publish-docker.yml

name: Publish Docker image

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: Optional image tag like 3.0 or v3.0
        required: false
        type: string
      push_latest:
        description: Also push latest tag
        required: false
        type: boolean
        default: true

env:
  IMAGE_NAME: misiektoja/spotify-monitor

permissions: {}

jobs:
  test:
    name: Tests and container smoke checks
    # A called workflow cannot exceed what the calling job grants, so the checkout in tests.yml needs this.
    permissions:
      contents: read
    uses: ./.github/workflows/tests.yml

  publish-docker:
    name: Build and publish multi-architecture image to Docker Hub
    needs: test
    runs-on: ubuntu-latest
    environment:
      name: docker
      url: https://hub.docker.com/r/misiektoja/spotify-monitor
    permissions:
      contents: read
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Resolve image tags
        id: resolve_tags
        shell: bash
        # Event and input values reach the script through the environment. Interpolating them directly into
        # run: would let a crafted tag or input run shell commands in a job already holding the registry token
        env:
          EVENT_NAME: ${{ github.event_name }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          INPUT_TAG: ${{ github.event.inputs.tag }}
          INPUT_PUSH_LATEST: ${{ github.event.inputs.push_latest }}
        run: |
          set -euo pipefail
          base_tag=""
          push_latest="false"
          if [[ "$EVENT_NAME" == "release" ]]; then
            base_tag="$RELEASE_TAG"
            push_latest="true"
          elif [[ -n "$INPUT_TAG" ]]; then
            base_tag="$INPUT_TAG"
            push_latest="$INPUT_PUSH_LATEST"
          else
            base_tag="${GITHUB_SHA::7}"
            push_latest="$INPUT_PUSH_LATEST"
          fi
          if [[ -z "$base_tag" ]]; then
            echo "Failed to resolve image tag" >&2
            exit 1
          fi
          # A tag becomes part of an image reference, so refuse anything outside the characters a tag may use
          if [[ ! "$base_tag" =~ ^[A-Za-z0-9._-]+$ ]]; then
            echo "Refusing unsafe image tag: $base_tag" >&2
            exit 1
          fi
          tags=("${IMAGE_NAME}:${base_tag}")
          if [[ "$base_tag" =~ ^v[0-9] ]]; then
            tags+=("${IMAGE_NAME}:${base_tag#v}")
          fi
          if [[ "$push_latest" == "true" ]]; then
            tags+=("${IMAGE_NAME}:latest")
          fi
          {
            echo "tags<<EOF"
            printf '%s\n' "${tags[@]}"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Log in to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push multi-architecture image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.resolve_tags.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max