paseo/.github/workflows/docker.yml

name: Docker

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      paseo_version:
        description: "Expected source version to build. Required when publish is true."
        required: false
        default: ""
      publish:
        description: "Publish the image to GHCR. Manual publishes require paseo_version."
        required: false
        default: "false"
        type: choice
        options:
          - "false"
          - "true"
      publish_latest:
        description: "Also publish ghcr.io/getpaseo/paseo:latest. Ignored for prereleases."
        required: false
        default: "false"
        type: choice
        options:
          - "false"
          - "true"

concurrency:
  group: docker-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  REGISTRY: ghcr.io
  PLATFORMS: linux/amd64,linux/arm64

jobs:
  setup:
    name: setup
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      full: ${{ github.event_name != 'pull_request' || steps.filter.outputs.routing != 'false' || steps.filter.outputs.workspace != 'false' }}
      docker: ${{ steps.filter.outputs.docker }}
      image: ${{ steps.values.outputs.image }}
      install_version: ${{ steps.values.outputs.install_version }}
      publish: ${{ steps.values.outputs.publish }}
      check_tag: ${{ steps.values.outputs.check_tag }}
      publish_tags: ${{ steps.values.outputs.publish_tags }}
    steps:
      - uses: actions/checkout@v6

      - name: Detect Docker contract changes
        id: filter
        uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3.0.3
        with:
          filters: .github/ci-paths.yml

      - id: values
        env:
          INPUT_PASEO_VERSION: ${{ inputs.paseo_version }}
          INPUT_PUBLISH: ${{ inputs.publish }}
          INPUT_PUBLISH_LATEST: ${{ inputs.publish_latest }}
          REPO_OWNER: ${{ github.repository_owner }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          owner="$(printf '%s' "${REPO_OWNER}" | tr '[:upper:]' '[:lower:]')"
          image="ghcr.io/${owner}/paseo"
          package_version="$(node -p "require('./package.json').version")"
          install_version="${INPUT_PASEO_VERSION:-${package_version}}"
          publish=false
          publish_latest=false
          prerelease=false

          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            install_version="${REF_NAME#v}"
            publish=true
            if [[ "${REF_NAME}" == *-* ]]; then
              prerelease=true
            else
              publish_latest=true
            fi
          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            if [[ "${INPUT_PUBLISH:-false}" == "true" ]]; then
              if [[ -z "${INPUT_PASEO_VERSION}" || "${INPUT_PASEO_VERSION}" == "latest" ]]; then
                echo "::error::paseo_version is required for manual Docker publishes."
                exit 1
              fi
              publish=true
            fi

            if [[ "${install_version}" == *-* ]]; then
              prerelease=true
            fi

            if [[ "${INPUT_PUBLISH_LATEST:-false}" == "true" && "${prerelease}" != "true" ]]; then
              publish_latest=true
            fi
          fi

          check_tag="${image}:check-${GITHUB_SHA::12}"
          publish_tags="${image}:${install_version}"
          if [[ "${publish_latest}" == "true" ]]; then
            publish_tags="${publish_tags}"$'\n'"${image}:latest"
          fi

          {
            echo "image=${image}"
            echo "install_version=${install_version}"
            echo "publish=${publish}"
            echo "check_tag=${check_tag}"
            echo "publish_tags<<EOF"
            echo "${publish_tags}"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

          echo "Resolved image=${image} install_version=${install_version} publish=${publish}"

  build:
    name: build
    needs: setup
    if: ${{ !cancelled() && needs.setup.outputs.publish != 'true' && (needs.setup.outputs.full != 'false' || needs.setup.outputs.docker != 'false') }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-qemu-action@v4
      - uses: docker/setup-buildx-action@v4

      - uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/base/Dockerfile
          platforms: ${{ env.PLATFORMS }}
          build-args: |
            PASEO_VERSION=${{ needs.setup.outputs.install_version }}
          tags: ${{ needs.setup.outputs.check_tag }}
          push: false
          provenance: false
          cache-from: type=gha,scope=paseo
          cache-to: type=gha,scope=paseo,mode=max

  publish:
    name: publish
    needs: setup
    if: ${{ !cancelled() && needs.setup.outputs.publish == 'true' && (needs.setup.outputs.full != 'false' || needs.setup.outputs.docker != 'false') }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-qemu-action@v4
      - uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/base/Dockerfile
          platforms: ${{ env.PLATFORMS }}
          build-args: |
            PASEO_VERSION=${{ needs.setup.outputs.install_version }}
          tags: ${{ needs.setup.outputs.publish_tags }}
          push: true
          provenance: false
          cache-from: type=gha,scope=paseo
          cache-to: type=gha,scope=paseo,mode=max