docker.yml

name: docker

on:
  push:
    branches: [main]
  pull_request: {}

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    name: build (${{ matrix.platform }})
    runs-on: ubuntu-24.04${{ matrix.platform == 'linux/arm64' && '-arm' || ''}}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - linux/amd64
          - linux/arm64
    permissions:
      id-token: write
      packages: write
      contents: read
      attestations: write
    env:
      PLATFORM: ${{ matrix.platform }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Build time variables
        run: |-
          echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >>"$GITHUB_ENV"
          echo "TOR_VERSION=$(tr -d '\n' <VERSION)" >>"$GITHUB_ENV"
      - name: Skip if already published
        env:
          FULL_DOCKER_IMAGE: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TOR_VERSION }}"
          GH_TOKEN: ${{ github.token }}
        run: |-
          echo "Checking if $FULL_DOCKER_IMAGE exists ..."
          if docker manifest inspect "$FULL_DOCKER_IMAGE" &>/dev/null; then
            echo "$FULL_DOCKER_IMAGE already exists, skipping build"
            gh run cancel "$GITHUB_RUN_ID"
            exit 0
          fi
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Download Gentoo
        run: ./scripts/fetch-gentoo.sh "${PLATFORM##*/}"
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
      - name: Build and push image
        uses: docker/build-push-action@v7
        id: build
        env:
          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
        with:
          context: .
          sbom: true
          provenance: mode=max
          labels: ${{ steps.meta.outputs.labels }}
          build-args: TOR_VERSION=${{ env.TOR_VERSION }}
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          outputs: type=image,rewrite-timestamp=true,push-by-digest=true,name-canonical=true,push=${{ github.event_name == 'push' }}
      - name: Export digest
        run: |-
          mkdir -p "${{ runner.temp }}/digests"
          digest="${{ steps.build.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"
      - name: Escape platform (/ -> -)
        id: platform
        run: echo "escaped=${PLATFORM//\//-}" >"$GITHUB_OUTPUT"
      - name: Upload digest
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ steps.platform.outputs.escaped }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1
      - name: Attest
        uses: actions/attest-build-provenance@v4
        id: attest
        if: ${{ github.event_name == 'push' }}
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

  merge:
    if: ${{ github.event_name == 'push' }}
    runs-on: ubuntu-24.04
    needs:
      - build
    permissions:
      id-token: write
      packages: write
      contents: read
      attestations: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Build time variables
        run: |-
          echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >>"$GITHUB_ENV"
          echo "TOR_VERSION=$(tr -d '\n' <VERSION)" >>"$GITHUB_ENV"
      - name: Download digests
        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Create manifest
        id: manifest
        env:
          FULL_DOCKER_IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TOR_VERSION }}
          DOCKER_IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          RUNNER_TEMP: ${{ runner.temp }}
        run: |-
          readarray -t digests < <(find "$RUNNER_TEMP/digests" -type f | xargs -n1 basename | xargs printf "$DOCKER_IMAGE@sha256:%s\n")
          docker buildx imagetools create -t "$FULL_DOCKER_IMAGE" "${digests[@]}"
          docker buildx imagetools inspect "$FULL_DOCKER_IMAGE"
          echo "digest=$(docker buildx imagetools inspect "$FULL_DOCKER_IMAGE" | grep "Digest:" | awk '{ print $2 }')" >"$GITHUB_OUTPUT"
      - name: Attest
        uses: actions/attest-build-provenance@v4
        id: attest
        if: ${{ github.event_name == 'push' }}
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.manifest.outputs.digest }}
          push-to-registry: true