docker.yml

# Copyright the version-bump contributors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Docker

on:
  push:
    branches:
      - 'main'
      - 'feature/**'
    tags:
      - 'v*.*.*'
  schedule:
    - cron: '0 06 * * *'

permissions:
  contents: read

jobs:

  docker:
    name: Docker
    runs-on: ubuntu-latest
    permissions:
      # id-token is used by cosign's OIDC based signing
      # https://blog.chainguard.dev/zero-friction-keyless-signing-with-github-actions/
      id-token: 'write'

    strategy:
      matrix:
        type: ["scratch", "alpine"]

    env:
      DOCKERHUB_USERNAME: "sudobmitch"
      GHCR_USERNAME: "sudo-bmitch"

    steps:
    - name: Prepare
      id: prep
      run: |
        EXT=""
        if [ "${{ matrix.type }}" != "scratch" ]; then
          EXT="-${{ matrix.type }}"
        fi
        HUB_IMAGE=sudobmitch/version-bump
        GHCR_IMAGE=ghcr.io/sudo-bmitch/version-bump
        VERSION=noop
        if [ "${{ github.event_name }}" = "schedule" ]; then
          VERSION=edge
        elif [[ $GITHUB_REF == refs/tags/* ]]; then
          VERSION="${GITHUB_REF#refs/tags/}"
        elif [[ $GITHUB_REF == refs/heads/* ]]; then
          VERSION="${GITHUB_REF#refs/heads/}"
          if [ "${{ github.event.repository.default_branch }}" = "$VERSION" ]; then
            VERSION=edge
          fi
        elif [[ $GITHUB_REF == refs/pull/* ]]; then
          VERSION="pr-${{ github.event.number }}"
        fi
        VERSION="$(echo "${VERSION}" | sed -r 's#/+#-#g')"
        TAGS="${HUB_IMAGE}:${VERSION}${EXT},${GHCR_IMAGE}:${VERSION}${EXT}"
        if [[ $VERSION =~ ^v[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
          MINOR="${VERSION%.*}"
          MAJOR="${MINOR%.*}"
          TAGS="${TAGS},${HUB_IMAGE}:${MINOR}${EXT},${HUB_IMAGE}:${MAJOR}${EXT}"
          TAGS="${TAGS},${GHCR_IMAGE}:${MINOR}${EXT},${GHCR_IMAGE}:${MAJOR}${EXT}"
          if [ "${{ matrix.type }}" == "scratch" ]; then
            TAGS="${TAGS},${HUB_IMAGE}:latest"
            TAGS="${TAGS},${GHCR_IMAGE}:latest"
          else
            TAGS="${TAGS},${HUB_IMAGE}:${{ matrix.type }}"
            TAGS="${TAGS},${GHCR_IMAGE}:${{ matrix.type }}"
          fi
        fi
        echo "version=${VERSION}" >>$GITHUB_OUTPUT
        echo "image_hub=${HUB_IMAGE}" >>$GITHUB_OUTPUT
        echo "image_ghcr=${GHCR_IMAGE}" >>$GITHUB_OUTPUT
        echo "tags=${TAGS}" >>$GITHUB_OUTPUT
        echo "created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >>$GITHUB_OUTPUT

    - name: Check out code
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

    - name: Install cosign
      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
     
    - name: Login to DockerHub
      if: github.repository_owner == 'sudo-bmitch'
      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
      with:
        username: ${{ env.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Login to GHCR
      if: github.repository_owner == 'sudo-bmitch'
      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
      with:
        registry: ghcr.io
        username: ${{ env.GHCR_USERNAME }}
        password: ${{ secrets.GHCR_TOKEN }}

    - name: Build and push
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      id: build
      with:
        context: .
        file: ./Dockerfile.buildkit
        platforms: linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
        push: ${{ github.event_name != 'pull_request' && github.repository_owner == 'sudo-bmitch' }}
        target: release-${{ matrix.type }}
        tags: ${{ steps.prep.outputs.tags }}
        labels: |
          org.opencontainers.image.created=${{ steps.prep.outputs.created }}
          org.opencontainers.image.source=${{ github.repositoryUrl }}
          org.opencontainers.image.version=${{ steps.prep.outputs.version }}
          org.opencontainers.image.revision=${{ github.sha }}