docker.yml

name: Build and push Docker image

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]

env:
  IMAGE: ghcr.io/${{ github.repository }}

jobs:
  # ── Build each platform on its native runner in parallel ─────────────────
  build:
    name: Build (${{ matrix.platform }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm

    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-buildx-action@v4

      - uses: docker/login-action@v4
        if: github.event_name != 'pull_request'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/metadata-action@v6
        id: meta
        with:
          images: ${{ env.IMAGE }}

      # PR: build only to validate compilation — no push
      - name: Build (PR validation)
        if: github.event_name == 'pull_request'
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.platform }}
          push: false

      # Push: build and push by raw digest (no tag yet — tagged in merge job)
      - name: Build and push by digest
        if: github.event_name != 'pull_request'
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        if: github.event_name != 'pull_request'
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest artifact
        if: github.event_name != 'pull_request'
        uses: actions/upload-artifact@v7
        with:
          name: digest-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  # ── Merge digests into a single manifest list, then attest ───────────────
  merge:
    name: Merge, attest SBOM and provenance
    needs: build
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      id-token: write     # required for OIDC signing
      attestations: write # required to push attestations to registry

    steps:
      - uses: actions/checkout@v6  # needed for source-based SBOM scan

      - uses: actions/download-artifact@v8
        with:
          path: /tmp/digests
          pattern: digest-*
          merge-multiple: true

      - uses: docker/setup-buildx-action@v4

      - uses: imjasonh/setup-crane@v0.5

      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/metadata-action@v6
        id: meta
        with:
          images: ${{ env.IMAGE }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha

      - name: Create and push manifest list
        id: manifest
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.IMAGE }}@sha256:%s ' *)

          primary_tag=$(jq -r '.tags[0]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
          echo "digest=$(crane digest "${primary_tag}")" >> "$GITHUB_OUTPUT"

      - name: Generate SBOM
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
          syft . -o spdx-json=sbom.spdx.json

      - name: Attest SBOM
        uses: actions/attest@v4
        with:
          subject-name: ${{ env.IMAGE }}
          subject-digest: ${{ steps.manifest.outputs.digest }}
          predicate-type: https://spdx.dev/Document
          predicate-path: sbom.spdx.json

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ${{ env.IMAGE }}
          subject-digest: ${{ steps.manifest.outputs.digest }}

      - name: Summary
        run: |
          echo "## Docker image published" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| | |" >> "$GITHUB_STEP_SUMMARY"
          echo "|---|---|" >> "$GITHUB_STEP_SUMMARY"
          echo "| **Repository** | \`${{ env.IMAGE }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "| **Digest** | \`${{ steps.manifest.outputs.digest }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "**Tags**" >> "$GITHUB_STEP_SUMMARY"
          while IFS= read -r tag; do
            echo "- \`${tag}\`" >> "$GITHUB_STEP_SUMMARY"
          done <<< "${{ steps.meta.outputs.tags }}"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo '```bash' >> "$GITHUB_STEP_SUMMARY"
          echo "docker pull ${{ env.IMAGE }}:${{ steps.meta.outputs.version }}" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"