docker.yml

name: docker

on:
  workflow_run:
    workflows: [build]
    types: [completed]

permissions:
  contents: read

jobs:
  docker:
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push' &&
      (github.event.workflow_run.head_branch == 'master' ||
       startsWith(github.event.workflow_run.head_branch, 'v'))
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
            artifact: linux-amd64
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
            artifact: linux-arm64
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write

    steps:
      - name: checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
          persist-credentials: false

      - name: set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: login to ghcr.io
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.PKG_TOKEN }}

      - name: login to DockerHub
        uses: docker/login-action@v4
        with:
          username: ${{ github.actor }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: build and push to ghcr.io by digest
        id: build-ghcr
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.platform }}
          build-args: |
            CI=github
            GITHUB_SHA=${{ github.event.workflow_run.head_sha }}
            GIT_BRANCH=${{ github.event.workflow_run.head_branch }}
          outputs: type=image,name=ghcr.io/ukeeper/ukeeper-readability,push-by-digest=true,name-canonical=true,push=true

      - name: build and push to DockerHub by digest
        id: build-dockerhub
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.platform }}
          build-args: |
            CI=github
            GITHUB_SHA=${{ github.event.workflow_run.head_sha }}
            GIT_BRANCH=${{ github.event.workflow_run.head_branch }}
          outputs: type=image,name=umputun/ukeeper-readability,push-by-digest=true,name-canonical=true,push=true

      - name: export digests
        env:
          DIGEST_GHCR: ${{ steps.build-ghcr.outputs.digest }}
          DIGEST_DOCKERHUB: ${{ steps.build-dockerhub.outputs.digest }}
        run: |
          mkdir -p /tmp/digests/ghcr /tmp/digests/dockerhub
          touch "/tmp/digests/ghcr/${DIGEST_GHCR#sha256:}"
          touch "/tmp/digests/dockerhub/${DIGEST_DOCKERHUB#sha256:}"

      - name: upload ghcr digest
        uses: actions/upload-artifact@v7
        with:
          name: digests-ghcr-${{ matrix.artifact }}
          path: /tmp/digests/ghcr/*
          retention-days: 1

      - name: upload dockerhub digest
        uses: actions/upload-artifact@v7
        with:
          name: digests-dockerhub-${{ matrix.artifact }}
          path: /tmp/digests/dockerhub/*
          retention-days: 1

  docker-merge:
    needs: docker
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: download ghcr digests
        uses: actions/download-artifact@v8
        with:
          path: /tmp/digests/ghcr
          pattern: digests-ghcr-*
          merge-multiple: true

      - name: download dockerhub digests
        uses: actions/download-artifact@v8
        with:
          path: /tmp/digests/dockerhub
          pattern: digests-dockerhub-*
          merge-multiple: true

      - name: verify all digests present
        run: |
          for registry in ghcr dockerhub; do
            expected=2
            actual=$(find /tmp/digests/$registry -maxdepth 1 -type f | wc -l)
            if [ "$actual" -ne "$expected" ]; then
              echo "Expected $expected digests for $registry, found $actual"
              ls -la /tmp/digests/$registry
              exit 1
            fi
          done
          echo "All digests present"

      - name: set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: login to ghcr.io
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.PKG_TOKEN }}

      - name: login to DockerHub
        uses: docker/login-action@v4
        with:
          username: ${{ github.actor }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: determine tags
        id: tags
        env:
          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
        run: |
          ref="${HEAD_BRANCH//\//_}"
          echo "ref=${ref}" >> $GITHUB_OUTPUT
          if [[ "$HEAD_BRANCH" == v* ]]; then
            echo "is_tag=true" >> $GITHUB_OUTPUT
          else
            echo "is_tag=false" >> $GITHUB_OUTPUT
          fi

      - name: create ghcr.io manifest and push
        working-directory: /tmp/digests/ghcr
        env:
          REF: ${{ steps.tags.outputs.ref }}
          IS_TAG: ${{ steps.tags.outputs.is_tag }}
        run: |
          tags="-t ghcr.io/ukeeper/ukeeper-readability:${REF}"
          if [[ "$IS_TAG" == "true" ]]; then
            tags="${tags} -t ghcr.io/ukeeper/ukeeper-readability:latest"
          fi
          docker buildx imagetools create ${tags} \
            $(printf 'ghcr.io/ukeeper/ukeeper-readability@sha256:%s ' *)

      - name: create DockerHub manifest and push
        working-directory: /tmp/digests/dockerhub
        env:
          REF: ${{ steps.tags.outputs.ref }}
          IS_TAG: ${{ steps.tags.outputs.is_tag }}
        run: |
          tags="-t umputun/ukeeper-readability:${REF}"
          if [[ "$IS_TAG" == "true" ]]; then
            tags="${tags} -t umputun/ukeeper-readability:latest"
          fi
          docker buildx imagetools create ${tags} \
            $(printf 'umputun/ukeeper-readability@sha256:%s ' *)