biliup/.github/workflows/docker-publish.yml

name: Docker

on:
  push:
    # Publish `master` as Docker `latest` image.
    branches:
      - master

    # Publish `v1.2.3` tags as releases.
    tags:
      - v*

  # Run tests for any PRs.
  pull_request:

# 顶层只保留读权限：test 任务会在 pull_request 事件下检出并构建
# PR 代码，不应持有 packages 写权限
permissions:
  contents: read

env:
  IMAGE_NAME: ghcr.io/biliup/caution

jobs:
  # Run tests.
  # See also https://docs.docker.com/docker-hub/builds/automated-testing/
  test:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Get PR number, repo URL, and branch name
        run: |
          if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
            pr_number=$(jq -r .number < "$GITHUB_EVENT_PATH")
            repo_url=$(jq -r .pull_request.head.repo.clone_url < "$GITHUB_EVENT_PATH")
            branch_name=$GITHUB_HEAD_REF
          else
            pr_number=""
            repo_url=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY
            branch_name="master"
          fi
          echo "PR_NUMBER=$pr_number" >> $GITHUB_ENV
          echo "REPO_URL=$repo_url" >> $GITHUB_ENV
          echo "BRANCH_NAME=$branch_name" >> $GITHUB_ENV

      - name: Run tests
        run: |
          if [ -f docker-compose.test.yml ]; then
            # runner 已移除 docker-compose v1，统一使用 compose v2 子命令
            docker compose --file docker-compose.test.yml build
            docker compose --file docker-compose.test.yml run sut
          else
            docker build \
              --build-arg repo_url=$REPO_URL \
              --build-arg branch_name=$BRANCH_NAME \
              --tag biliup-test \
              . --file Dockerfile
          fi

      - name: Smoke test container
        if: hashFiles('docker-compose.test.yml') == ''
        run: |
          docker run -d --name biliup-test -p 19159:19159 biliup-test
          for i in $(seq 1 30); do
            if curl -fsS -o /dev/null http://127.0.0.1:19159/; then
              docker exec biliup-test test -s /opt/ds_update.log
              docker rm -f biliup-test
              exit 0
            fi
            sleep 2
          done
          docker logs biliup-test
          exit 1


  build:
    needs: test
    name: Build for ${{ matrix.platform }}
    runs-on: ${{ matrix.runner }}
    if: github.event_name == 'push'
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-24.04
          - platform: linux/arm64
            runner: ubuntu-24.04-arm

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_NAME }}

      - name: Build and push by digest
        id: build-and-push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
          load: false
          push: true
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        run: |
          mkdir -p ${{ runner.temp }}/digests
          digest="${{ steps.build-and-push.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Generate artifact name
        id: artifact-name
        run: |
          # Use bash parameter expansion to replace '/' with '-' in platform name
          SAFE_PLATFORM="${{ matrix.platform }}"
          SAFE_PLATFORM="${SAFE_PLATFORM//\//-}"
          echo "name=digests-${SAFE_PLATFORM}" >> $GITHUB_OUTPUT

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.artifact-name.outputs.name }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: Merge and tag manifest
    needs: build
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    permissions:
      packages: write

    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_NAME }}

      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.IMAGE_NAME }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}