docker.yml

name: Docker

# Builds and pushes the Xudanu image to GHCR.
# - On release tags (v*): tags :latest, :VERSION, :stable
# - On main pushes: tags :edge and :latest
# - Manual dispatch for testing
#
# The image is public: ghcr.io/jonesd/xudanu
# The container registry is free for public repos.
#
# Multi-arch via matrix: each arch builds natively on its own runner
# (amd64 on ubuntu-latest, arm64 on ubuntu-24.04-arm — no QEMU),
# then a merge job stitches them into one manifest list.

on:
  push:
    tags: ["v*"]
    branches: [main]
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

permissions:
  contents: read
  packages: write

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      - name: Prepare platform pair
        id: platform
        run: |
          platform=${{ matrix.platform }}
          echo "pair=${platform//\//-}" >> "$GITHUB_OUTPUT"

      - name: Docker meta (per-arch digest)
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          labels: |
            org.opencontainers.image.title=Xudanu
            org.opencontainers.image.description=Collaborative hypertext documents with transclusion by reference — working Xanadu
            org.opencontainers.source=https://github.com/jonesd/xudanu
            org.opencontainers.image.licenses=Apache-2.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Log in to GHCR
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: .
          file: ./Dockerfile
          platforms: ${{ matrix.platform }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=build-${{ steps.platform.outputs.pair }}
          cache-to: type=gha,mode=max,scope=build-${{ steps.platform.outputs.pair }}

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: digests-${{ steps.platform.outputs.pair }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - name: Download digests
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Log in to GHCR
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (final tags)
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            # v1.7.0 -> 1.7.0, 1.7 (on tag pushes)
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            # main branch -> edge
            type=raw,value=edge,enable=${{ github.ref == 'refs/heads/main' }}
            # stable alias for release tags
            type=raw,value=stable,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
            # latest on both release tags and main (until a release
            # tag builds, main IS the latest)
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          TAGS=""
          while IFS= read -r tag; do
            [ -n "$tag" ] && TAGS="$TAGS -t $tag"
          done <<< "${{ steps.meta.outputs.tags }}"
          docker buildx imagetools create $TAGS \
            $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:edge