multi-runner-build.yml

name: 'Multi-runner container image build'
on:
  workflow_call:
    inputs:
      image:
        description: 'Name of the image'
        type: string
        required: true
      context:
        description: 'Path to build context'
        type: string
        required: true
      dockerfile:
        description: 'Path to Dockerfile'
        type: string
        required: true
      suffixes:
        description: 'Comma-separated list of suffixes to append to the image tag'
        type: string
        default: ''
      dockerhub-push:
        description: 'Push to Docker Hub'
        type: boolean
        default: false
      build-args:
        description: 'Docker build arguments'
        type: string
        required: false
      platforms:
        description: 'Platforms to build for'
        type: string
      runner-mapping:
        description: 'Mapping from platforms to runners'
        type: string
      target:
        description: 'Sets the target stage to build'
        type: string
      release-tag-type:
        description: 'The type of release tag to use, either git-tag or semver'
        type: string
        default: 'semver'
    secrets:
      GITHUB_APP_TOKEN:
        required: false
      DOCKERHUB_USERNAME:
        required: false
      DOCKERHUB_TOKEN:
        required: false
env:
  GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/${{ inputs.image }}
  DOCKERHUB_IMAGE: altran1502/${{ inputs.image }}

jobs:
  matrix:
    name: 'Generate matrix'
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.matrix.outputs.matrix }}
      key: ${{ steps.artifact-key.outputs.base }}
    steps:
      - name: Generate build matrix
        id: matrix
        shell: bash
        env:
          PLATFORMS: ${{ inputs.platforms || 'linux/amd64,linux/arm64' }}
          RUNNER_MAPPING: ${{ inputs.runner-mapping || '{"linux/amd64":"ubuntu-latest","linux/arm64":"ubuntu-24.04-arm"}' }}
        run: |
          matrix=$(jq -R -c \
            --argjson runner_mapping "${RUNNER_MAPPING}" \
            'split(",") | map({platform: ., runner: $runner_mapping[.]})' \
            <<< "${PLATFORMS}")
          echo "matrix=${matrix}" | tee -a $GITHUB_OUTPUT

      - name: Determine artifact key
        id: artifact-key
        shell: bash
        env:
          IMAGE: ${{ inputs.image }}
          SUFFIXES: ${{ inputs.suffixes }}
        run: |
          # Replace commas with hyphens for the artifact key
          suffix_key=$(echo "$SUFFIXES" | tr ',' '-')
          base="${IMAGE}${suffix_key}-digests"
          echo "base=${base}" | tee -a $GITHUB_OUTPUT

  build:
    needs: matrix
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.matrix.outputs.matrix) }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          token: ${{ secrets.GITHUB_APP_TOKEN || github.token }}

      - uses: immich-app/devtools/actions/image-build@259f3f8e3ca1d04dd6164171126f8bce36c8223a # image-build-action-v0.1.7
        with:
          context: ${{ inputs.context }}
          dockerfile: ${{ inputs.dockerfile }}
          image: ${{ env.GHCR_IMAGE }}
          ghcr-token: ${{ secrets.GITHUB_APP_TOKEN || github.token }}
          platform: ${{ matrix.platform }}
          artifact-key-base: ${{ needs.matrix.outputs.key }}
          build-args: ${{ inputs.build-args }}
          target: ${{ inputs.target }}

  merge:
    needs: [matrix, build]
    runs-on: ubuntu-latest
    if: ${{ !github.event.pull_request.head.repo.fork }}
    steps:
      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

      - name: Download digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ${{ runner.temp }}/digests
          pattern: ${{ needs.matrix.outputs.key }}-*
          merge-multiple: true
          github-token: ${{ secrets.GITHUB_APP_TOKEN || github.token }}

      - name: Login to Docker Hub
        if: ${{ inputs.dockerhub-push }}
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GHCR
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_APP_TOKEN || github.token }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Generate docker image tags
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        env:
          DOCKER_METADATA_PR_HEAD_SHA: 'true'
        with:
          flavor: |
            # Disable latest tag
            latest=false
          images: |
            name=${{ env.GHCR_IMAGE }}
            name=${{ env.DOCKERHUB_IMAGE }},enable=${{ inputs.dockerhub-push }}
          tags: |
            # Tag with branch name
            type=ref,event=branch
            # Tag with pr-number
            type=ref,event=pr
            # Tag with long commit sha hash
            type=sha,format=long,prefix=commit-
            # Release version tags
            type=semver,pattern=v{{version}},enabled=${{ inputs.release-tag-type == 'semver' }}
            type=semver,pattern=v{{major}},enabled=${{ inputs.release-tag-type == 'semver' }}
            type=ref,event=tag,enabled=${{ inputs.release-tag-type == 'git-tag' }}
            type=raw,value=release,enable=${{ github.event_name == 'release' }}

      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        env:
          SUFFIXES: ${{ inputs.suffixes }}
        shell: uv run --script {0}
        run: |
          # /// script
          # requires-python = ">=3.11"
          # dependencies = [
          #     "python-on-whales>=0.80.0",
          # ]
          # ///

          from python_on_whales import docker
          import json
          import os

          docker_args = {"annotations": {}, "tags": [], "sources": []}

          metadata_json = json.loads(os.environ.get("DOCKER_METADATA_OUTPUT_JSON", "{}"))

          annotations = metadata_json.get("annotations", [])
          for annotation in annotations:
            annotation = annotation.replace("manifest:", "index:")
            key, value = annotation.split("=", 1)
            docker_args["annotations"][key] = value

          tags = metadata_json.get("tags", [])
          suffixes = os.environ.get("SUFFIXES").split(",")
          print(f"{suffixes=}")
          for suffix in suffixes:
            for tag in tags:
              docker_args["tags"].append(f"{tag}{suffix}")

          ghcr_image = os.environ['GHCR_IMAGE']
          digests = os.listdir(".")
          docker_args["sources"] = [f"{ghcr_image}@sha256:{digest}" for digest in digests]

          print(json.dumps(docker_args))
          docker.buildx.imagetools.create(**docker_args)