docker_publish.yaml

name: Publish Docker Image

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      tags:
        description: "Docker image tags, comma-separated (e.g., latest,v0.1.0)"
        required: false
        default: "latest"

permissions:
  contents: read
  packages: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  # On push to main, inputs.tags is empty, so fall back to "unstable" so it
  # tracks main. Manual dispatch still honors custom tags.
  TAGS_INPUT: ${{ inputs.tags || 'unstable' }}

jobs:
  build-image:
    name: Build Docker image (${{ matrix.arch.name }}, ${{ matrix.variant.name }})
    strategy:
      matrix:
        arch:
          - runner: ubuntu-latest
            name: amd64
          - runner: ubuntu-22.04-arm
            name: arm64
        # Each tag is published twice: once as the regular image and once as a
        # Shadow-simulator-compatible image (tag suffixed "-shadow"). The shadow
        # build args mirror the `shadow-docker-build` Makefile target. LOCKED=
        # builds the shadow variant unlocked (the quinn-udp [patch] is absent
        # from Cargo.lock; see Dockerfile), so -shadow images are not
        # reproducible and should not be treated as equivalent-security
        # artifacts to the regular tags.
        variant:
          - name: default
            suffix: ""
            build_args: ""
          - name: shadow
            suffix: "-shadow"
            build_args: |
              SHADOW=1
              FEATURES=shadow-integration
              NO_DEFAULT_FEATURES=--no-default-features
              LOCKED=
    runs-on: ${{ matrix.arch.runner }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare tags
        id: prep
        env:
          SUFFIX: ${{ matrix.variant.suffix }}
          ARCH: ${{ matrix.arch.name }}
        run: |
          TAGS=""
          IFS=',' read -ra TAG_ARRAY <<< "${TAGS_INPUT}"
          for t in "${TAG_ARRAY[@]}"; do
            TAGS="${TAGS}${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${SUFFIX}-${ARCH},"
          done
          TAGS="${TAGS%,}"  # Remove trailing comma
          echo "tags=${TAGS}" >> $GITHUB_OUTPUT

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          build-args: |
            GIT_COMMIT=${{ github.sha }}
            GIT_BRANCH=${{ github.ref_name }}
            ${{ matrix.variant.build_args }}
          push: true
          tags: ${{ steps.prep.outputs.tags }}
          platforms: linux/${{ matrix.arch.name }}
          cache-from: type=gha,scope=${{ matrix.arch.name }}-${{ matrix.variant.name }}
          cache-to: type=gha,scope=${{ matrix.arch.name }}-${{ matrix.variant.name }},mode=max

  publish-manifest:
    name: Create and push multi-arch manifest
    runs-on: ubuntu-latest
    needs: build-image

    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create multi-arch manifests
        env:
          SHORT_SHA: ${{ github.sha }}
        run: |
          IFS=',' read -ra TAG_ARRAY <<< "${TAGS_INPUT}"
          FIRST_TAG="${TAG_ARRAY[0]}"
          SHORT="${SHORT_SHA::7}"

          # Publish each tag twice: the regular image and its "-shadow" twin.
          # These suffixes must stay in sync with the `variant` matrix suffixes
          # in the build-image job above: a new variant must be added in both.
          for suffix in "" "-shadow"; do
            # First tag also gets an immutable sha-<sha> tag.
            docker buildx imagetools create \
              -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG}${suffix} \
              -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${SHORT}${suffix} \
              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG}${suffix}-amd64 \
              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${FIRST_TAG}${suffix}-arm64

            # Remaining tags.
            for t in "${TAG_ARRAY[@]:1}"; do
              docker buildx imagetools create \
                -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${suffix} \
                ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${suffix}-amd64 \
                ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}${suffix}-arm64
            done
          done