semantic version format" >&2
            exit 1
          fi
          echo "version_major=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
          echo "version_minor=${BASH_REMATCH[2]}" >> "$GITHUB_OUTPUT"
          echo "version_patch=${BASH_REMATCH[3]}" >> "$GITHUB_OUTPUT"
          echo "version_pre_release=${BASH_REMATCH[5]}" >> "$GITHUB_OUTPUT"
          echo "image_tag=$image_tag" >> "$GITHUB_OUTPUT"
          echo "build_commit=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
          echo "build_timestamp=$(git show -s --format=%ct HEAD)" >> "$GITHUB_OUTPUT"
          if [[ "$GITHUB_REF_TYPE" == "tag" && -z "${BASH_REMATCH[5]}" ]]; then
            echo "publish_latest=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish_latest=false" >> "$GITHUB_OUTPUT"
          fi

  build_docker_image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    needs:
      - prepare
    strategy:
      matrix:
        platform:
          - linux/386
          - linux/amd64
          - linux/arm/v6
          - linux/arm/v7
          - linux/arm64
          - linux/ppc64le
          - linux/riscv64
          - linux/s390x
      fail-fast: true

    steps:
      - name: Prepare platform identifier
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"

      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup QEMU
        uses: docker/setup-qemu-action@v3

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: latest
          driver-opts: "image=moby/buildkit:v0.10.5"

      - name: Login to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          provenance: false
          context: .
          platforms: ${{ matrix.platform }}
          labels: ${{ needs.prepare.outputs.image_name }}
          outputs: type=image,name=${{ needs.prepare.outputs.image_name }},push-by-digest=true,name-canonical=true,push=true
          build-args: |
            VERSION_MAJOR=${{ needs.prepare.outputs.version_major }}
            VERSION_MINOR=${{ needs.prepare.outputs.version_minor }}
            VERSION_PATCH=${{ needs.prepare.outputs.version_patch }}
            VERSION_PRE_RELEASE=${{ needs.prepare.outputs.version_pre_release }}
            BUILD_CHANNEL=github-actions-docker
            BUILD_COMMIT=${{ needs.prepare.outputs.build_commit }}
            BUILD_TIMESTAMP=${{ needs.prepare.outputs.build_timestamp }}

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge_docker_digests:
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    needs:
      - prepare
      - build_docker_image

    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          DIGESTS=""
          for f in *; do
            DIGESTS="$DIGESTS ${{ needs.prepare.outputs.image_name }}@sha256:$f"
          done
          echo "Merging digests: $DIGESTS"
          docker buildx imagetools create \
            --tag ${{ needs.prepare.outputs.image_name }}:${{ needs.prepare.outputs.image_tag }} \
            $DIGESTS
          if [[ "${{ needs.prepare.outputs.publish_latest }}" == "true" ]]; then
            echo "Also tagging as latest"
            docker buildx imagetools create \
              --tag ${{ needs.prepare.outputs.image_name }}:latest \
              ${{ needs.prepare.outputs.image_name }}:${{ needs.prepare.outputs.image_tag }}
          fi

      - name: Inspect final manifest
        run: |
          docker buildx imagetools inspect ${{ needs.prepare.outputs.image_name }}:${{ needs.prepare.outputs.image_tag }}