docker.yml

name: Docker

on:
  push:
    branches:
      - main
      - dev
    tags:
      - "v*"
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  UPSTREAM_REPOSITORY: TypeType-Video/TypeType
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: true

jobs:
  prepare:
    runs-on: [self-hosted, Linux, X64, r730, downloader]
    permissions:
      contents: read
    outputs:
      build-time: ${{ steps.build-info.outputs.build-time }}
      image: ${{ steps.build-info.outputs.image }}
      labels: ${{ steps.meta.outputs.labels }}
      metadata-json: ${{ steps.meta.outputs.json }}
      version: ${{ steps.build-info.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Resolve build metadata
        id: build-info
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
            base_version="${GITHUB_REF_NAME#v}"
            if [[ ! "$base_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "Invalid component release tag: $GITHUB_REF_NAME"
              exit 1
            fi
            gh api "repos/${UPSTREAM_REPOSITORY}/git/ref/tags/v${base_version}" >/dev/null
            version="$base_version"
          else
            upstream_tag="$(gh api "repos/${UPSTREAM_REPOSITORY}/releases/latest" --jq '.tag_name')"
            if [[ ! "$upstream_tag" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
              echo "Invalid upstream TypeType release tag: $upstream_tag"
              exit 1
            fi
            base_version="${BASH_REMATCH[1]}"
          fi
          if [[ "$GITHUB_REF_NAME" == "main" ]]; then
            version="$base_version"
          elif [[ "$GITHUB_REF_NAME" == "dev" ]]; then
            base_version="$(tr -d '[:space:]' < VERSION)"
            if [[ ! "$base_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "Invalid development version: $base_version"
              exit 1
            fi
            version="$base_version-dev.$GITHUB_RUN_NUMBER"
          elif [[ "$GITHUB_REF" != refs/tags/v* ]]; then
            channel="${GITHUB_REF_NAME//[^0-9A-Za-z-]/-}"
            version="$base_version-$channel.$GITHUB_RUN_NUMBER"
          fi
          if [[ "$GITHUB_REF_NAME" == "dev" ]]; then
            image="${REGISTRY}/${GITHUB_REPOSITORY,,}-beta"
          else
            image="${REGISTRY}/${GITHUB_REPOSITORY,,}"
          fi
          {
            echo "image=$image"
            echo "version=$version"
            echo "build-time=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
          } >> "$GITHUB_OUTPUT"

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ steps.build-info.outputs.image }}
          tags: |
            type=raw,value=${{ steps.build-info.outputs.version }}
            type=sha,prefix=sha-,format=short
            type=ref,event=branch
            type=ref,event=tag
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=latest,enable=${{ github.ref_name == 'dev' }}
            type=raw,value=beta,enable=${{ github.ref_name == 'dev' }}

  build-platform:
    needs: prepare
    runs-on: [self-hosted, Linux, X64, r730, downloader]
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            arch: amd64
          - platform: linux/arm64
            arch: arm64
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Isolate Docker credentials
        run: echo "DOCKER_CONFIG=$RUNNER_TEMP/docker-config" >> "$GITHUB_ENV"

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
        if: matrix.arch == 'arm64'
        uses: docker/setup-qemu-action@v4
        with:
          platforms: arm64
          cache-image: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and push platform image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.wolfi
          build-args: |
            BUILD_VERSION=${{ needs.prepare.outputs.version }}
            BUILD_REVISION=${{ github.sha }}
            BUILD_TIME=${{ needs.prepare.outputs.build-time }}
          platforms: ${{ matrix.platform }}
          labels: ${{ needs.prepare.outputs.labels }}
          outputs: type=image,name=${{ needs.prepare.outputs.image }},push-by-digest=true,name-canonical=true,push=true
          provenance: false
          cache-from: type=gha,scope=downloader-${{ matrix.arch }}
          cache-to: type=gha,mode=max,scope=downloader-${{ matrix.arch }}

      - name: Verify published FFmpeg runtime
        env:
          IMAGE: ${{ needs.prepare.outputs.image }}
          DIGEST: ${{ steps.build.outputs.digest }}
          PLATFORM: ${{ matrix.platform }}
          ARCH: ${{ matrix.arch }}
        run: |
          docker pull --platform "$PLATFORM" "$IMAGE@$DIGEST"
          if [[ "$ARCH" == "amd64" ]]; then
            docker run --rm --platform "$PLATFORM" --entrypoint ffmpeg "$IMAGE@$DIGEST" -version
          else
            container_id="$(docker create --platform "$PLATFORM" --entrypoint ffmpeg "$IMAGE@$DIGEST")"
            trap 'docker rm "$container_id" >/dev/null' EXIT
            ffmpeg_path="$RUNNER_TEMP/ffmpeg-$ARCH"
            docker cp "$container_id:/usr/bin/ffmpeg" "$ffmpeg_path"
            readelf -h "$ffmpeg_path" | grep -q 'Machine:.*AArch64'
          fi

      - name: Export digest
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          digest_dir="$RUNNER_TEMP/downloader-digests"
          rm -rf "$digest_dir"
          mkdir -p "$digest_dir"
          touch "$digest_dir/${DIGEST#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v7
        with:
          name: downloader-digest-${{ matrix.arch }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/downloader-digests/*
          if-no-files-found: error
          retention-days: 1

  publish:
    needs: [prepare, build-platform]
    runs-on: [self-hosted, Linux, X64, r730, downloader]
    timeout-minutes: 10
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.manifest.outputs.digest }}
    steps:
      - name: Isolate Docker credentials
        run: echo "DOCKER_CONFIG=$RUNNER_TEMP/docker-config" >> "$GITHUB_ENV"

      - name: Prepare digest directory
        run: rm -rf "$RUNNER_TEMP/downloader-digests"

      - name: Download digests
        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/downloader-digests
          pattern: downloader-digest-*-${{ github.run_id }}-${{ github.run_attempt }}
          merge-multiple: true

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Publish manifest list
        id: manifest
        env:
          DIGEST_DIR: ${{ runner.temp }}/downloader-digests
          IMAGE: ${{ needs.prepare.outputs.image }}
          METADATA_JSON: ${{ needs.prepare.outputs.metadata-json }}
        run: |
          mapfile -t digests < <(find "$DIGEST_DIR" -maxdepth 1 -type f -printf '%f\n' | sort)
          if [[ "${#digests[@]}" -ne 2 ]]; then
            echo "Expected two platform digests, found ${#digests[@]}"
            exit 1
          fi
          mapfile -t tags < <(jq -r '.tags[]' <<< "$METADATA_JSON")
          tag_args=()
          for tag in "${tags[@]}"; do tag_args+=(--tag "$tag"); done
          source_args=()
          for digest in "${digests[@]}"; do source_args+=("$IMAGE@sha256:$digest"); done
          docker buildx imagetools create "${tag_args[@]}" "${source_args[@]}"
          manifest_json="$(docker buildx imagetools inspect "${tags[0]}" --format '{{json .Manifest}}')"
          digest="$(jq -r '.digest' <<< "$manifest_json")"
          if [[ "$digest" != sha256:* ]]; then
            echo "Published manifest has no valid digest"
            exit 1
          fi
          echo "digest=$digest" >> "$GITHUB_OUTPUT"

  notify-orchestrator:
    needs: [prepare, publish]
    if: github.ref_name == 'dev' || github.ref_name == 'main' || startsWith(github.ref, 'refs/tags/v')
    runs-on: [self-hosted, Linux, X64, r730, downloader]
    permissions:
      contents: read
    env:
      GH_TOKEN: ${{ secrets.TYPETYPE_ORCHESTRATOR_TOKEN }}
    steps:
      - name: Send image digest
        env:
          DIGEST: ${{ needs.publish.outputs.digest }}
          IMAGE: ${{ needs.prepare.outputs.image }}
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          if [[ "$GITHUB_REF_NAME" == "dev" ]]; then channel="beta"; else channel="stable"; fi
          jq -n \
            --arg channel "$channel" \
            --arg component "downloader" \
            --arg digest "$DIGEST" \
            --arg image "$IMAGE" \
            --arg revision "$GITHUB_SHA" \
            --arg version "$VERSION" \
            '{event_type:"component-image",client_payload:{channel:$channel,component:$component,digest:$digest,image:$image,revision:$revision,version:$version}}' \
            | gh api --method POST repos/TypeType-Video/TypeType/dispatches --input -