docker-publish.yml

name: Publish Docker Images

on:
  release:
    types: [published]
  push:
    branches: [main]
    paths:
      - "*.Dockerfile"
      - "apps/**"
      - "packages/**"
      - ".github/workflows/docker-publish.yml"
  workflow_dispatch:

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name != 'release' }}

env:
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ghcr.io/databuddy-analytics/databuddy

jobs:
  build:
    name: Build ${{ matrix.service }} (${{ matrix.platform.arch }})
    runs-on: ${{ matrix.platform.runner }}
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        service: [api, basket, links, uptime]
        platform:
          - arch: amd64
            os: linux/amd64
            runner: blacksmith-4vcpu-ubuntu-2404
          - arch: arm64
            os: linux/arm64
            runner: blacksmith-4vcpu-ubuntu-2404-arm
        include:
          - service: api
            description: "Databuddy API service - analytics backend"
          - service: basket
            description: "Databuddy Basket service - event ingestion"
          - service: links
            description: "Databuddy Links service - URL shortening and tracking"
          - service: uptime
            description: "Databuddy Uptime service - availability monitoring"

    steps:
      - uses: actions/checkout@v4

      - name: Mount Docker build cache
        uses: useblacksmith/stickydisk@v1
        with:
          key: ${{ github.repository }}-${{ matrix.service }}-${{ matrix.platform.arch }}
          path: /tmp/docker-build-cache

      - name: Set up Docker Builder
        uses: useblacksmith/setup-docker-builder@v1

      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine version tag
        id: version
        env:
          EVENT_NAME: ${{ github.event_name }}
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          if [[ "$EVENT_NAME" == "release" ]]; then
            echo "tag=$TAG_NAME" >> "$GITHUB_OUTPUT"
          else
            echo "tag=edge" >> "$GITHUB_OUTPUT"
          fi

      - name: Capture build date
        id: builddate
        run: echo "timestamp=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT"

      - name: Extract metadata (labels)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_PREFIX }}-${{ matrix.service }}
          labels: |
            org.opencontainers.image.title=databuddy-${{ matrix.service }}
            org.opencontainers.image.description=${{ matrix.description }}
            org.opencontainers.image.vendor=Databuddy Analytics
            org.opencontainers.image.licenses=AGPL-3.0

      - uses: useblacksmith/build-push-action@v2
        with:
          context: .
          file: ${{ matrix.service }}.Dockerfile
          push: true
          platforms: ${{ matrix.platform.os }}
          provenance: false
          labels: ${{ steps.meta.outputs.labels }}
          tags: ${{ env.IMAGE_PREFIX }}-${{ matrix.service }}:${{ steps.version.outputs.tag }}-${{ matrix.platform.arch }}
          build-args: |
            VERSION=${{ steps.version.outputs.tag }}
            BUILD_DATE=${{ steps.builddate.outputs.timestamp }}
            GIT_SHA=${{ github.sha }}
          cache-from: type=gha,scope=${{ matrix.service }}-${{ matrix.platform.arch }}
          cache-to: type=gha,mode=max,scope=${{ matrix.service }}-${{ matrix.platform.arch }}

  manifest:
    name: Publish ${{ matrix.service }} manifest
    needs: build
    runs-on: blacksmith-2vcpu-ubuntu-2404
    permissions:
      packages: write
    strategy:
      matrix:
        service: [api, basket, links, uptime]

    steps:
      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine version tag
        id: version
        env:
          EVENT_NAME: ${{ github.event_name }}
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          if [[ "$EVENT_NAME" == "release" ]]; then
            echo "tag=$TAG_NAME" >> "$GITHUB_OUTPUT"
            echo "is_release=true" >> "$GITHUB_OUTPUT"
          else
            echo "tag=edge" >> "$GITHUB_OUTPUT"
            echo "is_release=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Create multi-arch manifest
        run: |
          IMAGE="${{ env.IMAGE_PREFIX }}-${{ matrix.service }}"
          TAG="${{ steps.version.outputs.tag }}"
          SHA_SHORT="${{ github.sha }}"
          SHA_SHORT="${SHA_SHORT:0:7}"

          docker buildx imagetools create \
            --tag "$IMAGE:$TAG" \
            --tag "$IMAGE:sha-$SHA_SHORT" \
            "$IMAGE:$TAG-amd64" \
            "$IMAGE:$TAG-arm64"

          if [[ "${{ steps.version.outputs.is_release }}" == "true" ]]; then
            docker buildx imagetools create \
              --tag "$IMAGE:latest" \
              "$IMAGE:$TAG-amd64" \
              "$IMAGE:$TAG-arm64"
          fi

      - name: Verify manifest
        run: |
          IMAGE="${{ env.IMAGE_PREFIX }}-${{ matrix.service }}"
          TAG="${{ steps.version.outputs.tag }}"
          echo "Inspecting $IMAGE:$TAG"
          docker buildx imagetools inspect "$IMAGE:$TAG"