synctv/.github/workflows/docker.yml

name: Docker

on:
  push:
    branches: ['**']
    tags:
      - "v*"
  pull_request:
    branches: ['**']
  schedule:
    - cron: '0 0 * * *'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  docker-prepare:
    name: Docker Prepare
    runs-on: ubuntu-latest
    outputs:
      meta-images: ${{ steps.meta-images.outputs.value }}
      image-tag: ${{ steps.meta-images.outputs.image-tag }}
    steps:
      - name: Build image metadata inputs
        id: meta-images
        env:
          GHCR_REPOSITORY: ${{ github.repository }}
          DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME || secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_REPOSITORY: ${{ vars.DOCKERHUB_REPOSITORY || secrets.DOCKERHUB_REPOSITORY }}
          DEFAULT_REPOSITORY_NAME: ${{ github.event.repository.name }}
        run: |
          image_tag="sha-${GITHUB_SHA::7}"
          if [ -n "$DOCKERHUB_REPOSITORY" ]; then
            case "$DOCKERHUB_REPOSITORY" in
              */*)
                dockerhub_repository="$DOCKERHUB_REPOSITORY"
                ;;
              *)
                dockerhub_repository="$DOCKERHUB_USERNAME/$DOCKERHUB_REPOSITORY"
                ;;
            esac
          elif [ -n "$DOCKERHUB_USERNAME" ]; then
            dockerhub_repository="$DOCKERHUB_USERNAME/$DEFAULT_REPOSITORY_NAME"
          fi
          {
            echo "image-tag=$image_tag"
            echo 'value<<EOF'
            echo "ghcr.io/$GHCR_REPOSITORY"
            if [ -n "$dockerhub_repository" ]; then
              echo "docker.io/$dockerhub_repository"
            fi
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"          

  docker-build:
    name: Docker Build
    needs: docker-prepare
    permissions:
      contents: read
      packages: write
      id-token: write
    uses: docker/github-builder/.github/workflows/build.yml@v1
    with:
      runner: |
        default=ubuntu-24.04
        linux/arm=ubuntu-24.04-arm
        linux/arm64=ubuntu-24.04-arm        
      distribute: true
      platforms: linux/amd64,linux/arm64
      output: ${{ github.event_name == 'push' && 'image' || 'local' }}
      push: ${{ github.event_name == 'push' }}
      artifact-upload: false
      sign: ${{ github.event_name == 'push' && 'auto' || 'false' }}
      cache: true
      cache-mode: max
      cache-scope: synctv-image
      build-args: |
        SYNCTV_CARGO_BUILD_PROFILE=${{ github.event_name == 'pull_request' && 'dev' || 'release' }}
        CARGO_INCREMENTAL=0
        CARGO_TERM_COLOR=always        
      set-meta-annotations: true
      set-meta-labels: true
      meta-images: ${{ needs.docker-prepare.outputs.meta-images }}
      meta-tags: |
        type=ref,event=branch
        type=ref,event=pr
        type=ref,event=tag
        type=semver,pattern={{version}}
        type=semver,pattern={{major}}.{{minor}}
        type=raw,value=${{ needs.docker-prepare.outputs.image-tag }}        
    secrets:
      registry-auths: |
        - registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
        ${{ (vars.DOCKERHUB_USERNAME || secrets.DOCKERHUB_USERNAME) != '' && format('- registry: docker.io
          username: {0}
          password: {1}', vars.DOCKERHUB_USERNAME || secrets.DOCKERHUB_USERNAME, secrets.DOCKERHUB_PASSWORD) || '' }}        

  helm:
    name: Publish next Helm Chart
    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
    needs:
      - docker-prepare
      - docker-build
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/helm.yml
    with:
      channel: next
      image-tag: ${{ needs.docker-prepare.outputs.image-tag }}
    secrets:
      token: ${{ secrets.GITHUB_TOKEN }}
      HELM_OCI_NAMESPACE: ${{ secrets.HELM_OCI_NAMESPACE }}
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_REPOSITORY: ${{ secrets.DOCKERHUB_REPOSITORY }}
      DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}