update-current-image.yml

name: Update Image

on:
  schedule:
    - cron: '30 0 * * *'
  workflow_dispatch:
    inputs:
      node_version:
        description: 'Node.js version to build (e.g., 20.10.0). Leave empty to auto-detect latest.'
        required: false
        type: string

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

env:
  IMAGE_NAME: node-minimal
  GHCR_IMAGE: ghcr.io/chorrell/node-minimal

permissions:
  contents: read

jobs:
  check_version:
    runs-on: ubuntu-latest
    outputs:
      NODE_VERSION: ${{ steps.get_version.outputs.NODE_VERSION }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Validate and Get NODE_VERSION
        id: get_version
        env:
          GITHUB_EVENT_INPUTS_NODE_VERSION: ${{ github.event.inputs.node_version }}
        run: |
          if [[ -n "${GITHUB_EVENT_INPUTS_NODE_VERSION}" ]]; then
            INPUT_VERSION="${GITHUB_EVENT_INPUTS_NODE_VERSION}"
            if ! [[ $INPUT_VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "Error: Invalid version format '$INPUT_VERSION'. Expected format: X.Y.Z (e.g., 20.10.0)" >&2
              exit 1
            fi
            NODE_VERSION="$INPUT_VERSION"
          else
            NODE_VERSION=$(./check-missing-versions.sh | tail -1)
          fi
          echo "NODE_VERSION=$NODE_VERSION" >> "$GITHUB_OUTPUT"
          if [[ -n "$NODE_VERSION" ]]; then
            echo "Building Node.js version: $NODE_VERSION"
          else
            echo "No new Node.js versions to build"
          fi

  build:
    strategy:
      matrix:
        os:
          - ubuntu-24.04
          - ubuntu-24.04-arm
        platform:
          - amd64
          - arm64
        exclude:
          - os: ubuntu-24.04
            platform: arm64
          - os: ubuntu-24.04-arm
            platform: amd64

    needs: check_version
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      packages: write

    if: needs.check_version.outputs.NODE_VERSION
    env:
      NODE_VERSION: ${{needs.check_version.outputs.NODE_VERSION}}

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: ccache
        uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
        with:
          key: ${{ matrix.os }}-${{ matrix.platform }}
          max-size: 10G

      - name: Configure ccache
        run: |
          ccache --set-config=sloppiness=time_macros,locale,include_file_ctime,include_file_mtime
          ccache --set-config=hash_dir=false
          ccache -p

      - name: Set and Display Versions
        run: |
          MAJOR_VERSION=$(echo "$NODE_VERSION" | cut -d'.' -f 1)
          echo "MAJOR_VERSION=$MAJOR_VERSION" >> "$GITHUB_ENV"
          echo "Building Node.js version: $NODE_VERSION (major: $MAJOR_VERSION)"

      - name: Build Node
        run: |
          export PATH="/usr/lib/ccache:/usr/local/opt/ccache/libexec:$PATH"
          which gcc
          ./build.sh -n "$NODE_VERSION"
          ccache -s
          cp "node-v${NODE_VERSION}/out/Release/node" node

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Login to DockerHub
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build test image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        env:
          DOCKER_BUILD_SUMMARY: false
        with:
          context: .
          platforms: linux/${{ matrix.platform }}
          load: true
          tags: ${{ env.IMAGE_NAME }}-${{ env.NODE_VERSION }}
          cache-from: type=gha,scope=${{ matrix.platform }}
          cache-to: type=gha,mode=max,scope=${{ matrix.platform }}

      - name: Test Image
        run: docker run --rm "${IMAGE_NAME}-${NODE_VERSION}" -e "console.log('Hello from Node.js ' + process.version)"

      - name: Build and push per-platform image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/${{ matrix.platform }}
          push: true
          provenance: mode=max
          sbom: true
          tags: |
            ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:build-${{ github.run_id }}-${{ matrix.platform }}
            ${{ env.GHCR_IMAGE }}:build-${{ github.run_id }}-${{ matrix.platform }}
          cache-from: type=gha,scope=${{ matrix.platform }}

  merge:
    needs: [check_version, build]
    runs-on: ubuntu-latest
    permissions:
      packages: write
    env:
      NODE_VERSION: ${{ needs.check_version.outputs.NODE_VERSION }}

    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Login to DockerHub
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set major version
        run: echo "MAJOR_VERSION=$(echo "$NODE_VERSION" | cut -d'.' -f 1)" >> "$GITHUB_ENV"

      - name: Create DockerHub multi-arch manifests
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          RUN_ID: ${{ github.run_id }}
        run: |
          REPO="${DOCKERHUB_USERNAME}/${IMAGE_NAME}"
          docker buildx imagetools create \
            -t "${REPO}:${NODE_VERSION}" \
            -t "${REPO}:${MAJOR_VERSION}" \
            -t "${REPO}:current" \
            -t "${REPO}:latest" \
            "${REPO}:build-${RUN_ID}-amd64" \
            "${REPO}:build-${RUN_ID}-arm64"

      - name: Create GHCR multi-arch manifests
        env:
          RUN_ID: ${{ github.run_id }}
        run: |
          docker buildx imagetools create \
            -t "${GHCR_IMAGE}:${NODE_VERSION}" \
            -t "${GHCR_IMAGE}:${MAJOR_VERSION}" \
            -t "${GHCR_IMAGE}:current" \
            -t "${GHCR_IMAGE}:latest" \
            "${GHCR_IMAGE}:build-${RUN_ID}-amd64" \
            "${GHCR_IMAGE}:build-${RUN_ID}-arm64"

      - name: Inspect manifest
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
        run: |
          docker buildx imagetools inspect "${DOCKERHUB_USERNAME}/${IMAGE_NAME}:${NODE_VERSION}"