docker.yml

name: Create and publish a Docker image

on:
  push:
    branches: ['**']
  pull_request:
  workflow_call:
    inputs:
      tag-name:
        required: true
        type: string
    outputs:
      image_tags:
        value: ${{ jobs.meta.outputs.tags }}
      image_url:
        value: https://ghcr.io/${{ github.repository }}

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  # tool versions
  # renovate: datasource=github-releases depName=docker/buildx
  BUILDX_VERSION: v0.21.2
  # renovate: datasource=github-releases depName=moby/buildkit
  BUILDKIT_VERSION: v0.20.0

permissions: {}

jobs:
  env:
    # release-please によるコミットの時は workflow_call でのみ実行する
    if: ${{ !( github.workflow == 'Create and publish a Docker image' && startsWith(github.event.head_commit.message, 'release:') && github.event.head_commit.author.name == 'eoeo-release[bot]' ) }}
    runs-on: ubuntu-latest
    outputs:
      REGISTRY_IMAGE: ${{ steps.lowercase.outputs.REGISTRY_IMAGE }}
      PUSH: ${{ github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch }}
    steps:
      - id: lowercase
        run: |
          registory_image='${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}'
          echo "REGISTRY_IMAGE=${registory_image@L}" >> $GITHUB_OUTPUT

  meta:
    needs: [env]
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.meta.outputs.version}}
      tags: ${{ steps.meta.outputs.tags }}
      labels: ${{ steps.labels.outputs.labels }}
      json: ${{ steps.meta.outputs.json }}
    steps:
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
        with:
          images: ${{ needs.env.outputs.REGISTRY_IMAGE }}
          tags: |
            type=semver,pattern={{version}},value=${{ inputs.tag-name }}
            type=semver,pattern={{major}}.{{minor}},value=${{ inputs.tag-name }}
            type=semver,pattern={{major}},value=${{ inputs.tag-name }}
            type=edge
            type=ref,event=branch

      - name: Delete org.opencontainers.image.licenses label
        id: labels
        run: |
          cat << EOS >> "$GITHUB_OUTPUT"
          labels<<EOF
          $(echo '${{ steps.meta.outputs.labels }}' | sed '/^org.opencontainers.image.licenses=/d')
          EOF
          EOS

  build:
    permissions:
      packages: write
    needs: [env, meta]
    outputs:
      digest: ${{ steps.build.outputs.digest }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            on: ubuntu-24.04
          - platform: linux/arm64
            on: ubuntu-24.04-arm

    runs-on: ${{ matrix.on }}

    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver-opts: image=moby/buildkit:${{ env.BUILDKIT_VERSION }}

      - name: Log in to the Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
        with:
          platforms: ${{ matrix.platform }}
          labels: ${{ needs.meta.outputs.labels }}
          outputs: type=image,name=${{ needs.env.outputs.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=${{ fromJson(needs.env.outputs.PUSH) }}
          cache-from: type=gha,scope=buildkit-${{ matrix.platform }}
          cache-to: type=gha,scope=buildkit-${{ matrix.platform }},mode=max

      - id: export-digest
        if: ${{ fromJson(needs.env.outputs.PUSH) }}
        name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"
      - id: prepare
        if: ${{ steps.export-digest.conclusion == 'success' }}
        name: Prepare
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_OUTPUT
      - if: ${{ steps.export-digest.conclusion == 'success' }}
        name: Upload digest
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: digests-${{ steps.prepare.outputs.PLATFORM_PAIR }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    permissions:
      packages: write
    needs: [env, meta, build]
    if: ${{ fromJson(needs.env.outputs.PUSH) }}
    runs-on: ubuntu-latest
    steps:
      - name: Download digests
        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Log in to the Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest list and push
        working-directory: /tmp/digests
        shell: bash -xe {0}
        env:
          DOCKER_METADATA_OUTPUT_JSON: ${{ needs.meta.outputs.json }}
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("--tag=" + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
          $(printf '${{ needs.env.outputs.REGISTRY_IMAGE }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ needs.env.outputs.REGISTRY_IMAGE }}:${{ needs.meta.outputs.version }}

  build-migrate:
    permissions:
      packages: write
    needs: [env]
    runs-on: ubuntu-24.04
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver-opts: image=moby/buildkit:${{ env.BUILDKIT_VERSION }}

      - name: Log in to the Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: migrate-meta
        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
        with:
          images: ${{ needs.env.outputs.REGISTRY_IMAGE }}
          tags: |
            type=semver,pattern={{version}},value=${{ inputs.tag-name }},suffix=-migrate
            type=semver,pattern={{major}}.{{minor}},value=${{ inputs.tag-name }},suffix=-migrate
            type=semver,pattern={{major}},value=${{ inputs.tag-name }},suffix=-migrate
            type=edge,suffix=-migrate
            type=ref,event=branch,suffix=-migrate

      - name: Build and push Docker image
        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
        with:
          file: 'migrate.Dockerfile'
          push: ${{ fromJson(needs.env.outputs.PUSH) }}
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.migrate-meta.outputs.tags }}
          labels: ${{ steps.migrate-meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max