docker.yml

name: Docker

on:
  push:
    branches:
      - main
      - dev
    tags:
      - "v*"
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

permissions:
  contents: read

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-push:
    runs-on: [self-hosted, Linux, X64, arko, typetype]
    timeout-minutes: 45
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.build.outputs.digest }}
      image: ${{ steps.build-info.outputs.image }}
      version: ${{ steps.build-info.outputs.version }}

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          persist-credentials: false

      - name: Isolate Docker credentials
        run: echo "DOCKER_CONFIG=$RUNNER_TEMP/docker-config" >> "$GITHUB_ENV"

      - name: Set up Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
        with:
          bun-version: 1.3.14

      - name: Resolve build metadata
        id: build-info
        run: |
          base_version="$(bun -e 'console.log(require("./package.json").version)')"
          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
            version="${GITHUB_REF_NAME#v}"
          else
            channel="${GITHUB_REF_NAME//[^0-9A-Za-z-]/-}"
            version="$base_version-$channel.$GITHUB_RUN_NUMBER"
          fi
          if [[ "$GITHUB_REF_NAME" == "dev" ]]; then
            image="${REGISTRY}/${GITHUB_REPOSITORY,,}-beta"
          else
            image="${REGISTRY}/${GITHUB_REPOSITORY,,}"
          fi
          {
            echo "image=$image"
            echo "version=$version"
            echo "build-time=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
          } >> "$GITHUB_OUTPUT"

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302
        with:
          images: ${{ steps.build-info.outputs.image }}
          tags: |
            type=sha,prefix=sha-,format=short
            type=ref,event=branch
            type=ref,event=tag
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=latest,enable=${{ github.ref_name == 'dev' }}
            type=raw,value=beta,enable=${{ github.ref_name == 'dev' }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8
        with:
          platforms: arm64
          cache-image: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c

      - name: Build and push
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
        with:
          context: .
          build-args: |
            BUILD_VERSION=${{ steps.build-info.outputs.version }}
            BUILD_REVISION=${{ github.sha }}
            BUILD_TIME=${{ steps.build-info.outputs.build-time }}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: mode=max
          sbom: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

  notify-orchestrator:
    needs: build-and-push
    if: github.ref_name == 'dev' || github.ref_name == 'main' || startsWith(github.ref, 'refs/tags/v')
    runs-on: [self-hosted, Linux, X64, arko, typetype]
    permissions:
      contents: read
    env:
      GH_TOKEN: ${{ secrets.TYPETYPE_ORCHESTRATOR_TOKEN }}
    steps:
      - name: Send image digest
        env:
          DIGEST: ${{ needs.build-and-push.outputs.digest }}
          IMAGE: ${{ needs.build-and-push.outputs.image }}
          VERSION: ${{ needs.build-and-push.outputs.version }}
        run: |
          if [[ "$GITHUB_REF_NAME" == "dev" ]]; then channel="beta"; else channel="stable"; fi
          jq -n \
            --arg channel "$channel" \
            --arg component "token" \
            --arg digest "$DIGEST" \
            --arg image "$IMAGE" \
            --arg revision "$GITHUB_SHA" \
            --arg version "$VERSION" \
            '{event_type:"component-image",client_payload:{channel:$channel,component:$component,digest:$digest,image:$image,revision:$revision,version:$version}}' \
            | gh api --method POST repos/TypeType-Video/TypeType/dispatches --input -