docker.yaml

name: Docker

# Called by release.yaml in the same run (a release published with
# GITHUB_TOKEN does not trigger `on: release`, so the old
# `on: release: published` listener would never fire once publishing is
# automated), and on its own for `:develop` images.
#
# Tag meanings:
#   :1.13.2, :v1.13.2  — a published GitHub Release
#   :latest            — the newest published GitHub Release
#   :develop           — the newest push to develop
#
# This workflow deliberately does NOT push :latest. It is moved by release.yaml's
# publish job, by digest, only after the binaries, the image and the release
# assets have all been verified — otherwise a failure in any later job would
# leave :latest pointing at a build that never became a release.

on:
  workflow_call:
    inputs:
      ref:
        description: Commit SHA (or ref) to build. Defaults to the caller's ref.
        type: string
        required: false
        default: ''
      version:
        description: >-
          Release version without a leading `v` (e.g. 1.13.2). When set, the
          image is tagged as a release build.
        type: string
        required: false
        default: ''
    outputs:
      digest:
        description: Digest of the pushed image, for retagging by the caller.
        value: ${{ jobs.build.outputs.digest }}
  push:
    branches:
      - develop

permissions:
  contents: read
  packages: write

concurrency:
  group: docker-${{ inputs.version || github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: Build and Push
    runs-on: ubuntu-24.04
    # `skip docker` only applies to the develop path. A release build must never
    # be skippable by a commit message, or publish would fail with no digest.
    if: "inputs.version != '' || (!contains(github.event.head_commit.message, 'skip docker') && !contains(github.event.head_commit.message, 'docker skip'))"
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Code checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ inputs.ref }}

      - name: Get build information
        id: build_info
        env:
          VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          if [ -n "$VERSION" ]; then
            echo "build_version=${VERSION}" >> "$GITHUB_OUTPUT"
          else
            echo "build_version=dev-$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
          fi

      - name: Docker metadata
        id: docker_meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ghcr.io/${{ github.repository }}
          flavor: |
            latest=false
          tags: |
            type=raw,value=${{ inputs.version }},enable=${{ inputs.version != '' }}
            type=raw,value=v${{ inputs.version }},enable=${{ inputs.version != '' }}
            type=ref,event=branch,enable=${{ inputs.version == '' }}

      - name: Setup QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        id: build
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: ./Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          build-args: |
            VERSION=${{ steps.build_info.outputs.build_version }}
          labels: ${{ steps.docker_meta.outputs.labels }}
          tags: ${{ steps.docker_meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max