docker-image.yml

name: Build Docker Image

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      build_version:
        description: 'Version label and manual image tag, e.g. 2.0.6 or dev-abc1234'
        required: false
        type: string
      promote_digest:
        description: 'Existing image digest to tag as latest without rebuilding'
        required: false
        type: string

permissions:
  contents: read
  packages: write

concurrency:
  group: docker-image-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Validate build version
        if: ${{ inputs.promote_digest == '' }}
        env:
          BUILD_VERSION: ${{ inputs.build_version || github.ref_name }}
        run: |
          if [[ "$BUILD_VERSION" == *$'\n'* || "$BUILD_VERSION" == *$'\r'* ]]; then
            echo "Invalid BUILD_VERSION: newlines are not allowed" >&2
            exit 1
          fi
          if ! [[ "$BUILD_VERSION" =~ ^[0-9A-Za-z._-]{1,64}$ ]]; then
            echo "Invalid BUILD_VERSION: must match ^[0-9A-Za-z._-]{1,64}$" >&2
            exit 1
          fi

      - name: Set up QEMU
        if: ${{ inputs.promote_digest == '' }}
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        if: ${{ inputs.promote_digest == '' }}
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          flavor: latest=false
          tags: |
            type=semver,pattern={{version}},value=${{ inputs.build_version || github.ref_name }},enable=${{ inputs.build_version != '' || startsWith(github.ref, 'refs/tags/v') }}
            type=semver,pattern={{major}}.{{minor}},value=${{ inputs.build_version || github.ref_name }},enable=${{ inputs.build_version != '' || startsWith(github.ref, 'refs/tags/v') }}
            type=raw,value=${{ inputs.build_version }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.build_version != '' }}
            type=raw,value=latest,enable=${{ github.event_name != 'workflow_dispatch' || github.ref_name == github.event.repository.default_branch }}

      - name: Build and push Docker image
        if: ${{ inputs.promote_digest == '' }}
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            BUILD_VERSION=${{ inputs.build_version || github.ref_name }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: false

      - name: Promote existing image to latest
        if: ${{ inputs.promote_digest != '' }}
        env:
          SOURCE_DIGEST: ${{ inputs.promote_digest }}
        run: |
          if ! [[ "$SOURCE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "Invalid image digest" >&2
            exit 1
          fi
          docker buildx imagetools create \
            --tag "${REGISTRY}/${IMAGE_NAME}:latest" \
            "${REGISTRY}/${IMAGE_NAME}@${SOURCE_DIGEST}"