build_dockers_workflow.yml

---
name: Build docker images - workflow_call/on-demand

'on':
  workflow_call:
    secrets:
      DOCKER_PROVIDER:
        required: true
      DOCKER_USERNAME:
        required: true
      DOCKER_PASSWORD:
        required: true
    inputs:
      toolchain:
        type: string
        description: 'Rust toolchain'
        default: stable
      features:
        type: string
        default: 'safe,libtor,metrics'
      version:
        type: string
        description: 'build minotari tag/version'
      tag_alias:
        type: string
        description: 'build minotari tag alias'
      tari_network:
        type: string
        description: 'target testNet'
      build_items:
        type: string
        default: minotari_sha3_miner
        description: 'build images'
      platforms:
        type: string
        # linux/arm64,linux/amd64
        default: linux/amd64
        description: 'docker target build platform(s)'

env:
  DAYS_to_EXPIRE: 30

permissions:
  contents: read

jobs:
  builds_envs_setup:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}

    steps:
      - name: checkout tari
        uses: actions/checkout@v6

      - name: Set Matrix
        id: set-matrix
        shell: bash
        run: |
          # set -xuo pipefail
          build_items=${{ inputs.build_items }}
          if [ -z "${{ inputs.version }}" ] ; then
            echo "Get tari version"
            TARI_SOURCE_ROOT="./"
            VAPP=$(awk -F ' = ' '$1 ~ /^version/ \
              { gsub(/["]/, "", $2); printf("%s",$2) }' \
              "${TARI_SOURCE_ROOT}/Cargo.toml")
            VBRANCH=$(git --git-dir ${TARI_SOURCE_ROOT}/.git branch --show-current)
            VSHA_SHORT=$(git --git-dir ${TARI_SOURCE_ROOT}/.git rev-parse --short HEAD)
            VERSION="v${VAPP}_${VBRANCH}_$(date -u '+%Y%m%d')_${VSHA_SHORT}"
          else
            VERSION=${{ inputs.version }}
          fi

          cd buildtools/docker_rig
          source ./build-matrix.sh "${{ inputs.build_items }}" "${VERSION}" "${{ inputs.platforms }}" "${{ inputs.tari_network }}"

          echo "${matrix}"
          echo "${matrix}" | jq .
          echo "matrix=${matrix}" >> $GITHUB_OUTPUT

  docker_builds:
    name: Docker ${{ matrix.builds.arch }} ${{ matrix.builds.image_name }} build
    needs: builds_envs_setup

    continue-on-error: true

    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.builds_envs_setup.outputs.matrix) }}

    permissions:
      contents: read
      packages: write

    runs-on: ${{ matrix.builds.runner }}

    steps:
      - name: checkout tari
        uses: actions/checkout@v6

      - name: Setup expiration for none releases
        shell: bash
        run: |
          if [[ "${{ github.ref }}" =~ ^refs\/tags\/v[0-9]+\.[0-9]+\.[0-9]+.*$ ]]; then
            echo "No Expire for release"
          else
            echo "Expires in ${{ env.DAYS_to_EXPIRE }} days"
            echo "EXPIRATION=${{ env.DAYS_to_EXPIRE }}d" >> $GITHUB_ENV
          fi

      - name: environment setup
        shell: bash
        run: |
          IMAGE_NAME=${{ matrix.builds.image_name }}
          if [ "${IMAGE_NAME:0:9}" = "minotari_" ] ; then
            echo "Minotari builds"
            echo "APP_NAME=${{ matrix.builds.app_name }}" >> $GITHUB_ENV
            echo "APP_EXEC=${{ matrix.builds.app_exec }}" >> $GITHUB_ENV

            if [ ! -z "${{ inputs.tag_alias }}" ] ; then
              echo "Setup tag_alias with network"
              echo "TAG_ALIASQ=${{ secrets.DOCKER_PROVIDER }}/${{ secrets.DOCKER_REPO }}/${{ matrix.builds.image_name }}:${{ inputs.tag_alias }}-${{ matrix.builds.tari_network }}-${{ matrix.builds.arch }}" >> $GITHUB_ENV
              echo "TAG_ALIASG=ghcr.io/${{ github.repository_owner }}/${{ matrix.builds.image_name }}:${{ inputs.tag_alias }}-${{ matrix.builds.tari_network }}-${{ matrix.builds.arch }}" >> $GITHUB_ENV
            fi
            echo "DSuffix=-${{ matrix.builds.tari_network }}-${{ matrix.builds.arch }}" >> $GITHUB_ENV
          else
            echo "3rd Party builds - ${IMAGE_NAME}"
            echo "DOCKER_SUBTAG=${{ matrix.builds.build_args }}" >> $GITHUB_ENV
            echo "DSuffix=-${{ matrix.builds.arch }}" >> $GITHUB_ENV
          fi
          # What about riscv?
          if [[ "${{ matrix.builds.arch }}" == "amd64" ]]; then
            echo "cargo_arch=x86-64" >> $GITHUB_ENV
          else
            echo "cargo_arch=aarch64" >> $GITHUB_ENV
          fi

      - name: Set up QEMU for Docker
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            # name/${{ matrix.builds.image_name }}
            ghcr.io/${{ github.repository_owner }}/${{ matrix.builds.image_name }}
            ${{ secrets.DOCKER_PROVIDER }}/${{ secrets.DOCKER_REPO }}/${{ matrix.builds.image_name }}
          tags: |
            type=schedule
            type=ref,event=tag
            type=ref,event=branch,enable=${{ startsWith(matrix.builds.image_name, 'minotari_') }}
            type=ref,event=pr,enable=${{ startsWith(matrix.builds.image_name, 'minotari_') }}
            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
            type=sha
          labels: |
            maintainer=${{ github.actor }}
            quay.expires-after=${{ env.EXPIRATION }}
            org.opencontainers.image.vendor=TariLabs
            org.opencontainers.image.title=${{ matrix.builds.image_name }}
            org.opencontainers.image.description=Tari docker image ${{ matrix.builds.image_name }} for ${{ matrix.builds.arch }}
            org.opencontainers.image.url=https://github.com/${{ github.repository }}
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.version=${{ matrix.builds.version }}
          flavor: |
            # latest=${{ startsWith(github.ref, 'refs/tags/v') }}
            latest=false
            suffix=${{ env.DSuffix }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Image Provider
        uses: docker/login-action@v3
        with:
          registry: ${{ secrets.DOCKER_PROVIDER }}
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Docker image build and push
        id: docker_build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./buildtools/docker_rig/${{ matrix.builds.dockerfile }}
          platforms: ${{ matrix.builds.platform }}
          push: true
          provenance: false
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ matrix.builds.version }}
            ARCH=${{ env.cargo_arch }}
            FEATURES=${{ inputs.features }}
            APP_NAME=${{ matrix.builds.app_name }}
            APP_EXEC=${{ matrix.builds.app_exec }}
            TARI_NETWORK=${{ matrix.builds.tari_network }}
            TARI_TARGET_NETWORK=${{ matrix.builds.tari_target_network }}
            ${{ env.DOCKER_SUBTAG }}
          tags: |
            ${{ secrets.DOCKER_PROVIDER }}/${{ secrets.DOCKER_REPO }}/${{ matrix.builds.image_name }}:${{ matrix.builds.version }}${{ env.DSuffix }}
            ghcr.io/${{ github.repository_owner }}/${{ matrix.builds.image_name }}:${{ matrix.builds.version }}${{ env.DSuffix }}
            ${{ steps.meta.outputs.tags }}
            ${{ env.TAG_ALIASQ }}
            ${{ env.TAG_ALIASG }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}

      - name: Image digest
        run: |
          echo "Docker Digest - ${{ steps.docker_build.outputs.digest }}"
          echo "Docker Image - ${{ matrix.builds.image_name }}:${{ matrix.builds.version }}${{ env.DSuffix }}"

  multi-arch-create-manifest:
    needs: [ builds_envs_setup, docker_builds ]
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write

    steps:
      - name: Log in to Registries
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login ${{ secrets.DOCKER_PROVIDER }} -u ${{ secrets.DOCKER_USERNAME }} --password-stdin

      - name: Pre for multi-arch image merge
        env:
          BMATRIX: ${{ needs.builds_envs_setup.outputs.matrix }}
        run: |
          set -xuo pipefail
          echo '${{ env.BMATRIX }}' | jq -r

          # Get all multi-arch image_names (have both amd64 and arm64), with version
          mapfile -t multiarch_images < <(
            echo '${{ env.BMATRIX }}' | jq -r '
              .builds
                | group_by([.image_name, .tari_network])
                | map(select((map(.arch) | index("amd64")) and (map(.arch) | index("arm64"))))
                | map({image_name: .[0].image_name, version: .[0].version, tari_network: .[0].tari_network})
                | unique
                | map("\(.image_name):\(.version):\(.tari_network)")
                | .[]
              '
            )

          if [ ${#multiarch_images[@]} -eq 0 ]; then
            echo "No multi-arch Docker images found."
            mapfile -t all_images < <(
              echo '${{ env.BMATRIX }}' | jq -r '.builds[].image_name' | sort -u)
                for img in "${all_images[@]}"; do
                  if [[ ! " ${multiarch_images[*]} " =~ " ${img} " ]]; then
                    echo "Image '$img' has only one architecture built."
                  fi
                done
          else
            echo "Found ${#multiarch_images[@]} multi-arch Docker images."
            echo "${multiarch_images[*]}"
            for DENTRY in "${multiarch_images[@]}"; do
              DNAME="${DENTRY%%:*}"             # before first :
              REST="${DENTRY#*:}"               # drop first :
              DVERSION="${REST%%:*}"            # version
              DNETWORK="${REST##*:}"            # tari_network

              if [ "${DNAME:0:9}" = "minotari_" ] ; then
                DSUFFIX=-${DNETWORK}
              else
                DSUFFIX=
              fi
              echo "Multi-arch ${DNAME} processing ..."
              for DREGISTRY in ghcr.io quay.io; do
                if [[ "${DREGISTRY}" == "ghcr.io" ]]; then
                  REPO="${{ github.repository_owner }}"
                else
                  REPO="${{ secrets.DOCKER_REPO }}"
                fi

                echo "Registry run - ${DREGISTRY}"
                echo "Creating multi-arch image for ${REPO}/${DNAME} for ${DVERSION}${DSUFFIX}"
                docker manifest create \
                  ${DREGISTRY}/${REPO}/${DNAME}:${DVERSION}${DSUFFIX} \
                    --amend ${DREGISTRY}/${REPO}/${DNAME}:${DVERSION}${DSUFFIX}-amd64 \
                    --amend ${DREGISTRY}/${REPO}/${DNAME}:${DVERSION}${DSUFFIX}-arm64

                echo "Inspect multi-arch image for ${REPO}/${DNAME}"
                docker manifest inspect ${DREGISTRY}/${REPO}/${DNAME}:${DVERSION}${DSUFFIX} > manifest.json
                cat manifest.json
                echo "Pushing multi-arch image for ${REPO}/${DNAME}"
                docker manifest push ${DREGISTRY}/${REPO}/${DNAME}:${DVERSION}${DSUFFIX} || true

                if [[ "${{ inputs.tag_alias }}" =~ ^latest-.*$ ]]; then
                  echo "Latest Alias Multi-Arch tag - ${{ inputs.tag_alias }}"
                  docker manifest create \
                    ${DREGISTRY}/${REPO}/${DNAME}:${{ inputs.tag_alias }}${DSUFFIX} \
                      --amend ${DREGISTRY}/${REPO}/${DNAME}:${DVERSION}${DSUFFIX}-amd64 \
                      --amend ${DREGISTRY}/${REPO}/${DNAME}:${DVERSION}${DSUFFIX}-arm64
                  docker manifest push ${DREGISTRY}/${REPO}/${DNAME}:${{ inputs.tag_alias }}${DSUFFIX} || true
                fi

                if [[ "${GITHUB_REF}" =~ ^refs\/tags\/v[0-9]+\.[0-9]+\.[0-9]+.*$ ]]; then
                  echo "Release Multi-Arch Tag - ${GITHUB_REF_NAME} for ${GITHUB_REF}"
                  docker manifest create \
                    ${DREGISTRY}/${REPO}/${DNAME}:${GITHUB_REF_NAME} \
                      --amend ${DREGISTRY}/${REPO}/${DNAME}:${DVERSION}${DSUFFIX}-amd64 \
                      --amend ${DREGISTRY}/${REPO}/${DNAME}:${DVERSION}${DSUFFIX}-arm64
                  docker manifest push ${DREGISTRY}/${REPO}/${DNAME}:${GITHUB_REF_NAME} || true
                fi

                if [[ "$GITHUB_REF_TYPE" == "tag" && "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+.*$ ]]; then
                  echo "Latest Release Multi-Arch tag - $GITHUB_REF_NAME for $GITHUB_REF using ${DVERSION}${DSUFFIX}"
                  docker manifest create \
                    ${DREGISTRY}/${REPO}/${DNAME}:latest${DSUFFIX} \
                      --amend ${DREGISTRY}/${REPO}/${DNAME}:${DVERSION}${DSUFFIX}-amd64 \
                      --amend ${DREGISTRY}/${REPO}/${DNAME}:${DVERSION}${DSUFFIX}-arm64
                  #docker manifest annotate ${DREGISTRY}/${REPO}/${DNAME}:latest${DSUFFIX} --file manifest.json
                  docker manifest push ${DREGISTRY}/${REPO}/${DNAME}:latest${DSUFFIX} || true
                fi
              done
            done
          fi