release-container-image.yml

name: Release Container Image

on:
  workflow_dispatch:
  workflow_call:
    inputs:
      skip-compile:
        type: boolean
        default: true

concurrency:
  group: release-container-${{ github.ref }}
  cancel-in-progress: true

env:
  IMAGE_REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  compile-binaries:
    if: inputs.skip-compile != true && startsWith(github.ref, 'refs/tags/v')
    uses: ./.github/workflows/compile.yml
    secrets: inherit

  determine-image-metadata:
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest

    outputs:
      ref: ${{ steps.image-ref.outputs.ref }}
      version: ${{ steps.image-meta.outputs.version }}
      tags: ${{ steps.image-meta.outputs.tags }}
      labels: ${{ steps.image-meta.outputs.labels }}
      json: ${{ steps.image-meta.outputs.json }}
      bake-file: ${{ steps.image-meta.outputs.bake-file }}

    steps:
    - name: Ensure valid image ref
      id: image-ref
      run: |
        echo "ref=${IMAGE_REGISTRY}/${IMAGE_NAME,,}" >> $GITHUB_OUTPUT

    - name: Checkout
      uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Extract metadata (tags, labels) of Image
      id: image-meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ steps.image-ref.outputs.ref }}

  build-platform-images:
    if: startsWith(github.ref, 'refs/tags/v') && !cancelled() && !failure()
    runs-on: ubuntu-latest
    needs:
    - compile-binaries
    - determine-image-metadata

    permissions:
      contents: read
      packages: write

    strategy:
      fail-fast: true
      matrix:
        platform:
        - amd64
        - arm64
        - arm

    steps:
    - name: "Checkout repository"
      uses: actions/checkout@v4

    - name: Extract metadata of Platform
      id: platform_meta
      env:
        PLATFORM: linux/${{ matrix.platform }}
      run: |
        echo "os=$(dirname $PLATFORM)" >> $GITHUB_OUTPUT
        echo "arch=$(basename $PLATFORM)" >> $GITHUB_OUTPUT

    - name: Download binaries from earlier jobs
      uses: actions/download-artifact@v4
      with:
        name: binary-${{ matrix.platform }}
        path: dist/

    - name: Copy entrypoint
      id: copy_entrypoint
      run: |
        cp -f init/entrypoint dist/entrypoint

    - name: Login to Github Packages
      uses: docker/login-action@v3
      with:
        registry: ${{ env.IMAGE_REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Build image and push to GitHub Container Registry
      id: build
      uses: docker/build-push-action@v5
      with:
        push: true
        context: .
        file: .github/release.Dockerfile
        platforms: linux/${{ matrix.platform }}
        build-args: |
          DIST_DIR=./dist
          TARGETOS=${{ steps.platform_meta.outputs.os }}
          TARGETARCH=${{ steps.platform_meta.outputs.arch }}
        provenance: false
        labels: ${{ needs.determine-image-metadata.outputs.labels }}
        outputs: type=image,name=${{ needs.determine-image-metadata.outputs.ref }},push-by-digest=true,name-canonical=true,push=true

    - name: Inspect image
      run: docker buildx imagetools inspect ${{ needs.determine-image-metadata.outputs.ref }}@${{ steps.build.outputs.digest }}

    - name: Export digest
      run: |
        mkdir -p /tmp/digests
        digest="${{ steps.build.outputs.digest }}"
        touch "/tmp/digests/${digest#sha256:}"

    - name: Upload digest
      uses: actions/upload-artifact@v4
      with:
        name: digests-${{ matrix.platform }}
        path: /tmp/digests/*
        if-no-files-found: error
        retention-days: 1

  release-images:
    if: startsWith(github.ref, 'refs/tags/v') && !cancelled() && !failure()
    runs-on: ubuntu-latest
    needs:
    - determine-image-metadata
    - build-platform-images

    steps:
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Login to Github Packages
      uses: docker/login-action@v3
      with:
        registry: ${{ env.IMAGE_REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Download digests
      uses: actions/download-artifact@v4
      with:
        pattern: digests-*
        path: /tmp/digests
        merge-multiple: true

    - name: Create manifest list and push
      working-directory: /tmp/digests
      run: |
        IMAGE_METADATA_JSON=$(
        cat <<EOF
          ${{ needs.determine-image-metadata.outputs.json }}
        EOF
        )

        TAGS=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$IMAGE_METADATA_JSON")
        DIGESTS=$(printf '${{ needs.determine-image-metadata.outputs.ref }}@sha256:%s ' *)

        docker buildx imagetools create $TAGS $DIGESTS


    - name: Inspect image
      run: docker buildx imagetools inspect ${{ needs.determine-image-metadata.outputs.ref }}:${{ needs.determine-image-metadata.outputs.version }}