docker-image.yml

name: Build and Push Multi-Arch Docker Images

on:
  push:
    branches: [ main ]
    paths-ignore:
      - '**.md'
      - 'docs/**'
  release:
    types: [ published ]

env:
  DOCKER_TAG: ${{ github.ref_type == 'tag' && github.ref_name || 'latest' }}

jobs:

  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      services: ${{ steps.set-services.outputs.services }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - id: set-services
        run: |
          set -e

          SERVICES=()
          BASE_REF="${{ github.event.before }}"
          if [ -z "$BASE_REF" ]; then
            BASE_REF="$(git rev-parse HEAD~1)"
          fi

          CHANGED=$(git diff --name-only "$BASE_REF" HEAD)

          echo "Changed files:"
          echo "$CHANGED"

          declare -A MAP=(
            ["plc"]="plc/"
            ["router"]="router/"
            ["workstation"]="workstation/"
            ["simulation"]="simulation/"
            ["scadalts"]="scadalts/"
            ["attacker"]="attacker/"
            ["caldera"]="caldera/"
          )

          # rebuild everything on release
          if [ "${{ github.event_name }}" = "release" ]; then
            SERVICES=("${!MAP[@]}")
          else
            for SERVICE in "${!MAP[@]}"; do
              if echo "$CHANGED" | grep -q "^${MAP[$SERVICE]}"; then
                SERVICES+=("$SERVICE")
              fi
            done
          
            # If shared files changed, rebuild everything
            if echo "$CHANGED" | grep -Eq "^(docker-compose.yml|\.github/)"; then
              SERVICES=("${!MAP[@]}")
            fi
          fi


          echo "services=$(printf '%s\n' "${SERVICES[@]}" | jq -R . | jq -cs .)" >> "$GITHUB_OUTPUT"

  # ================================================================
  # Build AMD64 images
  # ================================================================
  build-amd64:
    needs: detect-changes
    if: needs.detect-changes.outputs.services != '[]'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push amd64 images
        run: |
          SERVICES=$(echo '${{ needs.detect-changes.outputs.services }}' | jq -r '.[]')
          set -euo pipefail
          for SERVICE in $SERVICES; do
            if [ ! -d "./${SERVICE}" ]; then
              echo "⚠️ Skipping ${SERVICE}: directory does not exist"
              continue
            fi
            IMAGE="${{ secrets.DOCKERHUB_USERNAME }}/grfics-${SERVICE}"
            echo "🚀 Building ${IMAGE}:${DOCKER_TAG} (amd64)"
            docker buildx build \
              --platform linux/amd64 \
              --tag "${IMAGE}:amd64" \
              --push \
              --cache-from type=gha \
              --cache-to type=gha,mode=max \
              "./${SERVICE}"
            echo "🧹 Cleaning local build cache to free space..."
            docker builder prune -af || true
            docker system prune -af || true
          done

  # ================================================================
  # Build ARM64 images
  # ================================================================
  build-arm64:
    needs: detect-changes
    if: needs.detect-changes.outputs.services != '[]'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true
      - uses: docker/setup-qemu-action@v3   # enables ARM emulation
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push arm64 images
        run: |
          SERVICES=$(echo '${{ needs.detect-changes.outputs.services }}' | jq -r '.[]')
          set -euo pipefail
          for SERVICE in $SERVICES; do
            if [ ! -d "./${SERVICE}" ]; then
              echo "⚠️ Skipping ${SERVICE}: directory does not exist"
              continue
            fi
            IMAGE="${{ secrets.DOCKERHUB_USERNAME }}/grfics-${SERVICE}"
            echo "🚀 Building ${IMAGE}:${DOCKER_TAG} (arm64)"
            docker buildx build \
              --platform linux/arm64 \
              --tag "${IMAGE}:arm64" \
              --push \
              --cache-from type=gha \
              --cache-to type=gha,mode=max \
              "./${SERVICE}"
            echo "🧹 Cleaning local build cache to free space..."
            docker builder prune -af || true
            docker system prune -af || true
          done

  # ================================================================
  # Combine manifests once both architectures exist
  # ================================================================
  create-manifests:
    runs-on: ubuntu-latest
    needs: [ detect-changes, build-amd64, build-arm64 ]
    if: needs.detect-changes.outputs.services != '[]'
    steps:
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Create and push multi-arch manifests
        run: |
          set -euo pipefail
          SERVICES=$(echo '${{ needs.detect-changes.outputs.services }}' | jq -r '.[]')
          for SERVICE in $SERVICES; do
            IMAGE="${{ secrets.DOCKERHUB_USERNAME }}/grfics-${SERVICE}:${DOCKER_TAG}"
            echo "🔗 Creating multi-arch manifest for ${IMAGE}"
            docker buildx imagetools create \
              -t "${IMAGE}" \
              "${IMAGE%:*}:amd64" \
              "${IMAGE%:*}:arm64"
            echo "✅ Multi-arch manifest published for ${IMAGE}"
          done