docker-build-and-publish.yml

name: Build and publish image

on:
  workflow_call:
    inputs:
      base_image:
        description: "The image to be used as a base for system containers"
        type: string
        required: false
      base_app_image:
        description: "The image to be used as a base for app containers"
        type: string
        required: false
      image_name:
        description: "The name of the image to build and publish"
        type: string
        required: true
      docker_path:
        description: "The path to the Dockerfile"
        type: string
        required: true
      platforms:
        description: "Which platforms should this image be built for?"
        default: "linux/amd64"
        type: string
        required: false
    outputs:
      image_tag:
        description: "The highest-priority tag assigned to the built image"
        value: ${{ jobs.docker.outputs.image_tag }}

env:
  DOCKERHUB_NAMESPACE: 'gameonwhales'
  DOCKERHUB_USERNAME: 'abeltramo'
  ARM64_RUNNER: ''
  PLATFORM_PAIR: ''

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      platforms: ${{ steps.set-platforms.outputs.platforms }}
      is_fork: ${{ steps.set-docker-vars.outputs.is_fork }}
      ghcr_namespace: ${{ steps.set-docker-vars.outputs.ghcr_namespace }}
      dockerhub_namespace: ${{ steps.set-docker-vars.outputs.dockerhub_namespace }}
      arm64_runner: ${{ steps.set-docker-vars.outputs.arm64_runner }}
    steps:
      - id: set-platforms
        run: |
          platforms=$(echo "${{ inputs.platforms }}" | tr ',' '\n' | jq -R -s -c 'split("\n")[:-1]')
          echo "platforms=${platforms}" >> $GITHUB_OUTPUT
          echo "==> Platforms set to: ${platforms}"

      - id: set-docker-vars
        run: |
          if [[ "${{ github.repository }}" == "games-on-whales/gow" ]]; then
            IS_FORK=false
            GHCR_NAMESPACE="${{ github.repository_owner }}"
            DOCKERHUB_NAMESPACE="${{ env.DOCKERHUB_NAMESPACE }}"
            ARM64_RUNNER=${{ env.ARM64_RUNNER != '' && env.ARM64_RUNNER || 'ARM64' }}
          else
            # Forks shall push to <username>/gow/<image-name>
            IS_FORK=true
            if [[ "${{ github.event_name }}" == "pull_request" ]]; then
              # For PRs, we use the forked repository owner as namespace
              # This allows us to pull build caches from the forked repository
              owner=$(echo ${{ github.event.pull_request.head.repo.owner.login }} | tr '[:upper:]' '[:lower:]')
              GHCR_NAMESPACE="${owner}/gow"
            else
              # For branches, we use the repository owner as namespace
              owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')
              GHCR_NAMESPACE="${owner}/gow"
            fi
            DOCKERHUB_NAMESPACE="${{ env.DOCKERHUB_NAMESPACE }}"
            ARM64_RUNNER=${{ env.ARM64_RUNNER != '' && env.ARM64_RUNNER || 'ubuntu-latest' }}
          fi

          echo "is_fork=${IS_FORK}" >> $GITHUB_OUTPUT
          echo "ghcr_namespace=${GHCR_NAMESPACE}" >> $GITHUB_OUTPUT
          echo "dockerhub_namespace=${DOCKERHUB_NAMESPACE}" >> $GITHUB_OUTPUT
          echo "arm64_runner=${ARM64_RUNNER}" >> $GITHUB_OUTPUT

          echo "==> Docker variables set:"
          echo "is_fork=${IS_FORK}"
          echo "ghcr_namespace=${GHCR_NAMESPACE}"
          echo "dockerhub_namespace=${DOCKERHUB_NAMESPACE}"
          echo "arm64_runner=${ARM64_RUNNER}"

  docker:
    needs: prepare
    runs-on: ${{ contains(matrix.platform, 'arm64') && needs.prepare.outputs.arm64_runner || 'ubuntu-latest' }}
    services:
      registry:
        image: registry:2
        ports:
          - 5000:5000

    strategy:
      matrix:
        platform: ${{ fromJson(needs.prepare.outputs.platforms) }}

    outputs:
      image_tag: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
      images: ${{ steps.prep.outputs.images }}
      has_docker_token: ${{ steps.prep.outputs.has_docker_token }}
      has_github_token: ${{ steps.prep.outputs.has_github_token }}

    steps:
      - name: Validate inputs
        shell: bash
        # Currently GitHub does _not_ validate that required inputs are actually given :-(
        # see: https://github.com/actions/runner/issues/1070
        run: |
          # image name is always required
          [[ "${{ inputs.image_name }}" ]] || {
            echo "image_name input is empty but required"
            exit 1
          }

          # base image name is required unless building the base image itself
          [[ "${{ inputs.image_name }}" = "base" ]] ||
           [[ "${{ inputs.base_image }}" ]] || {
            echo "base_image input is empty but required"
            exit 1
           }

          # base_app_image is required unless building base or base-app
          [[ "${{ inputs.image_name }}" = "base" ]] ||
           [[ "${{ inputs.image_name }}" = "base-app" ]] ||
           [[ "${{ inputs.base_image }}" ]] || {
            echo "base_app_image input is empty but required"
            exit 1
           }

          echo "==> Inputs validated successfully, exporting PLATFORM_PAIR"
          platform="${{ matrix.platform }}"
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - name: Checkout
        uses: actions/checkout@v4

      - name: Cache buildx layers locally
        if: github.event_name == 'pull_request'
        uses: actions/cache@v4
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ inputs.image_name }}-${{ env.PLATFORM_PAIR }}-pr-${{ github.event.number }}
          restore-keys: |
            ${{ runner.os }}-buildx-${{ inputs.image_name }}-${{ env.PLATFORM_PAIR }}-

      # Set derived configuration variables:
      # - images: images to build (docker and/or github)
      # - has_docker_token
      # - has_github_token
      # - cache_from: image tag to use for imported cache
      # - cache_to: image tag to use for exported cache
      # - github_server_url: reference to source code repository
      # - base_image_name: name of the base image to be used for up and downloading artifacts
      # - base_app_image_name: name of the base app image to be used for up and downloading artifacts
      # - buildx_output: will be used to determine how to export the built image (e.g. to a tarball for PRs or to a registry for branches)
      - name: Prepare
        id: prep
        run: |
          IMAGES=""
          CURRENT_PLATFORM="${{ contains(matrix.platform, 'arm64') && 'arm64' || 'x86' }}"

          upstream_build_from_cache_image="ghcr.io/games-on-whales/${{ inputs.image_name }}:buildcache-${CURRENT_PLATFORM}"
          build_from_cache_image="ghcr.io/${{ needs.prepare.outputs.ghcr_namespace }}/${{ inputs.image_name }}:buildcache-${CURRENT_PLATFORM}"
          build_to_cache_image="ghcr.io/${{ needs.prepare.outputs.ghcr_namespace }}/${{ inputs.image_name }}:buildcache-${CURRENT_PLATFORM}"

          echo "==> Testing if build cache ${build_from_cache_image} exists"
          docker buildx imagetools inspect "${build_from_cache_image}" 2>/dev/null || build_cache_missing=1
          if [ -n "${build_cache_missing:-}" ]; then
            echo "==> No existing buildx cache for branch build found, using upstream buildcache image ${upstream_build_from_cache_image}"
            build_from_cache_image="${upstream_build_from_cache_image}"
          else
            echo "==> Found existing buildx cache for branch build, using image ${build_from_cache_image}"
          fi

          if [[ "${{ github.event_name }}" != "pull_request" ]]; then
            echo "==> Setting variables for branch build"

            if [ -n "${{ secrets.GITHUB_TOKEN }}" ]; then
              REGISTRY_IMAGE="ghcr.io/${{ needs.prepare.outputs.ghcr_namespace }}/${{ inputs.image_name }}"
              if [ "$IMAGES" = "" ]; then
                IMAGES="${REGISTRY_IMAGE}"
              else
                IMAGES="$IMAGES,${REGISTRY_IMAGE}"
              fi

              echo "has_github_token=true" >> $GITHUB_OUTPUT
              echo "cache_from=type=registry,ref=${build_from_cache_image}"  >> $GITHUB_OUTPUT
              echo "cache_to=type=registry,ref=${build_to_cache_image},mode=max"  >> $GITHUB_OUTPUT
              echo "==> Pushing to GitHub Container Registry"
            fi
          
            # Order here matters, outputting this after `ghcr.io` means that later one we'll build images on top of
            # the Github registry. This is useful because Docker Hub has introduced a lot of rate limits
            if [ -n "${{ secrets.DOCKERHUB_TOKEN }}" ]; then
              REGISTRY_IMAGE="docker.io/${{ needs.prepare.outputs.dockerhub_namespace }}/${{ inputs.image_name }}"
              if [ "$IMAGES" = "" ]; then
                IMAGES="${REGISTRY_IMAGE}"
              else
                IMAGES="$IMAGES,${REGISTRY_IMAGE}"
              fi
              echo "has_docker_token=true" >> $GITHUB_OUTPUT
              echo "==> Pushing to Docker Hub"
            fi

            BUILDX_OUTPUT="type=registry"
          else
            echo "==> Setting variables for pull request build"
            # we only use local tags for PR builds
            IMAGES="localhost:5000/${{ inputs.image_name }}"

            # For pull requests, we save the image in a tarball
            BUILDX_OUTPUT="type=docker,dest=/tmp/${{ inputs.image_name }}-${PLATFORM_PAIR}.tar"

            if [ -d /tmp/.buildx-cache ]; then
              echo "==> Using existing local buildx cache for pr-${{ github.event.number }}"
              echo "cache_from=type=local,src=/tmp/.buildx-cache"  >> $GITHUB_OUTPUT
            else
              echo "==> No existing buildx cache for pr-${{ github.event.number }} found, using buildcache image ${build_from_cache_image}"
              echo "cache_from=type=registry,ref=${build_from_cache_image}"  >> $GITHUB_OUTPUT
            fi
            echo "cache_to=type=local,dest=/tmp/.buildx-cache-new"  >> $GITHUB_OUTPUT

            if [[ "${{ inputs.base_image != '' }}" == "true" ]]; then
              # get image name for up and downloading pr artifacts
              base_image_name=$(echo "${{ inputs.base_image }}" | sed 's|.*/||; s|:.*||')
              echo "base_image_name=${base_image_name}" >> $GITHUB_OUTPUT
            fi

            if [[ "${{ inputs.base_app_image != '' }}" == "true" ]]; then
              # get image name for up and downloading pr artifacts
              base_app_image_name=$(echo "${{ inputs.base_app_image }}" | sed 's|.*/||; s|:.*||')
              echo "base_app_image_name=${base_app_image_name}" >> $GITHUB_OUTPUT
            fi
          fi

          echo "images=${IMAGES}"  >> $GITHUB_OUTPUT
          echo "buildx_outputs=${BUILDX_OUTPUT}" >> $GITHUB_OUTPUT
          echo "github_server_url=${GITHUB_SERVER_URL}"  >> $GITHUB_OUTPUT

          echo "==> Images to build: ${IMAGES}"
          echo "==> Buildx outputs: ${BUILDX_OUTPUT}"
          echo "==> GitHub server URL: ${GITHUB_SERVER_URL}"

      - name: Download base image artifact
        id: download-base-image-artifact
        if: ${{ github.event_name == 'pull_request' && steps.prep.outputs.base_image_name != '' }}
        uses: dawidd6/action-download-artifact@v10
        with:
          name: docker-${{ steps.prep.outputs.base_image_name }}-${{ env.PLATFORM_PAIR }}.tar
          workflow_search: true
          search_artifacts: true
          allow_forks: true
          workflow_conclusion: ""
          commit: ${{ github.event.pull_request.head.sha }}
          path: /tmp/
      
      - name: Download base-app image artifact
        id: download-base-app-image-artifact
        if: ${{ github.event_name == 'pull_request' && steps.prep.outputs.base_app_image_name != '' }}
        uses: dawidd6/action-download-artifact@v10
        with:
          name: docker-${{ steps.prep.outputs.base_app_image_name }}-${{ env.PLATFORM_PAIR }}.tar
          workflow_search: true
          search_artifacts: true
          allow_forks: true
          workflow_conclusion: ""
          commit: ${{ github.event.pull_request.head.sha }}
          path: /tmp/

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          # list of Docker images to use as base name for tags
          images: ${{ steps.prep.outputs.images }}
          # generate Docker tags based on the following events/attributes
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}
            type=edge,branch=master
            type=ref,event=branch
            type=sha
          flavor: latest=auto #latest will point to last semver version (stable)

      # Prepare for multi-arch
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: all

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
        with:
          install: true
          version: latest
          driver-opts: image=moby/buildkit:master${{ github.event_name == 'pull_request' && ',network=host' || '' }}

      - name: Login to DockerHub
        if: steps.prep.outputs.has_docker_token != ''
        uses: docker/login-action@v3
        with:
          username: ${{ env.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        if: steps.prep.outputs.has_github_token != ''
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Load base image
        if: github.event_name == 'pull_request' && steps.prep.outputs.base_image_name != ''
        run: |
          set -e
          echo "==> Loading base image from artifact"
          docker load -i "/tmp/${{ steps.prep.outputs.base_image_name }}-${{ env.PLATFORM_PAIR }}.tar"
          docker inspect "${{ inputs.base_image }}"
          echo "==> Pushing base image to local registry"
          docker push "${{ inputs.base_image }}"

      - name: Load base-app image
        if: github.event_name == 'pull_request' && steps.prep.outputs.base_app_image_name != ''
        run: |
          set -e
          echo "==> Loading base-app image from artifact"
          docker load -i "/tmp/${{ steps.prep.outputs.base_app_image_name }}-${{ env.PLATFORM_PAIR }}.tar"
          docker inspect "${{ inputs.base_app_image }}"
          echo "==> Pushing base image to local registry"
          docker push "${{ inputs.base_app_image }}"

      - name: Build and Push
        id: docker_build
        uses: docker/build-push-action@v6
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: ./${{ inputs.docker_path }}/${{ inputs.image_name }}/build
          file: ./${{ inputs.docker_path }}/${{ inputs.image_name }}/build/Dockerfile
          platforms: ${{ matrix.platform }}
          outputs: ${{ steps.prep.outputs.buildx_outputs }}
          tags: ${{ steps.meta.outputs.tags }}
          build-args: |
            IMAGE_SOURCE=${{ steps.prep.outputs.github_server_url }}/${{ github.repository }}
            BASE_IMAGE=${{ inputs.base_image }}
            BASE_APP_IMAGE=${{ inputs.base_app_image }}
          cache-from: ${{ steps.prep.outputs.cache_from }}
          cache-to: ${{ steps.prep.outputs.cache_to }}

      - name: Upload docker image as artifact
        if: github.event_name == 'pull_request'
        uses: actions/upload-artifact@v4
        with:
          name: docker-${{ inputs.image_name }}-${{ env.PLATFORM_PAIR }}.tar
          path: /tmp/${{ inputs.image_name }}-*.tar
          if-no-files-found: error
          retention-days: 1

      # Temp fix
      # https://github.com/docker/build-push-action/issues/252
      # https://github.com/moby/buildkit/issues/1896
      - name: Cleanup buildx cache
        if: github.event_name == 'pull_request'
        run: |
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache

      - name: Image digest
        run: echo "${{ inputs.image_name }} > ${{ steps.docker_build.outputs.digest }}"

      - name: Export digest
        if: github.event_name != 'pull_request'
        id: export-digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.docker_build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"
          echo "hash=${digest#sha256:}" >> $GITHUB_OUTPUT

      - name: Upload digest
        if: github.event_name != 'pull_request'
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ inputs.image_name }}-${{ env.PLATFORM_PAIR }}
          path: /tmp/digests/*
          if-no-files-found: error
          overwrite: true
          retention-days: 1

  # Based on https://docs.docker.com/build/ci/github-actions/multi-platform/
  # We have to merge the two AMD64 and ARM64 images into a single manifest list
  # Otherwise the image would be overridden by the last one pushed
  merge:
    runs-on: ubuntu-latest
    needs: [ prepare, docker ]
    if: github.event_name != 'pull_request'
    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-${{ inputs.image_name }}-*
          merge-multiple: true

      - name: Login to Docker Hub
        if: needs.docker.outputs.has_docker_token != ''
        uses: docker/login-action@v3
        with:
          username: ${{ env.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GHCR
        if: needs.docker.outputs.has_github_token != ''
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ needs.docker.outputs.images }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}
            type=edge,branch=master
            type=ref,event=branch
            type=sha

      - name: Create ghcr manifest list and push
        if: needs.docker.outputs.has_github_token != ''
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map(select(startswith("ghcr.io"))) | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
          $(printf 'ghcr.io/${{ needs.prepare.outputs.ghcr_namespace }}/${{ inputs.image_name }}@sha256:%s ' *)
      
      - name: Create Docker Hub manifest list and push
        if: needs.docker.outputs.has_docker_token != ''
        continue-on-error: true
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map(select(startswith("docker.io"))) | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
          $(printf 'docker.io/gameonwhales/${{ inputs.image_name }}@sha256:%s ' *)

      - name: Inspect ghcr image
        if: needs.docker.outputs.has_github_token != ''
        run: |
          echo "Inspecting GHCR image:"
          docker buildx imagetools inspect ghcr.io/${{ needs.prepare.outputs.ghcr_namespace }}/${{ inputs.image_name }}:${{ steps.meta.outputs.version }}

      - name: Inspect Docker Hub image
        if: needs.docker.outputs.has_docker_token != ''
        continue-on-error: true
        run: |
          echo "Inspecting Docker Hub image:"
          docker buildx imagetools inspect gameonwhales/${{ inputs.image_name }}:${{ steps.meta.outputs.version }}