docker-publish.yml

name: Docker Build and Push

on:
  workflow_call:

permissions:
  contents: read
  packages: write

env:
  REGISTRY: ghcr.io
  IMAGE: ghcr.io/${{ github.repository }}

jobs:
  build-amd64:
    name: Build amd64
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        with:
          context: .
          push: true
          platforms: linux/amd64
          cache-from: type=gha,scope=amd64
          cache-to: type=gha,scope=amd64,mode=max
          outputs: type=image,push-by-digest=true,name=${{ env.IMAGE }},push=true

  build-arm64:
    name: Build arm64
    runs-on: ubuntu-24.04-arm
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
        with:
          context: .
          push: true
          platforms: linux/arm64
          cache-from: type=gha,scope=arm64
          cache-to: type=gha,scope=arm64,mode=max
          outputs: type=image,push-by-digest=true,name=${{ env.IMAGE }},push=true

  merge:
    name: Create multi-arch manifest
    runs-on: ubuntu-latest
    needs: [build-amd64, build-arm64]
    steps:
      - name: Login to GitHub Container Registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest and push
        run: |
          for TAG in latest ${{ github.ref_name }}; do
            docker buildx imagetools create -t ${{ env.IMAGE }}:${TAG} \
              ${{ env.IMAGE }}@${{ needs.build-amd64.outputs.digest }} \
              ${{ env.IMAGE }}@${{ needs.build-arm64.outputs.digest }}
          done