image.yml

name: Image
run-name: ${{ github.actor }} is building a new image

permissions:
  contents: read

on:
  workflow_dispatch:
  push:
    branches:
    - main
    - development
    paths:
    - docker/**
    - helm/Chart.yaml
    - .github/workflows/image.yml

jobs:

  build:
    runs-on:
        group: on-prem

    steps:
    - name: Git Checkout
      uses: actions/checkout@v6

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v4
      with:
        driver-opts: |
          image=docker.io/moby/buildkit:buildx-stable-1

    - name: Determine image version
      id: version
      run: |
        version="$(awk '/^appVersion:/ {gsub(/"/, "", $2); print $2}' helm/Chart.yaml)"
        if [ -z "$version" ]; then
          echo "Failed to read appVersion from helm/Chart.yaml" >&2
          exit 1
        fi
        echo "value=${version}" >> "$GITHUB_OUTPUT"

    - name: Extract image metadata
      id: meta
      uses: docker/metadata-action@v6
      with:
        images: ${{ vars.OCI_REGISTRY }}/library/tor
        tags: |
          type=raw,value=${{ steps.version.outputs.value }}-{{sha}}
          type=sha,format=short

    - name: Validate
      uses: docker/build-push-action@v7
      with:
        context: .
        file: docker/Dockerfile
        target: validate
        push: false

    - name: Authenticate with the remote Container Registry
      uses: docker/login-action@v4
      with:
        registry: ${{ vars.OCI_REGISTRY }}
        username: ${{ secrets.OCI_REGISTRY_HARBOR_LOGIN }}
        password: ${{ secrets.OCI_REGISTRY_HARBOR_SECRET }}

    - name: Build and push production image
      uses: docker/build-push-action@v7
      with:
        context: .
        file: docker/Dockerfile
        target: production
        push: true
        provenance: false
        # platforms: linux/amd64,linux/arm64
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}%