docker-publish.yml

name: Docker Publish

on:
    pull_request:
        branches:
            - main
    push:
        branches:
            - main
        tags:
            - 'v*'

env:
    REGISTRY: ghcr.io
    IMAGE_NAME: ${{ github.repository }}

jobs:
    # Build each architecture on its OWN native runner, no QEMU emulation.
    # arm64 runs on ubuntu-24.04-arm (free for public repos), which is why
    # npm ci no longer segfaults the way it did under emulated cross-builds.
    # On pull_request: build both arches to validate, do not push.
    # On push/tag: push each arch by digest (no tag yet); the merge job tags.
    build:
        runs-on: ${{ matrix.runner }}
        permissions:
            contents: read
            packages: write
        strategy:
            fail-fast: false
            matrix:
                include:
                    - platform: linux/amd64
                      runner: ubuntu-24.04
                    - platform: linux/arm64
                      runner: ubuntu-24.04-arm

        steps:
            - name: Prepare platform pair
              run: |
                  platform=${{ matrix.platform }}
                  echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"

            - name: Checkout repository
              uses: actions/checkout@v4

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v3

            - name: Log in to GitHub Container Registry
              if: github.event_name != 'pull_request'
              uses: docker/login-action@v3
              with:
                  registry: ${{ env.REGISTRY }}
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Extract metadata (labels)
              id: meta
              uses: docker/metadata-action@v5
              with:
                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

            - name: Build and push by digest
              id: build
              uses: docker/build-push-action@v6
              with:
                  context: .
                  platforms: ${{ matrix.platform }}
                  labels: ${{ steps.meta.outputs.labels }}
                  # Separate cache scope per arch so the two jobs do not evict each other.
                  cache-from: type=gha,scope=${{ env.PLATFORM_PAIR }}
                  cache-to: type=gha,mode=max,scope=${{ env.PLATFORM_PAIR }}
                  # push/tag: push by digest. pull_request: build only (validate, no push).
                  outputs: ${{ github.event_name != 'pull_request' && format('type=image,name={0}/{1},push-by-digest=true,name-canonical=true,push=true', env.REGISTRY, env.IMAGE_NAME) || 'type=cacheonly' }}

            - name: Export digest
              if: github.event_name != 'pull_request'
              run: |
                  mkdir -p /tmp/digests
                  digest="${{ steps.build.outputs.digest }}"
                  touch "/tmp/digests/${digest#sha256:}"

            - name: Upload digest
              if: github.event_name != 'pull_request'
              uses: actions/upload-artifact@v4
              with:
                  name: digests-${{ env.PLATFORM_PAIR }}
                  path: /tmp/digests/*
                  if-no-files-found: error
                  retention-days: 1

    # Merge the per-arch digests into a single multi-arch manifest list and tag it.
    # Skipped on pull_request (nothing was pushed to merge).
    merge:
        if: github.event_name != 'pull_request'
        runs-on: ubuntu-latest
        needs:
            - build
        permissions:
            contents: read
            packages: write
        steps:
            - name: Download digests
              uses: actions/download-artifact@v4
              with:
                  path: /tmp/digests
                  pattern: digests-*
                  merge-multiple: true

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v3

            - name: Log in to GitHub Container Registry
              uses: docker/login-action@v3
              with:
                  registry: ${{ env.REGISTRY }}
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Extract metadata (tags, labels)
              id: meta
              uses: docker/metadata-action@v5
              with:
                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
                  tags: |
                      # latest on main branch
                      type=raw,value=latest,enable={{is_default_branch}}
                      # version tag (v1.2.3 -> 1.2.3)
                      type=semver,pattern={{version}}
                      # major.minor (v1.2.3 -> 1.2)
                      type=semver,pattern={{major}}.{{minor}}
                      # major only (v1.2.3 -> 1)
                      type=semver,pattern={{major}}
                      # sha for traceability
                      type=sha,prefix=sha-,format=short

            - name: Create multi-arch manifest list
              working-directory: /tmp/digests
              run: |
                  docker buildx imagetools create \
                    $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
                    $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)

            - name: Inspect manifest
              run: |
                  docker buildx imagetools inspect \
                    ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}