publish-docker.yml

name: publish-docker

# Publishes multi-architecture images to GHCR and Docker Hub.

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing release tag to publish."
        required: true

permissions:
  contents: read

concurrency:
  group: publish-docker-${{ github.ref }}
  cancel-in-progress: false

jobs:

  resolve-version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.clean }}
      ref: ${{ steps.version.outputs.ref }}
    steps:
      - name: 🏷️ Resolve version
        id: version
        env:
          EVENT_NAME: ${{ github.event_name }}
          INPUT_TAG: ${{ inputs.tag }}
          REF_NAME: ${{ github.ref_name }}
          REPO_URL: https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.git
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            RAW="${INPUT_TAG#refs/tags/}"
          else
            RAW="$REF_NAME"
          fi
          CLEAN="${RAW#v}"
          if [[ ! "$CLEAN" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Invalid release tag: $CLEAN" >&2
            exit 1
          fi

          REF_TAG="$RAW"
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            REF_TAG=""
            for candidate in "$RAW" "v$CLEAN" "$CLEAN"; do
              if git ls-remote --exit-code --tags "$REPO_URL" "refs/tags/$candidate" >/dev/null 2>&1; then
                REF_TAG="$candidate"
                break
              fi
            done
            if [ -z "$REF_TAG" ]; then
              echo "No matching release tag found for input: $INPUT_TAG" >&2
              exit 1
            fi
          fi

          echo "clean=$CLEAN" >> "$GITHUB_OUTPUT"
          echo "ref=refs/tags/$REF_TAG" >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ steps.version.outputs.ref }}
          persist-credentials: false

      - name: 🔎 Verify source versions match release tag
        env:
          VERSION: ${{ steps.version.outputs.clean }}
        run: |
          set -euo pipefail
          fail=0
          check() {
            if [ "$2" != "$VERSION" ]; then
              echo "::error::$1 declares version '$2' but the release tag resolves to '$VERSION'"
              fail=1
            fi
          }
          check "socket_basics/version.py" "$(sed -n 's/^__version__ = "\(.*\)"$/\1/p' socket_basics/version.py | head -1)"
          check "socket_basics/__init__.py" "$(sed -n 's/^__version__ = "\(.*\)"$/\1/p' socket_basics/__init__.py | head -1)"
          check "pyproject.toml" "$(sed -n 's/^version = "\(.*\)"$/\1/p' pyproject.toml | head -1)"
          check "action.yml image tag" "$(sed -n 's#.*docker://ghcr.io/socketdev/socket-basics:\([^"]*\)".*#\1#p' action.yml | head -1)"
          if [ "$fail" -ne 0 ]; then
            echo "::error::Bump the version files in the release PR, merge, then re-tag."
            exit 1
          fi
          echo "✅ version.py, pyproject.toml, and action.yml all agree on $VERSION"

  build-test-push:
    name: publish (${{ matrix.image }}, ${{ matrix.arch }})
    needs: resolve-version
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - image: socket-basics
            dockerfile: Dockerfile
            check_set: main
            arch: amd64
            runs_on: ubuntu-latest
          - image: socket-basics
            dockerfile: Dockerfile
            check_set: main
            arch: arm64
            runs_on: ubuntu-24.04-arm
          - image: socket-basics-heavy
            dockerfile: Dockerfile.heavy
            check_set: heavy
            arch: amd64
            runs_on: ubuntu-latest
          - image: socket-basics-heavy
            dockerfile: Dockerfile.heavy
            check_set: heavy
            arch: arm64
            runs_on: ubuntu-24.04-arm
    uses: ./.github/workflows/_docker-pipeline.yml # zizmor: ignore[secrets-inherit]
    with:
      name: ${{ matrix.image }}
      dockerfile: ${{ matrix.dockerfile }}
      context: .
      check_set: ${{ matrix.check_set }}
      runs_on: ${{ matrix.runs_on }}
      arch_label: ${{ matrix.arch }}
      push_name: socket-basics
      push: true
      version: ${{ needs.resolve-version.outputs.version }}
      ref: ${{ needs.resolve-version.outputs.ref }}
    secrets: inherit

  merge-manifests:
    name: merge-manifests (${{ matrix.variant }})
    needs: [resolve-version, build-test-push]
    permissions:
      contents: read
      packages: write
    environment: publish
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - variant: socket-basics
            tag_suffix: ""
          - variant: socket-basics-heavy
            tag_suffix: "-heavy"
    steps:
      - name: ⬇️ Download per-arch digest artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: /tmp/digests
          pattern: digests-${{ matrix.variant }}__*
          merge-multiple: true

      - name: 🔨 Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Login to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Login to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ghcr.io/socketdev/socket-basics
            ${{ secrets.DOCKERHUB_USERNAME }}/socket-basics
          flavor: |
            latest=true
            suffix=${{ matrix.tag_suffix }},onlatest=true
          tags: |
            type=semver,pattern={{version}}
            type=raw,value=${{ needs.resolve-version.outputs.version }},enable=${{ github.event_name == 'workflow_dispatch' }}

      - name: 🧬 Create multi-arch manifest list
        working-directory: /tmp/digests
        env:
          GHCR_IMAGE: ghcr.io/socketdev/socket-basics
          DH_IMAGE: ${{ secrets.DOCKERHUB_USERNAME }}/socket-basics
          META_TAGS: ${{ steps.meta.outputs.tags }}
          EXPECTED_ARCHES: "2"
        run: |
          set -euo pipefail
          shopt -s nullglob
          digests=(*)
          if [ "${#digests[@]}" -ne "$EXPECTED_ARCHES" ]; then
            echo "::error::expected $EXPECTED_ARCHES per-arch digests for ${{ matrix.variant }}, found ${#digests[@]}"
            ls -la
            exit 1
          fi
          for image in "$GHCR_IMAGE" "$DH_IMAGE"; do
            tag_args=()
            while IFS= read -r tag; do
              [ -z "$tag" ] && continue
              case "$tag" in
                "$image:"*) tag_args+=(-t "$tag") ;;
              esac
            done <<< "$META_TAGS"
            if [ ${#tag_args[@]} -eq 0 ]; then
              echo "::error::no tags resolved for $image"
              exit 1
            fi
            sources=()
            for digest in "${digests[@]}"; do
              sources+=("${image}@sha256:${digest}")
            done
            echo "→ creating manifest list for $image with ${#sources[@]} arch sources"
            docker buildx imagetools create "${tag_args[@]}" "${sources[@]}"
          done

      - name: 🔍 Inspect published manifest
        env:
          GHCR_IMAGE: ghcr.io/socketdev/socket-basics
          DH_IMAGE: ${{ secrets.DOCKERHUB_USERNAME }}/socket-basics
          VERSION: ${{ needs.resolve-version.outputs.version }}
          TAG_SUFFIX: ${{ matrix.tag_suffix }}
        run: |
          set -euo pipefail
          for image in "$GHCR_IMAGE" "$DH_IMAGE"; do
            ref="${image}:${VERSION}${TAG_SUFFIX}"
            inspect="$(docker buildx imagetools inspect "$ref")"
            echo "$inspect"
            for platform in linux/amd64 linux/arm64; do
              if ! grep -q "Platform:[[:space:]]*$platform" <<< "$inspect"; then
                echo "::error::$ref is missing $platform"
                exit 1
              fi
            done
          done