# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
#
# Build the container image and publish it to the GitHub Container Registry
# (ghcr.io/<owner>/<repo>) on every push to main and every version tag.

name: docker

on:
  push:
    branches: [main]
    tags: ["v*"]
  workflow_dispatch:

# One in-flight build per ref; a newer push cancels the older run.
concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write # push to GHCR with the built-in GITHUB_TOKEN

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Only authenticate when we intend to push (not on manual dry-runs of forks).
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Derive image tags and labels
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable={{is_default_branch}}
            type=sha,format=short

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # linux/amd64 only: the image compiles the whole Rust workspace
          # (aws-lc-sys, vendored libgit2), so a QEMU-emulated arm64 build would
          # be prohibitively slow. Add linux/arm64 here with a native arm runner
          # if you need it.
          platforms: linux/amd64
          # A single-arch manifest — skip the extra provenance attestation that
          # otherwise adds an "unknown/unknown" entry to the package listing.
          provenance: false
          cache-from: type=gha
          cache-to: type=gha,mode=max