container.yml

---
name: "Build & Publish Container"

on:
  push:
    branches:
      - main
  pull_request:
  release:
    types:
      - published

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true


jobs:
  docker-publish:
    # This action doesn't need to wait on any other task, it's easy to re-tag if something failed and we're validating
    # the tag here also
    name: Push container image to ghcr.io
    runs-on: ubuntu-latest
    environment:
      name: release
    permissions:
      # For the docker push and the git clone
      packages: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository}}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=sha
            # Semver
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            # disabled if major zero
            type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }}

      - name: "Build and push Docker image"
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          # Reuse the builder
          cache-from: type=gha
          cache-to: type=gha,mode=max
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}