docker.yml

name: build

on:
  push:
    branches:
    tags:
    paths-ignore:
      - 'README.md'
      - 'LICENSE'
      - 'dk.sh'
      - 'Makefile'
      - '.github/dependabot.yml'
      - '.github/FUNDING.yml'
  pull_request:
    paths-ignore:
      - 'README.md'
      - 'LICENSE'
      - 'dk.sh'
      - 'Makefile'
      - '.github/dependabot.yml'
      - '.github/FUNDING.yml'

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        image:
          - name: app
            context: base.alpine
            dockerfile: base.alpine/Dockerfile
          - name: buildgo
            context: build.go
            dockerfile: build.go/Dockerfile
          - name: scratch
            context: base.scratch
            dockerfile: base.scratch/Dockerfile
        platform:
          - os: linux/amd64
            runner: ubuntu-latest
            artifact: amd64
          - os: linux/arm64
            runner: ubuntu-24.04-arm
            artifact: arm64
    permissions:
      contents: read
      packages: write
    runs-on: ${{ matrix.platform.runner }}
    steps:
      - name: checkout
        uses: actions/checkout@v6

      - name: set up docker buildx
        uses: docker/setup-buildx-action@v3

      - name: build only (PR validation)
        if: github.event_name == 'pull_request'
        uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.image.context }}
          file: ${{ matrix.image.dockerfile }}
          platforms: ${{ matrix.platform.os }}
          push: false

      - name: login to ghcr.io
        if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/'))
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUBPKG }}

      - name: login to dockerhub
        if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/'))
        uses: docker/login-action@v3
        with:
          username: ${{ github.actor }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: build and push to ghcr.io
        if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/'))
        id: build-ghcr
        uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.image.context }}
          file: ${{ matrix.image.dockerfile }}
          platforms: ${{ matrix.platform.os }}
          outputs: type=image,name=ghcr.io/${{ github.actor }}/baseimage/${{ matrix.image.name }},push-by-digest=true,name-canonical=true,push=true

      - name: build and push to dockerhub
        if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/'))
        id: build-dockerhub
        uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.image.context }}
          file: ${{ matrix.image.dockerfile }}
          platforms: ${{ matrix.platform.os }}
          outputs: type=image,name=docker.io/${{ github.actor }}/baseimage,push-by-digest=true,name-canonical=true,push=true

      - name: export digests
        if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/'))
        run: |
          mkdir -p /tmp/digests/${{ matrix.image.name }}/ghcr /tmp/digests/${{ matrix.image.name }}/dockerhub
          digest_ghcr="${{ steps.build-ghcr.outputs.digest }}"
          digest_dockerhub="${{ steps.build-dockerhub.outputs.digest }}"
          touch "/tmp/digests/${{ matrix.image.name }}/ghcr/${digest_ghcr#sha256:}"
          touch "/tmp/digests/${{ matrix.image.name }}/dockerhub/${digest_dockerhub#sha256:}"

      - name: upload ghcr digest
        if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/'))
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ matrix.image.name }}-ghcr-${{ matrix.platform.artifact }}
          path: /tmp/digests/${{ matrix.image.name }}/ghcr/*
          retention-days: 1

      - name: upload dockerhub digest
        if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/'))
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ matrix.image.name }}-dockerhub-${{ matrix.platform.artifact }}
          path: /tmp/digests/${{ matrix.image.name }}/dockerhub/*
          retention-days: 1

  merge:
    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/'))
    runs-on: ubuntu-latest
    needs: build
    strategy:
      matrix:
        image: [app, buildgo, scratch]
    steps:
      - name: download ghcr digests
        uses: actions/download-artifact@v8
        with:
          path: /tmp/digests/ghcr
          pattern: digests-${{ matrix.image }}-ghcr-*
          merge-multiple: true

      - name: download dockerhub digests
        uses: actions/download-artifact@v8
        with:
          path: /tmp/digests/dockerhub
          pattern: digests-${{ matrix.image }}-dockerhub-*
          merge-multiple: true

      - name: verify all digests present
        run: |
          for registry in ghcr dockerhub; do
            expected=2
            actual=$(find /tmp/digests/$registry -maxdepth 1 -type f | wc -l)
            if [ "$actual" -ne "$expected" ]; then
              echo "Expected $expected digests for $registry, found $actual"
              ls -la /tmp/digests/$registry
              exit 1
            fi
          done
          echo "All digests present"

      - name: set up docker buildx
        uses: docker/setup-buildx-action@v3

      - name: login to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUBPKG }}

      - name: login to dockerhub
        uses: docker/login-action@v3
        with:
          username: ${{ github.actor }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: set docker tags
        id: tags
        run: |
          ref="${GITHUB_REF##*/}"
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            echo "ghcr_tags=-t ghcr.io/${{ github.actor }}/baseimage/${{ matrix.image }}:${ref} -t ghcr.io/${{ github.actor }}/baseimage/${{ matrix.image }}:latest" >> $GITHUB_OUTPUT
            echo "dockerhub_tags=-t ${{ github.actor }}/baseimage:${{ matrix.image }}-${ref} -t ${{ github.actor }}/baseimage:${{ matrix.image }}-latest" >> $GITHUB_OUTPUT
          else
            echo "ghcr_tags=-t ghcr.io/${{ github.actor }}/baseimage/${{ matrix.image }}:${ref}" >> $GITHUB_OUTPUT
            echo "dockerhub_tags=-t ${{ github.actor }}/baseimage:${{ matrix.image }}-${ref}" >> $GITHUB_OUTPUT
          fi

      - name: create ghcr manifest and push
        working-directory: /tmp/digests/ghcr
        run: |
          docker buildx imagetools create ${{ steps.tags.outputs.ghcr_tags }} \
            $(printf 'ghcr.io/${{ github.actor }}/baseimage/${{ matrix.image }}@sha256:%s ' *)

      - name: create dockerhub manifest and push
        working-directory: /tmp/digests/dockerhub
        run: |
          docker buildx imagetools create ${{ steps.tags.outputs.dockerhub_tags }} \
            $(printf 'docker.io/${{ github.actor }}/baseimage@sha256:%s ' *)