docker-publish.yml

name: Publish Docker Images

on:
  release:
    types: [published]
  push:
    branches: [main]
    paths:
      - "*.Dockerfile"
      - "apps/**"
      - "packages/**"
      - ".github/workflows/docker-publish.yml"
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ghcr.io/databuddy-analytics/databuddy

jobs:
  build:
    name: Build ${{ matrix.service }} (${{ matrix.platform }})
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        service: [api, basket, links, uptime]
        platform: [linux/amd64, linux/arm64]
        include:
          - service: api
            description: "Databuddy API service - analytics backend"
          - service: basket
            description: "Databuddy Basket service - event ingestion"
          - service: links
            description: "Databuddy Links service - URL shortening and tracking"
          - service: uptime
            description: "Databuddy Uptime service - availability monitoring"

    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-qemu-action@v3
        if: matrix.platform != 'linux/amd64'

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract arch slug
        id: platform
        run: echo "arch=${PLATFORM##*/}" >> "$GITHUB_OUTPUT"
        env:
          PLATFORM: ${{ matrix.platform }}

      - name: Determine version tag
        id: version
        env:
          EVENT_NAME: ${{ github.event_name }}
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          if [[ "$EVENT_NAME" == "release" ]]; then
            echo "tag=$TAG_NAME" >> "$GITHUB_OUTPUT"
          else
            echo "tag=edge" >> "$GITHUB_OUTPUT"
          fi

      - name: Capture build date
        id: builddate
        run: echo "timestamp=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT"

      - name: Extract metadata (labels)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_PREFIX }}-${{ matrix.service }}
          labels: |
            org.opencontainers.image.title=databuddy-${{ matrix.service }}
            org.opencontainers.image.description=${{ matrix.description }}
            org.opencontainers.image.vendor=Databuddy Analytics
            org.opencontainers.image.licenses=AGPL-3.0

      - uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.service }}.Dockerfile
          push: true
          platforms: ${{ matrix.platform }}
          provenance: false
          labels: ${{ steps.meta.outputs.labels }}
          tags: ${{ env.IMAGE_PREFIX }}-${{ matrix.service }}:${{ steps.version.outputs.tag }}-${{ steps.platform.outputs.arch }}
          build-args: |
            VERSION=${{ steps.version.outputs.tag }}
            BUILD_DATE=${{ steps.builddate.outputs.timestamp }}
            GIT_SHA=${{ github.sha }}
          cache-from: type=gha,scope=${{ matrix.service }}-${{ steps.platform.outputs.arch }}
          cache-to: type=gha,mode=max,scope=${{ matrix.service }}-${{ steps.platform.outputs.arch }}

  manifest:
    name: Publish ${{ matrix.service }} manifest
    needs: build
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      packages: write
    strategy:
      matrix:
        service: [api, basket, links, uptime]

    steps:
      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine version tag
        id: version
        env:
          EVENT_NAME: ${{ github.event_name }}
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          if [[ "$EVENT_NAME" == "release" ]]; then
            echo "tag=$TAG_NAME" >> "$GITHUB_OUTPUT"
            echo "is_release=true" >> "$GITHUB_OUTPUT"
          else
            echo "tag=edge" >> "$GITHUB_OUTPUT"
            echo "is_release=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Create multi-arch manifest
        run: |
          IMAGE="${{ env.IMAGE_PREFIX }}-${{ matrix.service }}"
          TAG="${{ steps.version.outputs.tag }}"
          SHA_SHORT="${{ github.sha }}"
          SHA_SHORT="${SHA_SHORT:0:7}"

          # Create manifest with version tag
          docker buildx imagetools create \
            --tag "$IMAGE:$TAG" \
            --tag "$IMAGE:sha-$SHA_SHORT" \
            "$IMAGE:$TAG-amd64" \
            "$IMAGE:$TAG-arm64"

          # Add latest tag only for releases
          if [[ "${{ steps.version.outputs.is_release }}" == "true" ]]; then
            docker buildx imagetools create \
              --tag "$IMAGE:latest" \
              "$IMAGE:$TAG-amd64" \
              "$IMAGE:$TAG-arm64"
          fi

      - name: Verify manifest
        run: |
          IMAGE="${{ env.IMAGE_PREFIX }}-${{ matrix.service }}"
          TAG="${{ steps.version.outputs.tag }}"
          echo "Inspecting $IMAGE:$TAG"
          docker buildx imagetools inspect "$IMAGE:$TAG"