docker.yml

name: build-and-push

# 构建多架构镜像并推到 GHCR。公开镜像,阿里云集群直接 pull。
# 触发:push 到 dev/main 或打 v*.*.* tag,也可以手动 workflow_dispatch。
on:
  push:
    branches: [dev, main]
    tags: ["v*.*.*"]
  workflow_dispatch:
    inputs:
      tag:
        description: 覆盖镜像 tag(可选)
        required: false

permissions:
  contents: read
  packages: write

env:
  IMAGE: ghcr.io/${{ github.repository_owner }}/fastclaw

jobs:
  # --- Shared: derive version metadata ---
  meta:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.meta.outputs.version }}
      sha7: ${{ steps.meta.outputs.sha7 }}
      date: ${{ steps.meta.outputs.date }}
      tags: ${{ steps.tags.outputs.tags }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Derive version
        id: meta
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ -n "${{ github.event.inputs.tag }}" ]; then
            echo "version=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
          elif [[ "${{ github.ref }}" == refs/tags/* ]]; then
            echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
          else
            echo "version=$(git describe --tags --always --dirty)" >> $GITHUB_OUTPUT
          fi
          echo "sha7=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
          echo "date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_OUTPUT
      - name: Compute tags
        id: tags
        run: |
          TAGS="${{ env.IMAGE }}:${{ steps.meta.outputs.version }},${{ env.IMAGE }}:${{ steps.meta.outputs.sha7 }}"
          case "${{ github.ref }}" in
            refs/heads/dev)  TAGS="$TAGS,${{ env.IMAGE }}:dev" ;;
            refs/heads/main) TAGS="$TAGS,${{ env.IMAGE }}:latest" ;;
          esac
          echo "tags=$TAGS" >> $GITHUB_OUTPUT

  # --- Per-arch builds run in parallel ---
  build:
    needs: meta
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform: [linux/amd64, linux/arm64]
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Platform slug
        id: slug
        run: echo "slug=$(echo '${{ matrix.platform }}' | tr '/' '-')" >> $GITHUB_OUTPUT
      - name: Build and push (single arch)
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          platforms: ${{ matrix.platform }}
          push: false
          outputs: type=image,"name=${{ env.IMAGE }}",push-by-digest=true,name-canonical=true,push=true
          build-args: |
            VERSION=${{ needs.meta.outputs.version }}
            COMMIT=${{ needs.meta.outputs.sha7 }}
            DATE=${{ needs.meta.outputs.date }}
          cache-from: type=gha,scope=${{ steps.slug.outputs.slug }}
          cache-to: type=gha,scope=${{ steps.slug.outputs.slug }},mode=max
      - name: Export digest
        run: |
          mkdir -p ${{ runner.temp }}/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"
      - uses: actions/upload-artifact@v4
        with:
          name: digest-${{ steps.slug.outputs.slug }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  # --- Merge per-arch digests into one multi-arch manifest ---
  merge:
    needs: [meta, build]
    runs-on: ubuntu-latest
    steps:
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/download-artifact@v4
        with:
          path: ${{ runner.temp }}/digests
          pattern: digest-*
          merge-multiple: true
      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
          TAGS="${{ needs.meta.outputs.tags }}"
          TAG_ARGS=""
          IFS=',' read -ra TAG_ARRAY <<< "$TAGS"
          for t in "${TAG_ARRAY[@]}"; do
            TAG_ARGS="$TAG_ARGS -t $t"
          done
          docker buildx imagetools create $TAG_ARGS \
            $(printf '${{ env.IMAGE }}@sha256:%s ' *)