main.yml

name: Docker
on:
  push:
    branches:
    - main
  # We want to periodically update the base image for security
  schedule:
    # min hour dom month dow
    - cron: '22 3 * * 1'
  workflow_dispatch:
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:

    - name: Checkout repository
      uses: actions/checkout@v6

    - name: Figure out version tag & created date
      id: vars
      run: |
        set -x
        eval $( cat Dockerfile | sed -n -e 's/ARG \(cpp\|proton\)=/QPID_\U\1_VERSION=/p' )
        echo "tag=$QPID_CPP_VERSION-$QPID_PROTON_VERSION" >> $GITHUB_OUTPUT
        echo "created=$(date --utc +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_OUTPUT

    - name: Set up QEMU
      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

    - name: Log in to Docker Hub
      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
      if: github.ref == 'refs/heads/main'
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Log in to the Container registry
      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build the image
      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
      with:
        context: .
        push: true
        tags: |
          ghcr.io/okoko/qpid-cpp:${{ steps.vars.outputs.tag }}
          ghcr.io/okoko/qpid-cpp:latest
          okoko/qpid-cpp:${{ steps.vars.outputs.tag }}
          okoko/qpid-cpp:latest
        platforms: linux/amd64,linux/arm64
        labels: ${{ steps.meta.outputs.labels }}
        build-args: |
          CREATED=${{ steps.vars.outputs.created }}
          SOURCE_COMMIT=${{ github.sha }}
        # https://docs.docker.com/build/ci/github-actions/cache/
        cache-from: type=gha
        cache-to: type=gha,mode=max

    # With org.opencontainers.image.source pointing to this repository Dockerfile FROM updates in pull requests can be scanned
    # if the commits have matching tags with the image.
    # https://github.blog/changelog/2023-04-13-dependabot-now-supports-fetching-release-notes-and-changelogs-for-docker-images/
    # https://octokit.github.io/rest.js/v19#git-create-ref
    # https://octokit.github.io/rest.js/v19#git-update-ref
    - name: Tag the commit or update tag
      if: github.ref == 'refs/heads/main'
      uses: actions/github-script@v9
      with:
        script: |
          try {
            await github.rest.git.createRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: 'refs/tags/${{ steps.vars.outputs.tag }}',
              sha: context.sha,
            });
          } catch(e) {
            if (e.status === 422) {
              await github.rest.git.updateRef({
                owner: context.repo.owner,
                repo: context.repo.repo,
                ref: 'tags/${{ steps.vars.outputs.tag }}',
                sha: context.sha,
                force: true,
              });
            }
          }

  # Can not use Personal Access Token to update the README. Returns FORBIDDEN.
  describe:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:

    - name: Checkout repository
      uses: actions/checkout@v6

    - name: Docker Hub Description
      uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
        repository: okoko/qpid-cpp