docker-publish.yaml

name: Publish Docker image
run-name: Publish Docker image (${{ github.ref_type == 'tag' && github.ref_name || 'nightly' }})

on:
  push:
    branches:
      - taiyme
    tags:
      - '*-taiyme.*'

permissions:
  contents: read
  packages: write
  id-token: write

jobs:
  build-and-push:
    name: Build and Push
    runs-on: ${{ matrix.value.os }}
    strategy:
      fail-fast: false
      matrix:
        value:
          - os: ubuntu-22.04
            platform: linux/amd64
          - os: ubuntu-22.04-arm
            platform: linux/arm64
    steps:
      - name: Checkout ${{ github.sha }}
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          ref: ${{ github.sha }}
          fetch-depth: 1

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
        env:
          DOCKER_METADATA_SHORT_SHA_LENGTH: 9
        with:
          images: ${{ vars.DOCKER_IMAGE_NAME }}
          tags: |
            type=raw,priority=1300,value=${{ github.ref_name }},prefix=,suffix=,enable=${{ github.ref_type == 'tag' }}
            type=raw,priority=1200,value=latest,prefix=,suffix=,enable=${{ github.ref_type == 'tag' }}
            type=raw,priority=1200,value=nightly,prefix=,suffix=,enable=${{ github.ref_type != 'tag' }}
            type=sha,priority=1100,format=short,prefix=,suffix=,enable=true

      - name: Build and Push by digest
        id: build
        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
        with:
          context: .
          push: true
          platforms: ${{ matrix.value.platform }}
          provenance: false
          annotations: ${{ steps.meta.outputs.annotations }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=platform-${{ runner.os }}-${{ runner.arch }}
          cache-to: type=gha,mode=max,scope=platform-${{ runner.os }}-${{ runner.arch }}
          outputs: type=image,name=${{ vars.DOCKER_IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        env:
          digest: ${{ steps.build.outputs.digest }}
        run: |
          mkdir -p ${{ runner.temp }}/digests
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: digests-${{ runner.os }}-${{ runner.arch }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  merge-images:
    name: Merge images
    runs-on: ubuntu-22.04
    needs:
      - build-and-push
    steps:
      - name: Download digests
        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          pattern: digests-*
          path: ${{ runner.temp }}/digests
          merge-multiple: true

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
        env:
          DOCKER_METADATA_SHORT_SHA_LENGTH: 9
        with:
          images: ${{ vars.DOCKER_IMAGE_NAME }}
          tags: |
            type=raw,priority=1300,value=${{ github.ref_name }},prefix=,suffix=,enable=${{ github.ref_type == 'tag' }}
            type=raw,priority=1200,value=latest,prefix=,suffix=,enable=${{ github.ref_type == 'tag' }}
            type=raw,priority=1200,value=nightly,prefix=,suffix=,enable=${{ github.ref_type != 'tag' }}
            type=sha,priority=1100,format=short,prefix=,suffix=,enable=true

      - name: Create and Push manifest list
        working-directory: ${{ runner.temp }}/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ vars.DOCKER_IMAGE_NAME }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ vars.DOCKER_IMAGE_NAME }}:${{ steps.meta.outputs.version }}