Crystal/.gitea/workflows/publish-image.yml

name: Publish container image
on:
  push:
    tags:
      - "**"
  workflow_dispatch:
    inputs:
      tag:
        description: "dev-<commit SHA> (7-40 lowercase hex characters, matching the selected source); empty uses the checked-out commit"
        required: false
        type: string

permissions:
  contents: read

jobs:
  publish:
    runs-on: docker-build
    container:
      image: node:22-bookworm
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock
    timeout-minutes: 30
    env:
      # Gitea does not implement GitHub's build-summary/artifact service.
      DOCKER_BUILD_SUMMARY: "false"
      DOCKER_BUILD_RECORD_UPLOAD: "false"
    steps:
      - uses: https://github.com/actions/checkout@v4
        with:
          persist-credentials: false

      - name: Resolve and validate image tag
        id: image
        env:
          EVENT_NAME: ${{ github.event_name }}
          GIT_REF: ${{ github.ref }}
          INPUT_TAG: ${{ github.event.inputs.tag || inputs.tag }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
        run: node scripts/image-publication.mjs

      - name: Check registry credentials
        env:
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          test -n "$REGISTRY_USERNAME" || { echo 'Set the REGISTRY_USERNAME Actions secret.'; exit 1; }
          test -n "$REGISTRY_TOKEN" || { echo 'Set the REGISTRY_TOKEN Actions secret (write:package).'; exit 1; }

      - name: Install Docker client and check daemon access
        run: |
          apt-get update
          apt-get install -y --no-install-recommends ca-certificates curl
          install -m 0755 -d /etc/apt/keyrings
          curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
          chmod a+r /etc/apt/keyrings/docker.asc
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" > /etc/apt/sources.list.d/docker.list
          apt-get update
          apt-get install -y --no-install-recommends docker-ce-cli
          docker info

      - name: Set up Buildx
        uses: https://github.com/docker/setup-buildx-action@v3

      - name: Build an image for the runner's architecture
        uses: https://github.com/docker/build-push-action@v6
        with:
          context: .
          load: true
          tags: crystal-smoke:${{ github.run_id }}

      - name: Check the container before publication
        env:
          SMOKE_IMAGE: crystal-smoke:${{ github.run_id }}
        run: |
          container_id=''
          trap '
            if [ -n "$container_id" ]; then docker rm -f "$container_id"; fi
            docker image rm "$SMOKE_IMAGE"
          ' EXIT
          container_id=$(docker run -d --read-only --tmpfs /tmp --cap-drop ALL --security-opt no-new-privileges:true "$SMOKE_IMAGE")
          for _attempt in $(seq 1 30); do
            if docker exec "$container_id" wget -q -O /dev/null http://127.0.0.1:8080/; then
              docker exec "$container_id" wget -q -O /dev/null http://127.0.0.1:8080/sw.js
              exit 0
            fi
            sleep 1
          done
          docker logs "$container_id"
          exit 1

      - name: Log in to Gitea's container registry
        uses: https://github.com/docker/login-action@v3
        with:
          registry: ${{ steps.image.outputs.registry }}
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and publish
        uses: https://github.com/docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ steps.image.outputs.image }}:${{ steps.image.outputs.tag }}
            ${{ steps.image.outputs.image }}:${{ steps.image.outputs.channel }}
          labels: |
            org.opencontainers.image.title=Crystal
            org.opencontainers.image.source=${{ steps.image.outputs.source }}
            org.opencontainers.image.revision=${{ steps.image.outputs.revision }}
            org.opencontainers.image.version=${{ steps.image.outputs.tag }}

      - name: Request production deployment in Dockhand
        if: steps.image.outputs.channel == 'prod'
        env:
          DOCKHAND_WEBHOOK_URL: ${{ secrets.DOCKHAND_PROD_WEBHOOK_URL }}
          DOCKHAND_WEBHOOK_SECRET: ${{ secrets.DOCKHAND_PROD_WEBHOOK_SECRET }}
        run: node scripts/notify-dockhand.mjs

      - name: Request test deployment in Dockhand
        if: steps.image.outputs.channel == 'dev'
        env:
          DOCKHAND_WEBHOOK_URL: ${{ secrets.DOCKHAND_DEV_WEBHOOK_URL }}
          DOCKHAND_WEBHOOK_SECRET: ${{ secrets.DOCKHAND_DEV_WEBHOOK_SECRET }}
        run: node scripts/notify-dockhand.mjs