image-build-source.yml

## Github workflow to build a docker image from source

name: Docker Image (Source)

on:
  workflow_dispatch:
  workflow_call:

## Define which docker arch to build for
env:
  docker_platforms: "linux/amd64,linux/arm64"
  docker-org: blockstack

concurrency:
  group: docker-image-source-${{ github.head_ref || github.ref || github.run_id }}
  ## Always cancel duplicate jobs
  cancel-in-progress: true

jobs:
  ## Runs anytime `ci.yml` runs or when manually called
  image:
    name: Build Image
    runs-on: ubuntu-latest
    ## Requires the repo environment "Push to Docker", which will trigger a secondary approval step before running this workflow.
    environment: "Push to Docker"
    permissions:
      id-token: write
      attestations: write
    steps:
      ## Setup Docker for the builds
      - name: Docker setup
        id: docker_setup
        uses: stacks-network/actions/docker@main
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      ## if the repo owner is not `stacks-network`, default to a docker-org of the repo owner (i.e. github user id)
      ## this allows forks to run the docker push workflows without having to hardcode a dockerhub org (but it does require docker hub user to match github username)
      - name: Set Local env vars
        id: set_env
        if: |
          github.repository_owner != 'stacks-network'
        run: |
          echo "docker-org=${{ github.repository_owner }}" >> "$GITHUB_ENV"

      ## Set docker metatdata
      - name: Docker Metadata ( ${{matrix.dist}} )
        id: docker_metadata
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 #v5.6.1
        with:
          images: |
            ${{env.docker-org}}/${{ github.event.repository.name }}
            ${{env.docker-org}}/stacks-blockchain
          tags: |
            type=raw,value=${{ env.BRANCH_NAME }}
            type=ref,event=pr

      ## Build docker image
      - name: Build and Push ( ${{matrix.dist}} )
        id: docker_build
        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
        with:
          file: ./Dockerfile
          platforms: ${{ env.docker_platforms }}
          tags: ${{ steps.docker_metadata.outputs.tags }}
          labels: ${{ steps.docker_metadata.outputs.labels }}
          build-args: |
            STACKS_NODE_VERSION=${{ env.GITHUB_SHA_SHORT }}
            GIT_BRANCH=${{ env.GITHUB_REF_SHORT }}
            GIT_COMMIT=${{ env.GITHUB_SHA_SHORT }}
          push: ${{ env.DOCKER_PUSH }}

      ## Generate docker image attestation(s)
      - name: Generate artifact attestation (${{ github.event.repository.name }})
        id: attest_primary
        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
        with:
          subject-name: |
            index.docker.io/${{env.docker-org}}/${{ github.event.repository.name }}
          subject-digest: ${{ steps.docker_build.outputs.digest }}
          push-to-registry: true

      - name: Generate artifact attestation (stacks-blockchain)
        id: attest_secondary
        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
        with:
          subject-name: |
            index.docker.io/${{env.docker-org}}/stacks-blockchain
          subject-digest: ${{ steps.docker_build.outputs.digest }}
          push-to-registry: true