container.yml

name: Container publication

on:
  push:
    branches: [main]
    tags: ['v*']
  workflow_dispatch:

permissions:
  contents: read
  packages: write

concurrency:
  group: rusttorrent-container-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    # Privileged publication capacity is selected only for this repository and
    # this workflow deliberately has no pull_request trigger.
    runs-on: [self-hosted, node-b, linux, x64, publish, docker]
    env:
      IMAGE: ghcr.io/thedancingdeveloper-org/rusttorrent
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-qemu-action@v4
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GHCR_TOKEN }}
      - name: Define immutable and compatibility tags
        id: tags
        shell: bash
        run: |
          if [[ "$GITHUB_REF_TYPE" == tag ]]; then
            case "$GITHUB_REF_NAME" in v[0-9]*) ;; *) exit 1 ;; esac
            printf 'tags=%s\n' "$IMAGE:$GITHUB_REF_NAME,$IMAGE:latest,$IMAGE:beta,$IMAGE:sha-$GITHUB_SHA" >> "$GITHUB_OUTPUT"
          else
            test "$GITHUB_REF_NAME" = main
            printf 'tags=%s\n' "$IMAGE:dev,$IMAGE:sha-$GITHUB_SHA" >> "$GITHUB_OUTPUT"
          fi
      - name: Build and publish the destination image once
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile
          platforms: ${{ github.ref_type == 'tag' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
          push: true
          provenance: false
          tags: ${{ steps.tags.outputs.tags }}
          cache-from: ''
          cache-to: ''
      # GitHub does not expose a supported REST mutation for package
      # visibility. The package is made public once during repository
      # bootstrap; this anonymous pull is the fail-closed enforcement.
      - name: Verify the anonymous destination manifest
        run: |
          if [[ "$GITHUB_REF_TYPE" == tag ]]; then tag="$GITHUB_REF_NAME"; else tag=dev; fi
          token=$(curl -fsS 'https://ghcr.io/token?service=ghcr.io&scope=repository:thedancingdeveloper-org/rusttorrent:pull' | jq -r .token)
          test -n "$token"
          curl -fsS -H "Authorization: Bearer $token" \
            -H 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json' \
            "https://ghcr.io/v2/thedancingdeveloper-org/rusttorrent/manifests/$tag" > manifest.json
          jq -e '.schemaVersion == 2' manifest.json >/dev/null