docker.yml

name: docker

on:
  workflow_run:
    workflows: [build]
    types: [completed]

permissions:
  contents: read

jobs:
  docker:
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push' &&
      (github.event.workflow_run.head_branch == 'master' ||
       startsWith(github.event.workflow_run.head_branch, 'v'))
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
            artifact: linux-amd64
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
            artifact: linux-arm64
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write

    steps:
      - name: checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
          persist-credentials: false

      - name: set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: login to ghcr.io
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.PKG_TOKEN }}

      - name: login to DockerHub
        continue-on-error: true
        uses: docker/login-action@v4
        with:
          username: ${{ github.actor }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: build and push to ghcr.io by digest
        id: build-ghcr
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.platform }}
          build-args: |
            CI=github
            GITHUB_SHA=${{ github.event.workflow_run.head_sha }}
            GIT_BRANCH=${{ github.event.workflow_run.head_branch }}
          outputs: type=image,name=ghcr.io/ukeeper/ukeeper-readability,push-by-digest=true,name-canonical=true,push=true

      - name: build and push to DockerHub by digest
        id: build-dockerhub
        continue-on-error: true
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.platform }}
          build-args: |
            CI=github
            GITHUB_SHA=${{ github.event.workflow_run.head_sha }}
            GIT_BRANCH=${{ github.event.workflow_run.head_branch }}
          outputs: type=image,name=umputun/ukeeper-readability,push-by-digest=true,name-canonical=true,push=true

      - name: export ghcr digest
        env:
          DIGEST_GHCR: ${{ steps.build-ghcr.outputs.digest }}
        run: |
          mkdir -p /tmp/digests/ghcr
          touch "/tmp/digests/ghcr/${DIGEST_GHCR#sha256:}"

      - name: export dockerhub digest
        if: steps.build-dockerhub.outcome == 'success'
        env:
          DIGEST_DOCKERHUB: ${{ steps.build-dockerhub.outputs.digest }}
        run: |
          mkdir -p /tmp/digests/dockerhub
          touch "/tmp/digests/dockerhub/${DIGEST_DOCKERHUB#sha256:}"

      - name: upload ghcr digest
        uses: actions/upload-artifact@v7
        with:
          name: digests-ghcr-${{ matrix.artifact }}
          path: /tmp/digests/ghcr/*
          retention-days: 1

      - name: upload dockerhub digest
        if: steps.build-dockerhub.outcome == 'success'
        uses: actions/upload-artifact@v7
        with:
          name: digests-dockerhub-${{ matrix.artifact }}
          path: /tmp/digests/dockerhub/*
          retention-days: 1

  docker-merge:
    needs: docker
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: download ghcr digests
        uses: actions/download-artifact@v8
        with:
          path: /tmp/digests/ghcr
          pattern: digests-ghcr-*
          merge-multiple: true

      - name: download dockerhub digests
        id: download-dockerhub
        continue-on-error: true
        uses: actions/download-artifact@v8
        with:
          path: /tmp/digests/dockerhub
          pattern: digests-dockerhub-*
          merge-multiple: true

      - name: verify ghcr digests present
        run: |
          expected=2
          actual=$(find /tmp/digests/ghcr -maxdepth 1 -type f | wc -l)
          if [ "$actual" -ne "$expected" ]; then
            echo "Expected $expected digests for ghcr, found $actual"
            ls -la /tmp/digests/ghcr
            exit 1
          fi
          echo "All ghcr digests present"

      - name: verify dockerhub digests present
        id: verify-dockerhub
        continue-on-error: true
        run: |
          if [ ! -d /tmp/digests/dockerhub ]; then
            echo "No dockerhub digests directory, skipping"
            exit 1
          fi
          expected=2
          actual=$(find /tmp/digests/dockerhub -maxdepth 1 -type f | wc -l)
          if [ "$actual" -ne "$expected" ]; then
            echo "Expected $expected digests for dockerhub, found $actual"
            ls -la /tmp/digests/dockerhub
            exit 1
          fi
          echo "All dockerhub digests present"

      - name: set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: login to ghcr.io
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.PKG_TOKEN }}

      - name: login to DockerHub
        if: steps.verify-dockerhub.outcome == 'success'
        continue-on-error: true
        uses: docker/login-action@v4
        with:
          username: ${{ github.actor }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: determine tags
        id: tags
        env:
          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
        run: |
          ref="${HEAD_BRANCH//\//_}"
          echo "ref=${ref}" >> $GITHUB_OUTPUT
          if [[ "$HEAD_BRANCH" == v* ]]; then
            echo "is_tag=true" >> $GITHUB_OUTPUT
          else
            echo "is_tag=false" >> $GITHUB_OUTPUT
          fi

      - name: create ghcr.io manifest and push
        working-directory: /tmp/digests/ghcr
        env:
          REF: ${{ steps.tags.outputs.ref }}
          IS_TAG: ${{ steps.tags.outputs.is_tag }}
        run: |
          tags="-t ghcr.io/ukeeper/ukeeper-readability:${REF}"
          if [[ "$IS_TAG" == "true" ]]; then
            tags="${tags} -t ghcr.io/ukeeper/ukeeper-readability:latest"
          fi
          docker buildx imagetools create ${tags} \
            $(printf 'ghcr.io/ukeeper/ukeeper-readability@sha256:%s ' *)

      - name: create DockerHub manifest and push
        if: steps.verify-dockerhub.outcome == 'success'
        continue-on-error: true
        working-directory: /tmp/digests/dockerhub
        env:
          REF: ${{ steps.tags.outputs.ref }}
          IS_TAG: ${{ steps.tags.outputs.is_tag }}
        run: |
          tags="-t umputun/ukeeper-readability:${REF}"
          if [[ "$IS_TAG" == "true" ]]; then
            tags="${tags} -t umputun/ukeeper-readability:latest"
          fi
          docker buildx imagetools create ${tags} \
            $(printf 'umputun/ukeeper-readability@sha256:%s ' *)