docker.yml

# Dedicated-server Docker image (game server + admin/portal/download UI in one Linux container).
#
# Two entry points:
#   * workflow_dispatch — build it by hand from the Actions tab (build-validate by default; set `push`
#     to publish to GHCR).
#   * workflow_call     — reused by release.yml so a tagged release also builds + pushes the image to
#     GHCR (tagged with the release version and `latest`). See docs/developer/SELF_HOSTING.md §10.

name: Docker

on:
  workflow_dispatch:
    inputs:
      push:
        description: "Push the image to GHCR (ghcr.io). Leave off to only build/validate."
        type: boolean
        default: false
      tag:
        description: "Image tag to apply (e.g. dev, 0.1.0)."
        type: string
        default: dev
      latest:
        description: "Also tag the pushed image as :latest."
        type: boolean
        default: false
      platforms:
        description: "Target platforms."
        type: string
        default: linux/amd64
  workflow_call:
    inputs:
      push:
        type: boolean
        default: false
      tag:
        type: string
        default: dev
      latest:
        type: boolean
        default: false
      platforms:
        type: string
        default: linux/amd64

permissions:
  contents: read
  packages: write

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: true

jobs:
  image:
    name: Build dedicated-server image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      # Build the image tag list. The owner is lowercased — GHCR repository names must be lowercase, but
      # github.repository_owner can contain uppercase letters.
      - name: Compute image name + tags
        id: img
        run: |
          name="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/blocks-beyond-the-stars-server"
          {
            echo "tags<<EOF"
            echo "${name}:${{ inputs.tag }}"
            if [ "${{ inputs.latest }}" = "true" ]; then echo "${name}:latest"; fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      # QEMU only matters for cross-architecture emulation. release.yml asks for linux/amd64,linux/arm64
      # so it is genuinely needed there, but the workflow_dispatch default is linux/amd64 only — a native
      # build on an amd64 runner, where installing QEMU cost ~30 s and left three duplicate 30 MB binfmt
      # entries in the repo cache budget for nothing (#532).
      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
        if: ${{ contains(inputs.platforms, 'arm') || contains(inputs.platforms, 'ppc') || contains(inputs.platforms, 's390') || contains(inputs.platforms, 'riscv') }}
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Log in to GHCR
        if: ${{ inputs.push }}
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build (and optionally push)
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: ./Dockerfile
          platforms: ${{ inputs.platforms }}
          push: ${{ inputs.push }}
          tags: ${{ steps.img.outputs.tags }}
          # Bake the version into the server assemblies so /bump-forwarded and crash reports carry the
          # release version instead of the .NET default 1.0.0 (release.yml passes the tag as `tag`).
          build-args: |
            VERSION=${{ inputs.tag }}
          # `scope` keeps the four image workflows (docker, worldhost-image, reports-image, ai-image) in
          # separate cache namespaces. They previously shared one unscoped `type=gha` namespace and evicted
          # each other's layers on every push (#529).
          cache-from: type=gha,scope=dedicated-server
          # Only non-tag runs export the layer cache: this workflow is workflow_call'ed by release.yml
          # on tag refs, and tag-scoped caches are unreadable by every other ref — they only crowded
          # main's caches out of the 10 GB budget. Tag runs still import via cache-from.
          #
          # mode=min, not mode=max: mode=max exported every intermediate SDK/restore/build layer, which grew
          # to ~3.27 GB across ~24 blobs — 64 % of the repo's entire 10 GB cache budget — and churned on
          # every push, LRU-evicting the Unity Library cache that actually saves release wall-clock (#529).
          cache-to: ${{ startsWith(github.ref, 'refs/tags/') && ' ' || 'type=gha,mode=min,scope=dedicated-server' }}