docker.yml

name: docker

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

# Publishes to Docker Hub as $DOCKERHUB_USERNAME/loki-cli.
# Requires two repository secrets:
#   - DOCKERHUB_USERNAME  (your Docker Hub username)
#   - DOCKERHUB_TOKEN     (a Docker Hub *access token*, not your password)
# Create the token at https://hub.docker.com/settings/security
env:
  IMAGE_NAME: ${{ secrets.DOCKERHUB_USERNAME }}/loki-cli

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Ensure Docker Hub credentials are configured
        if: github.event_name != 'pull_request'
        run: |
          if [ -z "${{ secrets.DOCKERHUB_USERNAME }}" ] || [ -z "${{ secrets.DOCKERHUB_TOKEN }}" ]; then
            echo "::error::DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets are not set. Add them under Settings → Secrets and variables → Actions."
            exit 1
          fi

      - uses: docker/setup-qemu-action@v3       # arm64 emulation
      - uses: docker/setup-buildx-action@v3

      # Log in only when we intend to push (main / tag / manual).
      - name: Log in to Docker Hub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Derive tags and labels
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: docker.io/${{ env.IMAGE_NAME }}
          tags: |
            # branch pushes → e.g. `main`
            type=ref,event=branch
            # PRs → e.g. `pr-42` (built only, never pushed)
            type=ref,event=pr
            # git sha for every build
            type=sha,format=short
            # semver from git tag v1.2.3 → `1.2.3`, `1.2`, `1`, `latest`
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build (and push if not a PR)
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: true
          sbom: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Fast sanity check on the amd64 image.
      - name: Smoke test image (amd64)
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            # PRs don't push, so rebuild a local single-arch tag for the smoke test.
            docker buildx build --load --platform linux/amd64 -t loki-cli:smoke .
            IMAGE=loki-cli:smoke
          else
            IMAGE="$(echo '${{ steps.meta.outputs.tags }}' | head -n1)"
          fi
          echo "Testing $IMAGE"
          docker run --rm "$IMAGE" --version
          docker run --rm "$IMAGE" --help | head -20

      # Refresh the short description and README on the Docker Hub page.
      # Uses the Docker Hub v2 API directly to avoid third-party Node actions
      # that carry deprecation warnings. Runs only when we actually pushed
      # (i.e. not on PRs) and only from the default branch.
      - name: Update Docker Hub description
        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
          REPO: ${{ env.IMAGE_NAME }}
          SHORT_DESC: A logcli-style CLI for querying Grafana Loki instances.
        run: |
          set -euo pipefail

          echo "Acquiring Docker Hub JWT for $DOCKERHUB_USERNAME ..."
          JWT=$(jq -n --arg u "$DOCKERHUB_USERNAME" --arg p "$DOCKERHUB_TOKEN" \
                 '{username:$u, password:$p}' \
              | curl -sS -H 'Content-Type: application/json' \
                     -X POST -d @- https://hub.docker.com/v2/users/login/ \
              | jq -re '.token')

          # Docker Hub caps `full_description` at 25 000 chars.
          jq -n \
            --arg d "$SHORT_DESC" \
            --rawfile f README.md \
            '{description:$d, full_description:($f[0:25000])}' > payload.json

          HTTP=$(curl -sS -o response.json -w '%{http_code}' \
                      -X PATCH \
                      -H 'Content-Type: application/json' \
                      -H "Authorization: JWT $JWT" \
                      -d @payload.json \
                      "https://hub.docker.com/v2/repositories/$REPO/")
          echo "Docker Hub API responded with HTTP $HTTP"
          if [ "$HTTP" -ge 300 ]; then
            echo "::error::Failed to update Docker Hub description (HTTP $HTTP)"
            cat response.json
            exit 1
          fi
          rm -f payload.json response.json