ci-docker.yaml

name: CI Docker

on:
  push:
    branches:
    - main
    - feature/*
  pull_request:
    branches:
    - main
  schedule:
  - cron: 0 23 * * 6
  workflow_dispatch:
    inputs:
      publish-image:
        description: Publish a docker image
        required: true
        default: false
        type: boolean

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true
env:
  PLATFORMS: linux/arm64,linux/amd64
  PUBLISH_IMAGE: ${{ (github.event_name == 'push' && github.ref_name == 'main') || github.event.inputs.publish-image == 'true' }}
jobs:
  changes:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
    - name: Checkout
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
    - name: Paths Filter
      uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
      id: filter
      with:
        token: ${{ secrets.GITHUB_TOKEN }}
        base: ${{ github.event.pull_request.base.ref || github.base_ref || github.ref }}
        filters: |
          shared: &shared
            - 'home/.chezmoi*'
            - 'home/.chezmoiscripts/universal/**'
            - 'home/.chezmoitemplates/universal/**'
            - 'home/dot_*/**'
            - 'home/private_dot_*/**'
            - 'install.sh'
            - '.github/workflows/ci-docker.yaml'
          archlinux:
            - *shared
            - 'home/.chezmoiscripts/archlinux/*'
            - 'home/.chezmoitemplates/archlinux/*'
            - 'containers/archlinux/**/*'
          ubuntu:
            - *shared
            - 'home/.chezmoiscripts/ubuntu/*'
            - 'home/.chezmoitemplates/ubuntu/*'
            - 'containers/ubuntu/Dockerfile'
    - name: Set Matrix
      id: set-matrix
      run: |
        MATRIX=$(echo '${{ steps.filter.outputs.changes }}' | jq -c 'del(.[] | select(. == "shared")) | {os: select(length > 0) }')
        echo matrix="$MATRIX" >> $GITHUB_OUTPUT
  docker-build:
    needs: [changes]
    if: ${{ needs.changes.outputs.matrix != '' && needs.changes.outputs.matrix != '[]' }}
    strategy:
      matrix: ${{ fromJSON(needs.changes.outputs.matrix) }}
      fail-fast: false
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    services:
      registry:
        image: registry:2
        ports:
        - 5000:5000
    steps:
    - name: Checkout
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
    - name: Set up QEMU
      uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3
    - name: Setup Docker Buildx
      id: buildx
      uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3
      with:
        driver-opts: network=host
        install: true
        platforms: ${{ env.PLATFORMS }}
    - name: Cache Docker Layers
      uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
      with:
        path: /tmp/.buildx-cache
        key: ${{ matrix.os }}-buildx-${{ github.sha }}
        restore-keys: |
          ${{ matrix.os }}-buildx
    - name: Login to DockerHub
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
    - name: Login to GitHub Container Registry
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Build and Export to Local Docker Registry
      uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
      with:
        file: containers/${{ matrix.os }}/Dockerfile
        context: .
        push: true
        platforms: ${{ env.PLATFORMS }}
        tags: localhost:5000/${{ matrix.os }}:latest
        secrets: |
          "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}"
        builder: ${{ steps.buildx.outputs.name }}
        cache-from: type=local,src=/tmp/.buildx-cache
        cache-to: type=local,mode=max,dest=/tmp/.buildx-cache-new
    - name: Run Tests amd64
      run: docker run --rm --platform amd64 localhost:5000/${{ matrix.os }}:latest /home/devcontainer/.local/bin/check-dotfiles
    - name: Run Tests arm64
      run: docker run --rm --platform arm64 localhost:5000/${{ matrix.os }}:latest /home/devcontainer/.local/bin/check-dotfiles
    - name: Generate Image Metadata
      id: metadata
      uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81   # v5
      with:
        images: |
          ghcr.io/${{ github.repository }}
          docker.io/${{ github.repository }}
        tags: |
          type=schedule,prefix=${{ matrix.os }}-,pattern={{date 'YYYYMMDD'}}
          type=raw,value=${{ matrix.os }},enable={{is_default_branch}}
        flavor: latest=${{ github.ref_name == 'main' && contains(matrix.os, 'ubuntu') }}
    - name: Push Image
      uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
      with:
        file: containers/${{ matrix.os }}/Dockerfile
        context: .
        push: ${{ env.PUBLISH_IMAGE }}
        platforms: ${{ env.PLATFORMS }}
        tags: ${{ steps.metadata.outputs.tags }}
        labels: ${{ steps.metadata.outputs.labels }}
        secrets: |
          "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}"
        builder: ${{ steps.buildx.outputs.name }}
        cache-from: type=local,src=/tmp/.buildx-cache
        cache-to: type=local,mode=max,dest=/tmp/.buildx-cache-new
    - name: Move Docker Cache
      run: |
        rm -rf /tmp/.buildx-cache
        mv /tmp/.buildx-cache-new /tmp/.buildx-cache