docker-dev.yaml

# Action to publish development Docker images
# Images are versioned as `0.0.0-{tag}-DATETIMESTAMP`
name: Development Image Release

on: workflow_dispatch

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: read

jobs:
  release-docker-image:
    name: Build and Release powersync-service Docker Image
    runs-on: ubuntu-latest
    environment: dockerhub
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          # check out full history
          # Temporarily needed for changesets
          fetch-depth: 0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Enable Corepack
        run: corepack enable
      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: pnpm

      - name: Install dependencies
        run: pnpm install

      - name: Ensure Changesets
        run: |
          # If no changesets are available the status check will fail
          # We should not continue if there are no changesets    
          pnpm changeset status
          pnpm changeset version --snapshot dev

        # This uses the service's package.json version for the Docker Image tag.
        # The changeset command above must change this to a dev package version.
      - name: Get dev service version from package.json
        id: get_version
        run: |
          version="$(node -p "require('./service/package.json').version")"

          node -e '
            const semver = require("semver");
            const version = process.argv[1];
            const parsed = semver.parse(version);

            if (!parsed) {
              console.error("Service version " + version + " is not a valid semver version.");
              process.exit(1);
            }

            const prerelease = parsed.prerelease.join(".");
            if (!/^dev(?:[.-]|$)/.test(prerelease)) {
              console.error("Service version " + version + " is not a dev snapshot version.");
              process.exit(1);
            }
          ' "$version"

          echo "SERVICE_VERSION=$version" >> "$GITHUB_OUTPUT"

      - name: Extract metadata for the image
        uses: docker/metadata-action@v5
        id: meta
        with:
          images: ${{ vars.DOCKER_REGISTRY }}
          labels: |
            org.opencontainers.image.licenses=FSL-1.1-ALv2
            org.opencontainers.image.version=${{ steps.get_version.outputs.SERVICE_VERSION }}
            org.opencontainers.image.vendor=Journey Mobile, Inc
          annotations: |
            org.opencontainers.image.licenses=FSL-1.1-ALv2
            org.opencontainers.image.version=${{ steps.get_version.outputs.SERVICE_VERSION }}
            org.opencontainers.image.vendor=Journey Mobile, Inc
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index

      - name: Build Image and Push
        uses: docker/build-push-action@v6
        with:
          platforms: linux/arm64,linux/amd64
          cache-from: type=registry,ref=${{vars.DOCKER_REGISTRY}}:latest
          context: .
          # This should not be taged as latest
          tags: ${{vars.DOCKER_REGISTRY}}:${{steps.get_version.outputs.SERVICE_VERSION}}
          file: ./service/Dockerfile
          push: true

          # Add labels and annotations from metadata-action above.
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          # Note: This includes build args in the published provenance.
          # Do not use this if secrets are passed in as args.
          provenance: mode=max
          # Pre-generate an SBOM file, which can be used for vulnerability scanning or listing licenses.
          sbom: true