docker.yml

name: Docker image

# Build and publish the self-host Docker image — the primary self-host artifact
# (spec/self-hosting.md §10). Experimental until @dwk/server's Node conformance
# column (conformance/status.json) is green. Runs on a published release or on
# manual dispatch, never on ordinary PRs; a plain dispatch builds without pushing
# so the Dockerfile can be validated on demand.

on:
  # Build-only validation when the image inputs change, so a Dockerfile/bundle
  # break is caught on the PR (this workflow otherwise only runs on release).
  pull_request:
    paths:
      - "packages/server/**"
      - "pnpm-lock.yaml"
      - "package.json"
      - ".github/workflows/docker.yml"
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      push:
        description: "Push the image to GHCR (otherwise build only)"
        type: boolean
        default: false

permissions:
  contents: read
  packages: write

jobs:
  image:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Read @dwk/server version
        id: ver
        run: |
          echo "version=$(node -p "require('./packages/server/package.json').version")" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Log in to GHCR
        if: ${{ github.event_name == 'release' || inputs.push == true }}
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build (and push on release / opt-in)
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: packages/server/Dockerfile
          push: ${{ github.event_name == 'release' || inputs.push == true }}
          tags: |
            ghcr.io/${{ github.repository_owner }}/dwk-server:${{ steps.ver.outputs.version }}
            ghcr.io/${{ github.repository_owner }}/dwk-server:experimental