docker-publish.yml

# Docker publish to ghcr.io (v0.13.4)
#
# Builds and pushes API + Web Docker images to GitHub Container Registry
# on every push to main. Images are tagged with both `latest` and the
# short commit SHA for traceability.
#
# Requires no manual secrets — uses the built-in GITHUB_TOKEN for
# authentication to ghcr.io.

name: Docker publish

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: docker-publish-${{ github.ref }}
  cancel-in-progress: false

env:
  REGISTRY: ghcr.io
  API_IMAGE: ghcr.io/roddygithub/gw2analytics-api
  WEB_IMAGE: ghcr.io/roddygithub/gw2analytics-web

jobs:
  publish:
    name: Build & push images
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and push API image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/api/Dockerfile
          push: true
          tags: |
            ${{ env.API_IMAGE }}:latest
            ${{ env.API_IMAGE }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build and push Web image
        uses: docker/build-push-action@v6
        with:
          context: ./web
          file: web/Dockerfile
          push: true
          tags: |
            ${{ env.WEB_IMAGE }}:latest
            ${{ env.WEB_IMAGE }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max