docker.yml

name: Docker

on:
  push:
    branches: [main, release/**]
  pull_request:
  release:
    types: [published]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_protected == 'true' && github.sha || github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

env:
  REGISTRY_IMAGE: stellar/stellar-cli

jobs:

  complete:
    if: always()
    needs: [build, merge]
    runs-on: ubuntu-latest
    steps:
    - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
      run: exit 1

  build:
    strategy:
      fail-fast: false
      matrix:
        include:
        - runs-on: ubuntu-latest-16-cores
          platform: linux/amd64
        - runs-on: ubuntu-jammy-16-cores-arm64
          platform: linux/arm64
    runs-on: ${{ matrix.runs-on }}
    steps:
    - name: Prepare
      run: |
        platform=${{ matrix.platform }}
        echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

    - name: Docker meta
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY_IMAGE }}
        tags: |
          type=sha
          type=raw,value={{tag}}

    # QEMU is needed if building arm64 on amd64, but it is commented because the
    # build is currently configured to build each natively.
    # - name: Set up QEMU
    #   uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Build
      uses: docker/build-push-action@v6
      with:
        platforms: ${{ matrix.platform }}
        labels: ${{ steps.meta.outputs.labels }}
        outputs: type=docker,dest=/tmp/myimage.tar

    - name: Login to Docker Hub
      if: github.event_name == 'release' && github.event.action == 'published'
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Push by digest
      if: github.event_name == 'release' && github.event.action == 'published'
      id: push
      uses: docker/build-push-action@v6
      with:
        platforms: ${{ matrix.platform }}
        labels: ${{ steps.meta.outputs.labels }}
        outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true

    - name: Export digest
      if: github.event_name == 'release' && github.event.action == 'published'
      run: |
        mkdir -p /tmp/digests
        digest="${{ steps.push.outputs.digest }}"
        touch "/tmp/digests/${digest#sha256:}"

    - name: Upload digest
      if: github.event_name == 'release' && github.event.action == 'published'
      uses: actions/upload-artifact@v4
      with:
        name: digests-${{ env.PLATFORM_PAIR }}
        path: /tmp/digests/*
        if-no-files-found: error
        retention-days: 1

  merge:
    if: github.event_name == 'release' && github.event.action == 'published'
    needs: [build]
    runs-on: ubuntu-latest
    steps:
    - name: Download digests
      uses: actions/download-artifact@v4
      with:
        path: /tmp/digests
        pattern: digests-*
        merge-multiple: true

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Docker meta
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY_IMAGE }}

    - name: Login to Docker Hub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Create manifest list and push
      working-directory: /tmp/digests
      run: |
        docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
          $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)

    - name: Inspect image
      run: |
        docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}