docker-build.yml

name: Build and Publish Docker Image

on:
  workflow_dispatch: # Allows manual triggering
    inputs:
      force:
        description: "Force a new build"
        required: false
        default: false
        type: boolean

env:
  REGISTRY_IMAGE: ghcr.io/patte/convex-backend

jobs:
  init:
    runs-on: ubuntu-latest
    steps:
      - name: Get latest release tag and check for new release
        id: check_release
        run: |
          RELEASE_TAG=$(curl -s https://api.github.com/repos/get-convex/convex-backend/releases/latest | grep "tag_name" | cut -d\" -f4)
          echo "RELEASE_TAG=$RELEASE_TAG" >> $GITHUB_ENV

          PREVIOUS_TAG=$(docker inspect ${{ env.REGISTRY_IMAGE }}:latest --format '{{ index .Config.Labels "org.opencontainers.image.version" }}' || echo "none")

          if [ -z "$PREVIOUS_TAG" ]; then
            echo "No previous image found. Proceeding with the build of release: $RELEASE_TAG."
          elif [ "${{ github.event.inputs.force }}" == "true" ]; then
            echo "Forced build detected. Proceeding with the build of release: $RELEASE_TAG."
          elif [ "$RELEASE_TAG" == "$PREVIOUS_TAG" ]; then
            echo "No new release detected. Exiting."
            exit 0
          else
            echo "New release detected: $RELEASE_TAG"
          fi
    outputs:
      release_tag: ${{ env.RELEASE_TAG }}

  build:
    needs: init
    strategy:
      fail-fast: false
      matrix:
        platform:
          - linux/amd64
          - linux/arm64
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
            cache-from: type=gha
            cache-to: type=gha,mode=max
          - platform: linux/arm64
            runner: self-hosted
            cache-from:
            cache-to:
    runs-on: ${{ matrix.runner }}
    steps:
      - name: check for new release
        run: |
          if [ -z "${{ needs.init.outputs.release_tag }}" ]; then
            echo "No release tag found. Exiting."
            exit 0
          fi
          echo "RELEASE_TAG=${{ needs.init.outputs.release_tag }}" >> $GITHUB_ENV

      - name: Prepare
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Docker Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
          build-args: |
            RELEASE_TAG=${{ env.RELEASE_TAG }}
          labels: |
            org.opencontainers.image.version=${{ env.RELEASE_TAG }}
          cache-from: ${{ matrix.cache-from }}
          cache-to: ${{ matrix.cache-to }}
          outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    runs-on: ubuntu-latest
    needs: [init, build]
    steps:
      - name: check for new release
        run: |
          if [ -z "${{ needs.init.outputs.release_tag }}" ]; then
            echo "No release tag found. Exiting."
            exit 0
          fi
          echo "RELEASE_TAG=${{ needs.init.outputs.release_tag }}" >> $GITHUB_ENV

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Docker Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Create multi-platform manifest and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create --tag ${{ env.REGISTRY_IMAGE }}:${{ env.RELEASE_TAG }} --tag ${{ env.REGISTRY_IMAGE }}:latest \
            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)

      - name: Create GitHub Release
        id: create_release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          release_name: "Release ${{ env.RELEASE_TAG }}"
          body: |
            This is based on convex-backend's release: [${{ env.RELEASE_TAG }}](https://github.com/get-convex/convex-backend/releases/tag/${{ env.RELEASE_TAG }}).
            New Docker images have been built and are available at the following locations:

            - `${{ env.REGISTRY_IMAGE }}:${{ env.RELEASE_TAG }}`
            - `${{ env.REGISTRY_IMAGE }}:latest`

            [convex-backend on ghcr.io](https://github.com/patte/convex-backend-docker/pkgs/container/convex-backend)
          draft: false
          prerelease: false