publish.yml

name: publish

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: jdx/mise-action@v2
        with:
          cache: true

      - name: Lint
        run: ./scripts/lint.sh

  matrix:
    runs-on: ubuntu-latest
    needs: [lint]
    outputs:
      matrix: ${{ steps.gen.outputs.matrix }}
      count: ${{ steps.gen.outputs.count }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: jdx/mise-action@v2
        with:
          cache: true

      - id: gen
        shell: bash
        run: |
          set -euo pipefail
          base="${{ github.event.before }}"
          head="${{ github.sha }}"
          matrix_json="$(python scripts/ci_matrix.py changed --base "$base" --head "$head" --json)"
          count="$(echo "$matrix_json" | jq '.include | length')"

          echo "count=$count" >> "$GITHUB_OUTPUT"
          echo "matrix<<EOF" >> "$GITHUB_OUTPUT"
          echo "$matrix_json" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

  build-and-push:
    runs-on: ubuntu-latest
    needs: [matrix]
    if: needs.matrix.outputs.count != '0'
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.matrix.outputs.matrix) }}
    steps:
      - uses: actions/checkout@v4

      - uses: jdx/mise-action@v2
        with:
          cache: true

      - uses: docker/setup-qemu-action@v3

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - id: latest-guard
        shell: bash
        run: |
          set -euo pipefail
          git fetch --no-tags --depth=1 origin main
          main_head="$(git rev-parse origin/main)"
          if [[ "${GITHUB_SHA}" == "${main_head}" ]]; then
            echo "publish_latest=true" >> "$GITHUB_OUTPUT"
          else
            echo "publish_latest=false" >> "$GITHUB_OUTPUT"
          fi

      - id: meta
        shell: bash
        run: |
          set -euo pipefail
          base="ghcr.io/${{ github.repository }}/${{ matrix.image_name }}"
          short="${GITHUB_SHA::7}"

          tags=("$base:sha-$short")
          if [[ "${{ steps.latest-guard.outputs.publish_latest }}" == "true" ]]; then
            tags=("$base:latest" "${tags[@]}")
          fi
          if [[ -n "${{ matrix.version }}" ]]; then
            tags+=("$base:${{ matrix.version }}")
          fi

          {
            echo "tags<<EOF"
            printf '%s\n' "${tags[@]}"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - id: build-args
        shell: bash
        run: |
          set -euo pipefail
          image_source="${{ github.server_url }}/${{ github.repository }}"
          {
            echo "value<<EOF"
            jq -r '.[]' <<< '${{ toJSON(matrix.build_args) }}'
            echo "ENV_IMAGE_SOURCE=${image_source}"
            echo "ENV_IMAGE_REVISION=${{ github.sha }}"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.dir }}
          file: ${{ matrix.dir }}/Dockerfile
          platforms: ${{ join(matrix.platforms, ',') }}
          build-args: ${{ steps.build-args.outputs.value }}
          push: true
          provenance: false
          sbom: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max