FreshRSS/.github/workflows/docker-publish.yml

name: Publish Docker images

on:
  push:
    branches:
      - edge
  release:
    types: [published]
  workflow_dispatch:

# To ensure that if the latest push finishes faster than an earlier run, the previous run won't
# overwrite it later. (by queueing the runs)
concurrency:
  group: docker-publish-${{ github.ref_name }} # e.g. docker-publish-edge, docker-publish-latest, docker-publish-1.29.1
  cancel-in-progress: false

permissions: {}

jobs:
  build-container-image:
    name: Build Docker image ${{ matrix.name }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write # For uploading to the GitHub container registry (ghcr.io)
    strategy:
      matrix:
        include:
          - name: Debian
            file: Docker/Dockerfile
            flavor: |
              latest=auto
            tags: |
              type=edge,onlatest=false
              type=semver,pattern={{version}}
              type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/0.') }}
            #  type=semver,pattern={{major}}.{{minor}}
          - name: Alpine
            file: Docker/Dockerfile-Alpine
            flavor: |
              latest=false
            tags: |
              type=raw,value=alpine,enable=${{ github.ref == 'refs/heads/latest' || startsWith(github.ref, 'refs/tags/') }}
              type=edge,suffix=-alpine,onlatest=false
              type=semver,pattern={{version}}-alpine
              type=semver,pattern={{major}}-alpine,enable=${{ !startsWith(github.ref, 'refs/tags/0.') }}
            #  type=semver,pattern={{major}}.{{minor}}-alpine
    steps:
    - name: Login to Docker Hub
      if: github.repository_owner == 'FreshRSS'
      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Set up QEMU
      uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

    - name: Checkout
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: Get FreshRSS version
      run: |
        FRESHRSS_VERSION=$(sed -n "s/^const FRESHRSS_VERSION = '\(.*\)'.*$/\1/p" constants.php)
        echo "$FRESHRSS_VERSION"
        echo "FRESHRSS_VERSION=$FRESHRSS_VERSION" >> $GITHUB_ENV

    - name: Add metadata to Docker images
      id: meta
      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
      with:
        flavor: ${{ matrix.flavor }}
        images: |
          docker.io/freshrss/freshrss
          ghcr.io/${{ github.repository }}
        tags: ${{ matrix.tags }}
        labels: |
          org.opencontainers.image.url=https://freshrss.org/
          org.opencontainers.image.version=${{ env.FRESHRSS_VERSION }}

    - name: Login to GitHub Container Registry
      if: github.repository_owner == 'FreshRSS'
      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build and push Docker images
      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
      with:
        context: . # Switching from git context to path context, needed for .dockerignore to be applied. See: https://github.com/docker/build-push-action#git-context
        file: ${{ matrix.file }}
        platforms: linux/amd64,linux/arm/v7,linux/arm64
        build-args: |
          FRESHRSS_VERSION=${{ env.FRESHRSS_VERSION }}
          SOURCE_COMMIT=${{ github.sha }}
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        push: ${{ (github.ref == 'refs/heads/latest' || github.ref == 'refs/heads/edge' || startsWith(github.ref, 'refs/tags/')) && github.repository_owner == 'FreshRSS' }}
        provenance: mode=max
        sbom: true