headroom/.github/workflows/docker.yml

name: Docker

on:
  workflow_call:
    inputs:
      version:
        description: "Version to stamp into the image contents and exact image tag"
        required: false
        type: string
      enable_ref_tags:
        description: "Whether to emit branch/PR ref tags"
        required: false
        default: true
        type: boolean
  workflow_dispatch:
    inputs:
      version:
        description: "Version to stamp into the image contents and exact image tag"
        required: false
  release:
    types: [published]

env:
  REGISTRY: ghcr.io

permissions:
  contents: read
  packages: write
  id-token: write # For cosign keyless signing via Sigstore OIDC

jobs:
  docker-variant-tags:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - variant: ""
            bake_target: runtime
          - variant: nonroot
            bake_target: runtime-nonroot
          - variant: code
            bake_target: runtime-code
          - variant: code-nonroot
            bake_target: runtime-code-nonroot
          - variant: slim
            bake_target: runtime-slim
          - variant: slim-nonroot
            bake_target: runtime-slim-nonroot
          - variant: code-slim
            bake_target: runtime-code-slim
          - variant: code-slim-nonroot
            bake_target: runtime-code-slim-nonroot

    steps:
      - uses: actions/checkout@v6

      - name: Normalize image name
        id: image-name
        run: |
          image_name="$(printf '%s' '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
          printf 'image_name=%s\n' "$image_name" >> "$GITHUB_OUTPUT"

      - name: Determine image version
        id: version
        env:
          MANUAL_VERSION: ${{ inputs.version || github.event.inputs.version }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          version="${MANUAL_VERSION#v}"
          if [ -z "$version" ] && [ -n "$RELEASE_TAG" ]; then
            version="${RELEASE_TAG#v}"
          fi
          printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"

      - name: Set up Python
        if: steps.version.outputs.version != ''
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Sync versioned files for image build
        if: steps.version.outputs.version != ''
        run: |
          python scripts/version-sync.py --version ${{ steps.version.outputs.version }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (variant)
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ steps.image-name.outputs.image_name }}
          tags: |
            type=ref,event=branch,enable=${{ inputs.enable_ref_tags }},suffix=${{ matrix.variant != '' && format('-{0}', matrix.variant) || '' }}
            type=ref,event=pr,enable=${{ inputs.enable_ref_tags }},suffix=${{ matrix.variant != '' && format('-{0}', matrix.variant) || '' }}
            type=raw,value=${{ steps.version.outputs.version }},enable=${{ steps.version.outputs.version != '' }},suffix=${{ matrix.variant != '' && format('-{0}', matrix.variant) || '' }}
            type=semver,pattern={{version}},suffix=${{ matrix.variant != '' && format('-{0}', matrix.variant) || '' }}
            type=semver,pattern={{major}}.{{minor}},suffix=${{ matrix.variant != '' && format('-{0}', matrix.variant) || '' }}
            type=semver,pattern={{major}},suffix=${{ matrix.variant != '' && format('-{0}', matrix.variant) || '' }}
            type=sha,prefix=${{ matrix.variant != '' && format('{0}-', matrix.variant) || 'sha-' }}
            type=raw,value=${{ matrix.variant }},enable=${{ matrix.variant != '' }}
            type=raw,value=latest,enable=${{ matrix.variant == '' }}

      - name: Build and push variant (bake)
        id: bake
        uses: docker/bake-action@v7
        with:
          files: |
            ./docker-bake.hcl
            cwd://${{ steps.meta.outputs.bake-file-tags }}
            cwd://${{ steps.meta.outputs.bake-file-labels }}
          targets: ${{ matrix.bake_target }}
          push: true
          set: |
            *.cache-from=type=gha
            *.cache-to=type=gha,mode=max

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign images with cosign (keyless via Sigstore OIDC)
        env:
          BAKE_META: ${{ steps.bake.outputs.metadata }}
        run: |
          # Extract all pushed image digests from bake metadata and sign each
          echo "$BAKE_META" | jq -r '
            to_entries[].value."containerimage.digest" // empty
          ' | while read -r digest; do
            image="${{ env.REGISTRY }}/${{ steps.image-name.outputs.image_name }}@${digest}"
            echo "Signing ${image}"
            cosign sign --yes "${image}"
          done