irtt-rs/.gitea/workflows/docker-publish.yml

name: Publish irtt-server image

on:
  push:
    tags:
      # This repo tags each crate independently (irtt-proto/vX, irtt-client/vX,
      # ...); only the app package's tag corresponds to this image.
      - "irtt-rs/v*"
  workflow_dispatch:

env:
  IMAGE_NAME: irtt-server
  IMAGE_OWNER: lochnair
  GITEA_REGISTRY: git.lochnair.net
  GHCR_REGISTRY: ghcr.io
  # Pinned so a floating "latest" release doesn't silently change the build.
  CRANE_VERSION: v0.20.2

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Determine image tags
        id: meta
        run: |
          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
            version="${GITHUB_REF_NAME#irtt-rs/v}"
            echo "version=${version}" >> "$GITHUB_OUTPUT"
            echo "tags=${version},latest" >> "$GITHUB_OUTPUT"
          else
            # Manual dispatch off a branch: tag by commit only, never touch
            # "latest", so an ad-hoc build can't clobber the last release.
            version="sha-$(git rev-parse --short HEAD)"
            echo "version=${version}" >> "$GITHUB_OUTPUT"
            echo "tags=${version}" >> "$GITHUB_OUTPUT"
          fi

      # Cross-compilation is handled inside the Dockerfile via tonistiigi/xx
      # (native builds, no emulation), but buildx still needs a driver that
      # can assemble a multi-platform manifest list.
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4

      - name: Log in to Gitea Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.GITEA_REGISTRY }}
          # The automatic per-job token comes back unauthorized for package
          # writes on this instance, so use a PAT (scope: write:package) instead.
          # (Secret names can't start with GITEA_/GITHUB_, hence REGISTRY_*.)
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Log in to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.GHCR_REGISTRY }}
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_TOKEN }}

      - name: Build tag list
        id: tags
        run: |
          IFS=',' read -ra tag_list <<< "${{ steps.meta.outputs.tags }}"
          gitea_tags=""
          for t in "${tag_list[@]}"; do
            gitea_tags="${gitea_tags}${GITEA_REGISTRY}/${IMAGE_OWNER}/${IMAGE_NAME}:${t},"
          done
          echo "gitea=${gitea_tags%,}" >> "$GITHUB_OUTPUT"

      # Gitea is the primary publish target: this is the only build. Every
      # other registry gets an exact digest copy of this same image (see
      # below), never a separate build, so the hash matches everywhere.
      - name: Build and push to Gitea
        id: build
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.tags.outputs.gitea }}

      - name: Install crane
        run: |
          mkdir -p "${HOME}/.local/bin"
          curl -sL "https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/go-containerregistry_Linux_x86_64.tar.gz" \
            | tar -xz -C "${HOME}/.local/bin" crane
          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"

      - name: Duplicate image to GHCR (same digest, no rebuild)
        run: |
          source_ref="${GITEA_REGISTRY}/${IMAGE_OWNER}/${IMAGE_NAME}@${{ steps.build.outputs.digest }}"
          IFS=',' read -ra tag_list <<< "${{ steps.meta.outputs.tags }}"
          for t in "${tag_list[@]}"; do
            crane copy "${source_ref}" "${GHCR_REGISTRY}/${IMAGE_OWNER}/${IMAGE_NAME}:${t}"
          done