Termix/.github/workflows/docker.yml

name: Build and Push Docker Image

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to build (e.g., 26.10.0)"
        required: true
      build_type:
        description: "Build type"
        required: true
        default: "Development"
        type: choice
        options:
          - Development
          - Beta
          - Production
      source_ref:
        description: "Git ref/SHA to build (defaults to the workflow ref)"
        required: false
        default: ""
  workflow_call:
    inputs:
      version:
        description: "Version to build (e.g., 26.10.0)"
        required: true
        type: string
      build_type:
        description: "Build type (Development, Beta or Production)"
        required: true
        type: string
      dry_run:
        description: "Build the image but do not push to any registry"
        required: false
        type: boolean
        default: false
      source_ref:
        description: "Git ref/SHA to build"
        required: false
        type: string
        default: ""

jobs:
  # One image per plugin profile (docker/bundled-plugins.json). standard keeps
  # the plain tags; minimal and full add a suffix.
  build:
    runs-on: blacksmith-8vcpu-ubuntu-2404
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        profile: [standard, minimal, full]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.source_ref || github.ref }}
          fetch-depth: 1

      - name: Resolve source revision
        run: |
          echo "SOURCE_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
          echo "BUILD_CREATED=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"

      # The image reads its version from package.json, so a beta has to say so.
      - name: Stamp beta version
        if: ${{ inputs.build_type == 'Beta' }}
        run: node scripts/sync-version.cjs --version "${{ inputs.version }}"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        with:
          platforms: linux/amd64,linux/arm64

      - name: Setup Docker Buildx
        uses: useblacksmith/setup-docker-builder@v2
        with:
          cache-key: termix-ssh/termix

      - name: Determine tags
        id: tags
        run: |
          VERSION=${{ inputs.version }}
          BUILD_TYPE=${{ inputs.build_type }}

          TAGS=()
          ALL_TAGS=()

          SUFFIX=""
          if [ "${{ matrix.profile }}" != "standard" ]; then
            SUFFIX="-${{ matrix.profile }}"
          fi

          if [ "$BUILD_TYPE" = "Production" ]; then
            TAGS+=("$VERSION$SUFFIX" "latest$SUFFIX")
          elif [ "$BUILD_TYPE" = "Beta" ]; then
            TAGS+=("beta$SUFFIX" "$VERSION$SUFFIX")
          else
            TAGS+=("dev-$VERSION$SUFFIX")
          fi

          for tag in "${TAGS[@]}"; do
            ALL_TAGS+=("ghcr.io/lukegus/termix:$tag")
            ALL_TAGS+=("ghcr.io/termix-ssh/termix:$tag")
            if [ "$BUILD_TYPE" != "Development" ]; then
              ALL_TAGS+=("docker.io/bugattiguy527/termix:$tag")
            fi
          done

          echo "ALL_TAGS=$(IFS=,; echo "${ALL_TAGS[*]}")" >> $GITHUB_ENV
          echo "TAGS=${TAGS[*]}" >> $GITHUB_ENV

      - name: Login to GHCR
        if: ${{ !inputs.dry_run }}
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: lukegus
          password: ${{ secrets.TERMIX_PAT }}

      - name: Login to Docker Hub (prod and beta only)
        if: ${{ (inputs.build_type == 'Production' || inputs.build_type == 'Beta') && !inputs.dry_run }}
        uses: docker/login-action@v4
        with:
          username: bugattiguy527
          password: ${{ secrets.DOCKERHUB_BUGATTIGUY527_TOKEN }}

      - name: Build and push multi-arch image
        uses: useblacksmith/build-push-action@v2
        with:
          context: .
          file: ./docker/Dockerfile
          push: ${{ !inputs.dry_run }}
          platforms: linux/amd64,linux/arm64
          tags: ${{ env.ALL_TAGS }}
          build-args: |
            BUILDKIT_CONTEXT_KEEP_GIT_DIR=1
            PLUGIN_PROFILE=${{ matrix.profile }}
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ env.SOURCE_SHA }}
            org.opencontainers.image.created=${{ env.BUILD_CREATED }}
          outputs: ${{ inputs.dry_run && 'type=cacheonly' || 'type=registry,compression=zstd' }}

      - name: Login to Docker Hub as termixssh
        id: termix_hub
        if: ${{ (inputs.build_type == 'Production' || inputs.build_type == 'Beta') && !inputs.dry_run }}
        env:
          TOKEN: ${{ secrets.DOCKERHUB_TERMIXSSH_TOKEN }}
        run: |
          if [ -z "$TOKEN" ]; then
            echo "DOCKERHUB_TERMIXSSH_TOKEN is not set, skipping docker.io/termixssh"
            exit 0
          fi
          echo "$TOKEN" | docker login docker.io --username termixssh --password-stdin
          echo "ready=true" >> "$GITHUB_OUTPUT"

      - name: Copy image to docker.io/termixssh
        if: ${{ steps.termix_hub.outputs.ready == 'true' }}
        run: |
          for tag in $TAGS; do
            docker buildx imagetools create --tag "docker.io/termixssh/termix:$tag" "ghcr.io/termix-ssh/termix:$tag"
          done

      - name: Cleanup Docker
        if: always()
        run: |
          docker image prune -af
          docker system prune -af --volumes