docker-publish.yml

name: Publish Docker Image

on:
  release:
    types: [published]

jobs:
  docker:
    name: Build and Push Docker Image
    runs-on: ubuntu-latest
    environment: dockerhub
    permissions:
      contents: write  # to update release notes

    steps:
      - uses: actions/checkout@v4

      - name: Extract version
        id: version
        run: |
          TAG="${{ github.event.release.tag_name }}"
          echo "CLEANCLOUD_VERSION=${TAG#v}" >> $GITHUB_OUTPUT

      - name: Wait for PyPI availability
        run: |
          CLEANCLOUD_VERSION="${{ steps.version.outputs.CLEANCLOUD_VERSION }}"
          echo "Waiting for cleancloud==${CLEANCLOUD_VERSION} to appear on PyPI..."
          for i in $(seq 1 20); do
            curl -sf --retry 3 --retry-delay 5 "https://pypi.org/pypi/cleancloud/${CLEANCLOUD_VERSION}/json" > /dev/null && echo "Found on PyPI" && exit 0
            echo "Not yet available (attempt $i/20), retrying in 30s..."
            sleep 30
          done
          echo "Timed out waiting for PyPI" && exit 1

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: getcleancloud/cleancloud
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern=v{{version}}
            type=raw,value=latest,enable=${{ !github.event.release.prerelease }}
          labels: |
            org.opencontainers.image.description=Read-only cloud hygiene scanner for AWS, Azure, and GCP
            org.opencontainers.image.licenses=MIT

      - name: Build and push
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          build-args: |
            CLEANCLOUD_VERSION=${{ steps.version.outputs.CLEANCLOUD_VERSION }}
            CLEANCLOUD_EXTRAS=all
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: true
          sbom: true

      - name: Log image digest
        run: echo "Image digest ${{ steps.build.outputs.digest }}"

      - name: Update release notes with Docker info
        uses: actions/github-script@v7
        with:
          script: |
            const version = '${{ steps.version.outputs.CLEANCLOUD_VERSION }}';
            const digest = '${{ steps.build.outputs.digest }}';
            const currentBody = context.payload.release.body || '';

            // Idempotent: skip if Docker section already present (workflow rerun guard)
            if (currentBody.includes('🐳 **Docker Image**')) {
              console.log('Docker section already present, skipping update.');
              return;
            }

            const safeBody = currentBody.endsWith('\n') ? currentBody : currentBody + '\n';
            const dockerInfo = `\n🐳 **Docker Image**\n\n\`\`\`bash\n# AWS\ndocker run --rm -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e AWS_REGION getcleancloud/cleancloud scan --provider aws --all-regions\n\n# Azure\ndocker run --rm -e AZURE_CLIENT_ID -e AZURE_TENANT_ID -e AZURE_SUBSCRIPTION_ID -e AZURE_FEDERATED_TOKEN_FILE -v "\${AZURE_FEDERATED_TOKEN_FILE}:\${AZURE_FEDERATED_TOKEN_FILE}:ro" getcleancloud/cleancloud scan --provider azure\n\n# GCP (WIF or service account key)\ndocker run --rm -e GOOGLE_APPLICATION_CREDENTIALS=/gcp-creds.json -v "\${GOOGLE_APPLICATION_CREDENTIALS}:/gcp-creds.json:ro" getcleancloud/cleancloud scan --provider gcp --all-projects\n\`\`\`\n\n📦 Pull: \`docker pull getcleancloud/cleancloud:${version}\`\n🔗 Docker Hub: https://hub.docker.com/r/getcleancloud/cleancloud\n🔏 Digest: \`${digest}\``;

            await github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: context.payload.release.id,
              body: safeBody + dockerInfo
            });