images.yml

name: Container Images

on:
  workflow_dispatch:
    inputs:
      platforms:
        description: OCI platforms to build.
        required: true
        default: linux/amd64
      features:
        description: Override all image profile feature sets. Leave empty for profile defaults.
        required: false
        default: ""
      include_load_balancer:
        description: Build the load-balancer image profile for manual dispatches before the normal load-balancer image line.
        required: true
        default: false
        type: boolean
      publish_dev_wolfi:
        description: Publish the Quay-only development Wolfi image from main.
        required: true
        default: false
        type: boolean
      config:
        description: Config file copied into /etc/fluxheim/fluxheim.toml.
        required: false
        default: ""
      runtime_uid:
        description: Runtime UID inside the image. Keep 65532 unless intentionally publishing a root image.
        required: true
        default: "65532"
      runtime_gid:
        description: Runtime GID inside the image. Keep 65532 unless intentionally publishing a root image.
        required: true
        default: "65532"
  push:
    tags:
      - "v*"

permissions:
  contents: read
  packages: write

env:
  CARGO_TERM_COLOR: always

jobs:
  images:
    if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish_dev_wolfi != 'true') }}
    name: Build and publish ${{ matrix.profile.name }} ${{ matrix.variant }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        variant:
          - debian
          - alpine
          - wolfi
          - suse-micro
        profile:
          - name: full
            tag: ""
            features: profile-full,acme-client,metrics,metrics-otlp,otel-tracing,otel-otlp
            config: packaging/container/fluxheim.toml
            wolfi_config: ""
            wolfi_runtime_packages: ""
          - name: cache
            tag: cache
            features: profile-cache-edge,acme-client
            config: packaging/container/cache.toml
            wolfi_config: ""
            wolfi_runtime_packages: ""
          - name: proxy
            tag: proxy
            features: profile-proxy-edge,acme-client
            config: packaging/container/proxy.toml
            wolfi_config: ""
            wolfi_runtime_packages: ""
          - name: php
            tag: php
            features: profile-web-server,php-fpm,acme-client
            config: packaging/container/php.toml
            wolfi_config: packaging/container/php-managed.toml
            wolfi_runtime_packages: php-8.5-fpm
          - name: load-balancer
            tag: load-balancer
            features: profile-load-balancer-edge,acme-client
            config: packaging/container/load-balancer.toml
            wolfi_config: ""
            wolfi_runtime_packages: ""
    env:
      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
      QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
      QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
      QUAY_NAMESPACE: ${{ vars.QUAY_NAMESPACE || github.repository_owner }}
      QUAY_REPOSITORY: ${{ vars.QUAY_REPOSITORY || github.event.repository.name }}
      INCLUDE_LOAD_BALANCER: ${{ inputs.include_load_balancer || false }}

    steps:
      - name: Decide image profile
        id: profile
        shell: bash
        env:
          PROFILE: ${{ matrix.profile.name }}
        run: |
          set -euo pipefail
          build="true"
          if [[ "${PROFILE}" == "load-balancer" ]]; then
            if [[ "${GITHUB_EVENT_NAME}" != "push" && ! "${GITHUB_REF_NAME}" =~ ^v(1\.[5-9]|[2-9]\.) && "${INCLUDE_LOAD_BALANCER}" != "true" ]]; then
              build="false"
            fi
          fi
          echo "build=${build}" >> "${GITHUB_OUTPUT}"
          if [[ "${build}" == "false" ]]; then
            echo "Skipping ${PROFILE} image profile for manual ref before the load-balancer image line without include_load_balancer=true."
          fi

      - name: Checkout repository
        if: ${{ steps.profile.outputs.build == 'true' }}
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up QEMU
        if: ${{ steps.profile.outputs.build == 'true' }}
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Set up Buildx
        if: ${{ steps.profile.outputs.build == 'true' }}
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to GitHub Container Registry
        if: ${{ steps.profile.outputs.build == 'true' }}
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        if: ${{ steps.profile.outputs.build == 'true' && env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }}
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: docker.io
          username: ${{ env.DOCKERHUB_USERNAME }}
          password: ${{ env.DOCKERHUB_TOKEN }}

      - name: Log in to Quay
        if: ${{ steps.profile.outputs.build == 'true' && env.QUAY_USERNAME != '' && env.QUAY_TOKEN != '' }}
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: quay.io
          username: ${{ env.QUAY_USERNAME }}
          password: ${{ env.QUAY_TOKEN }}

      - name: Prepare tags
        if: ${{ steps.profile.outputs.build == 'true' }}
        id: tags
        shell: bash
        env:
          VARIANT: ${{ matrix.variant }}
          PROFILE: ${{ matrix.profile.name }}
          PROFILE_TAG: ${{ matrix.profile.tag }}
        run: |
          set -euo pipefail
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            version="${GITHUB_REF_NAME}"
          else
            version="dev"
          fi

          if [[ -n "${PROFILE_TAG}" ]]; then
            variant_suffix="${PROFILE_TAG}-${VARIANT}"
          else
            variant_suffix="${VARIANT}"
          fi
          sha_suffix="${GITHUB_SHA::12}-${variant_suffix}"

          tags=(
            "ghcr.io/${GITHUB_REPOSITORY}:${version}-${variant_suffix}"
            "ghcr.io/${GITHUB_REPOSITORY}:sha-${sha_suffix}"
          )

          if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
            tags+=("ghcr.io/${GITHUB_REPOSITORY}:latest-${variant_suffix}")
          fi

          if [[ "${VARIANT}" == "wolfi" ]]; then
            if [[ -n "${PROFILE_TAG}" ]]; then
              tags+=("ghcr.io/${GITHUB_REPOSITORY}:${version}-${PROFILE_TAG}")
              if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
                tags+=("ghcr.io/${GITHUB_REPOSITORY}:latest-${PROFILE_TAG}")
              fi
            else
              tags+=(
                "ghcr.io/${GITHUB_REPOSITORY}:${version}"
                "ghcr.io/${GITHUB_REPOSITORY}:${version}-base"
              )
              if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
                tags+=(
                  "ghcr.io/${GITHUB_REPOSITORY}:latest"
                  "ghcr.io/${GITHUB_REPOSITORY}:latest-base"
                )
              fi
            fi
          fi

          if [[ -n "${DOCKERHUB_USERNAME}" ]]; then
            tags+=(
              "docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:${version}-${variant_suffix}"
              "docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:sha-${sha_suffix}"
            )
            if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
              tags+=("docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:latest-${variant_suffix}")
            fi
            if [[ "${VARIANT}" == "wolfi" ]]; then
              if [[ -n "${PROFILE_TAG}" ]]; then
                tags+=("docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:${version}-${PROFILE_TAG}")
                if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
                  tags+=("docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:latest-${PROFILE_TAG}")
                fi
              else
                tags+=(
                  "docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:${version}"
                  "docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:${version}-base"
                )
                if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
                  tags+=(
                    "docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:latest"
                    "docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:latest-base"
                  )
                fi
              fi
            fi
          fi

          if [[ -n "${QUAY_USERNAME}" ]]; then
            tags+=(
              "quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:${version}-${variant_suffix}"
              "quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:sha-${sha_suffix}"
            )
            if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
              tags+=("quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:latest-${variant_suffix}")
            fi
            if [[ "${VARIANT}" == "wolfi" ]]; then
              if [[ -n "${PROFILE_TAG}" ]]; then
                tags+=("quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:${version}-${PROFILE_TAG}")
                if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
                  tags+=("quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:latest-${PROFILE_TAG}")
                fi
              else
                tags+=(
                  "quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:${version}"
                  "quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:${version}-base"
                )
                if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
                  tags+=(
                    "quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:latest"
                    "quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:latest-base"
                  )
                fi
              fi
            fi
          fi

          {
            echo "tags<<EOF"
            printf '%s\n' "${tags[@]}"
            echo "EOF"
          } >> "${GITHUB_OUTPUT}"

      - name: Resolve build inputs
        if: ${{ steps.profile.outputs.build == 'true' }}
        id: build-inputs
        shell: bash
        env:
          VARIANT: ${{ matrix.variant }}
          MATRIX_FEATURES: ${{ matrix.profile.features }}
          MATRIX_CONFIG: ${{ matrix.profile.config }}
          MATRIX_WOLFI_CONFIG: ${{ matrix.profile.wolfi_config || '' }}
          MATRIX_WOLFI_RUNTIME_PACKAGES: ${{ matrix.profile.wolfi_runtime_packages || '' }}
          INPUT_FEATURES: ${{ inputs.features || '' }}
          INPUT_CONFIG: ${{ inputs.config || '' }}
        run: |
          set -euo pipefail
          features="${INPUT_FEATURES:-$MATRIX_FEATURES}"
          config="${INPUT_CONFIG:-$MATRIX_CONFIG}"
          runtime_packages=""
          if [[ "${VARIANT}" == "wolfi" && -z "${INPUT_CONFIG}" ]]; then
            if [[ -n "${MATRIX_WOLFI_CONFIG}" ]]; then
              config="${MATRIX_WOLFI_CONFIG}"
            fi
            runtime_packages="${MATRIX_WOLFI_RUNTIME_PACKAGES}"
          fi
          {
            echo "features=${features}"
            echo "config=${config}"
            echo "runtime_packages=${runtime_packages}"
          } >> "${GITHUB_OUTPUT}"

      - name: Build and publish image
        if: ${{ steps.profile.outputs.build == 'true' }}
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: containers/Containerfile.${{ matrix.variant }}
          platforms: ${{ inputs.platforms || 'linux/amd64' }}
          push: true
          build-args: |
            FLUXHEIM_FEATURES=${{ steps.build-inputs.outputs.features }}
            FLUXHEIM_CONFIG=${{ steps.build-inputs.outputs.config }}
            FLUXHEIM_RUNTIME_PACKAGES=${{ steps.build-inputs.outputs.runtime_packages }}
            FLUXHEIM_RUNTIME_UID=${{ inputs.runtime_uid || '65532' }}
            FLUXHEIM_RUNTIME_GID=${{ inputs.runtime_gid || '65532' }}
          cache-from: type=gha,scope=images-${{ matrix.profile.name }}-${{ matrix.variant }}
          cache-to: type=gha,mode=max,scope=images-${{ matrix.profile.name }}-${{ matrix.variant }}
          labels: |
            org.opencontainers.image.title=Fluxheim
            org.opencontainers.image.description=Fluxheim static web server and reverse proxy
            org.opencontainers.image.licenses=EUPL-1.2
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ github.ref_name }}
          tags: ${{ steps.tags.outputs.tags }}

  quay-dev-wolfi:
    name: Build and publish Quay dev-wolfi
    if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.publish_dev_wolfi == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    env:
      QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
      QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
      QUAY_NAMESPACE: ${{ vars.QUAY_NAMESPACE || github.repository_owner }}
      QUAY_REPOSITORY: ${{ vars.QUAY_REPOSITORY || github.event.repository.name }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to Quay
        if: ${{ env.QUAY_USERNAME != '' && env.QUAY_TOKEN != '' }}
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: quay.io
          username: ${{ env.QUAY_USERNAME }}
          password: ${{ env.QUAY_TOKEN }}

      - name: Prepare dev tags
        if: ${{ env.QUAY_USERNAME != '' && env.QUAY_TOKEN != '' }}
        id: dev-tags
        shell: bash
        run: |
          set -euo pipefail
          short_sha="${GITHUB_SHA::12}"
          {
            echo "tags<<EOF"
            echo "quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:dev-wolfi"
            echo "quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:dev-${short_sha}-wolfi"
            echo "EOF"
          } >> "${GITHUB_OUTPUT}"

      - name: Build and publish dev-wolfi
        if: ${{ env.QUAY_USERNAME != '' && env.QUAY_TOKEN != '' }}
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: containers/Containerfile.wolfi
          platforms: linux/amd64
          push: true
          build-args: |
            FLUXHEIM_FEATURES=profile-development
            FLUXHEIM_CONFIG=packaging/container/fluxheim.toml
            FLUXHEIM_RUNTIME_UID=65532
            FLUXHEIM_RUNTIME_GID=65532
          cache-from: type=gha,scope=quay-dev-wolfi
          cache-to: type=gha,mode=max,scope=quay-dev-wolfi
          labels: |
            org.opencontainers.image.title=Fluxheim Development
            org.opencontainers.image.description=Fluxheim development image with all compatible production features enabled
            org.opencontainers.image.licenses=EUPL-1.2
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=dev
          tags: ${{ steps.dev-tags.outputs.tags }}

      - name: Skip Quay publish
        if: ${{ env.QUAY_USERNAME == '' || env.QUAY_TOKEN == '' }}
        run: echo "Skipping dev-wolfi publish because QUAY_USERNAME or QUAY_TOKEN is not configured."