docker.yml

name: docker

on:
  # Temporary - change back to schedule once it is confirmed to work
  pull_request:
#  schedule:
#    - cron: '30 18 * * *'

env:
  CERBERUS_IMAGE_ID: ghcr.io/rems-project/cerberus/cn:release

# Cancelling an in-progress job when a new push is performed causes the CI to
# show up as failed: https://github.com/orgs/community/discussions/8336
# This is noisy. If we want to enable that, we should consider:
# https://github.com/MercuryTechnologies/delete-cancelled-runs
concurrency:
  group: docker-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  deploy-docker:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform: [linux-amd64, linux-arm64]
    permissions:
      packages: write
      contents: read
      attestations: write
      id-token: write
    steps:
    - uses: actions/checkout@v4

    - name: Login to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Build the Docker image
      run: |
        echo "Building ${{env.CERBERUS_IMAGE_ID}}"
        PLATFORM=${{ matrix.platform }} make -f Makefile_docker release_cn
        docker tag cn:release ${{env.CERBERUS_IMAGE_ID}}-${{ matrix.platform }}
    - name: Push the Docker image
      run: docker push ${{env.CERBERUS_IMAGE_ID}}-${{ matrix.platform }}

  combine-docker:
      runs-on: docker:latest
      needs: deploy-docker
      permissions:
        packages: write
        contents: read
        attestations: write
        id-token: write
      steps:
      - uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Pull images
        run: |
          docker pull ${{env.CERBERUS_IMAGE_ID}}-linux-amd64
          docker pull ${{env.CERBERUS_IMAGE_ID}}-linux-arm64
      - name: Create manifest
        run: |
          docker manifest create ${{env.CERBERUS_IMAGE_ID}} ${{env.CERBERUS_IMAGE_ID}}-linux-amd64 ${{env.CERBERUS_IMAGE_ID}}-linux-arm64
          docker manifest inspect ${{env.CERBERUS_IMAGE_ID}}
      - name: Push the Docker image
        run: docker manifest push ${{env.CERBERUS_IMAGE_ID}}