docker.yml

name: Build Docker Image

on:
  schedule:
    - cron: "0 0 * * 0"
  workflow_dispatch:
  workflow_run:
    workflows: ["Release"]
    types:
      - completed

env:
  LATEST_PYTHON_VERSION: "3.12"

jobs:
  metadata:
    runs-on: ubuntu-latest
    if: |-
      github.event_name != 'workflow_run' ||
      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
    permissions:
      contents: read
    outputs:
      LATEST_RELEASE: ${{ steps.workflow.outputs.LATEST_RELEASE || steps.api.outputs.LATEST_RELEASE }}

    steps:
      - name: Get latest release from previous workflow
        id: workflow
        if: github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success'
        run: |
          tag=${{ github.event.workflow_run.head_branch }}
          echo "LATEST_RELEASE=${tag#refs/tags/}" >> $GITHUB_OUTPUT

      - name: Get latest release from api
        id: api
        if: github.event_name != 'workflow_run'
        run: |
          gh api repos/${{ github.repository }}/releases/latest | jq -r '.tag_name' | xargs -0 printf "LATEST_RELEASE=%s" >> $GITHUB_OUTPUT
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build:
    runs-on: ubuntu-latest
    needs: metadata
    permissions:
      contents: read
      packages: write
    concurrency:
      group: ${{ github.workflow }}-${{ needs.metadata.outputs.LATEST_RELEASE }}-${{ matrix.python_version }}${{ matrix.python_variant }}-${{ matrix.platform }}
      cancel-in-progress: true
    strategy:
      fail-fast: true
      matrix:
        python_version:
          - "3.9"
          - "3.10"
          - "3.11"
          - "3.12"
        python_variant:
          - ""
          - "-slim"
        platform:
          - linux/amd64
          - linux/arm64

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.metadata.outputs.LATEST_RELEASE }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Setup Docker
        uses: docker/setup-buildx-action@v3

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Generate Image Name and Scope
        id: image
        run: |
          echo "IMAGE=${GITHUB_REPOSITORY@L}" >> $GITHUB_OUTPUT
          echo "SCOPE=${{ hashFiles('**/pdm.lock') }}-${{ matrix.python_version }}${{ matrix.python_variant }}-${{ matrix.platform }}" >> $GITHUB_OUTPUT
          platform="${{ matrix.platform }}"
          echo "ARTIFACT=${{ matrix.python_version }}${{ matrix.python_variant }}-${platform/\//-}-digests" >> $GITHUB_OUTPUT

      - name: Generate Labels
        uses: docker/metadata-action@v5
        id: metadata
        with:
          images: ${{ steps.image.outputs.IMAGE }}

      - name: Build and Publish
        uses: docker/build-push-action@v6
        id: build
        with:
          context: .
          platforms: ${{ matrix.platform }}
          pull: true
          build-args: |
            PYTHON_IMAGE=${{ matrix.python_version }}
            VARIANT=${{ matrix.python_variant }}
          labels: ${{ steps.metadata.outputs.labels }}
          cache-from: type=gha,scope=${{ steps.image.outputs.SCOPE }}
          cache-to: type=gha,scope=${{ steps.image.outputs.SCOPE }},mode=max
          outputs: type=image,name=${{ steps.image.outputs.IMAGE }},push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        run: |
          mkdir -p /tmp/digests/
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.image.outputs.ARTIFACT }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  push:
    runs-on: ubuntu-latest
    needs: [metadata, build]
    strategy:
      matrix:
        python_version:
          - "3.9"
          - "3.10"
          - "3.11"
        python_variant:
          - ""
          - "-slim"

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.metadata.outputs.LATEST_RELEASE }}

      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/artifacts
          pattern: "*-digests"

      - name: Copy digests
        run: |
          mkdir -p /tmp/digests
          cp /tmp/artifacts/${{ matrix.python_version }}${{ matrix.python_variant }}-*-digests/* /tmp/digests

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Generate Image Name
        id: image
        run: |
          echo "IMAGE=${GITHUB_REPOSITORY@L}" >> $GITHUB_OUTPUT

      - name: Generate Tags
        uses: docker/metadata-action@v5
        id: metadata
        with:
          context: git
          images: |
            ${{ github.repository }}
          flavor: |
            suffix=-py${{ matrix.python_version }}${{ matrix.python_variant }},onlatest=true
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create --dry-run $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ steps.image.outputs.IMAGE }}@sha256:%s ' *)
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ steps.image.outputs.IMAGE }}@sha256:%s ' *)

      - name: Generate Tags
        uses: docker/metadata-action@v5
        id: metadata-latest
        if: matrix.python_version == env.LATEST_PYTHON_VERSION
        with:
          context: git
          images: |
            ${{ github.repository }}
          flavor: |
            suffix=${{ matrix.python_variant }},onlatest=true
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}

      - name: Create manifest list and push for latest python version
        if: matrix.python_version == env.LATEST_PYTHON_VERSION
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create --dry-run $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ steps.image.outputs.IMAGE }}@sha256:%s ' *)
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ steps.image.outputs.IMAGE }}@sha256:%s ' *)

      - name: Docker Hub Description
        uses: peter-evans/dockerhub-description@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
          short-description: ${{ github.event.repository.description }}