docker.yml

name: Docker

on:
  push:
    # The upstream repository's default branch is master; the fork uses main.
    branches: [main, master]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  image:
    name: Build, test and publish the image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write  # push to GHCR
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      # hatch-vcs cannot read the version inside the build context (.git is
      # excluded), so it is derived here and injected as a build argument.
      - name: Derive the package version
        id: version
        env:
          REF_NAME: ${{ github.ref_name }}
          REF_TYPE: ${{ github.ref_type }}
        run: |
          if [ "$REF_TYPE" = "tag" ]; then
            echo "value=${REF_NAME#v}" >> "$GITHUB_OUTPUT"
          else
            echo "value=0.0.0.dev0" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Set up Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      # Single-arch build loaded into the local daemon, so the image can be
      # exercised before anything is published. Buildx cannot --load a
      # multi-arch manifest, hence the separate step; the multi-arch build
      # below reuses this layer cache, so it costs little.
      - name: Build for testing
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64
          load: true
          push: false
          tags: pyonyphe:test
          build-args: |
            HATCH_VCS_PRETEND_VERSION=${{ steps.version.outputs.value }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Smoke-test the image
        run: |
          docker run --rm pyonyphe:test --version
          docker run --rm pyonyphe:test search --help
          # The CLI must fail cleanly with exit code 2, not crash, when no key
          # is configured. `|| status=$?` is required: the step runs under
          # `set -e`, so a bare non-zero command would abort the script here.
          status=0
          docker run --rm pyonyphe:test user || status=$?
          test "$status" -eq 2
          # And it must not run as root.
          test "$(docker run --rm --entrypoint id pyonyphe:test -u)" = "1000"

      # Pull requests stop here: they build and test, they never publish.
      - name: Log in to GHCR
        if: github.event_name != 'pull_request'
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute tags and labels
        if: github.event_name != 'pull_request'
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=sha,format=short
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}

      - name: Build and push
        if: github.event_name != 'pull_request'
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            HATCH_VCS_PRETEND_VERSION=${{ steps.version.outputs.value }}
          cache-from: type=gha
          cache-to: type=gha,mode=max