docker-publish.yml

name: Build and Publish Docker Image

on:
  push:
    branches: [ main ]
    tags:
      - 'v*'

permissions:
  contents: read
  packages: write

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4

      - name: Derive lowercase repo for GHCR
        id: repo
        run: echo "REPO_LOWER=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV

      - name: Log in to GHCR
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5
        with:
          images: ghcr.io/${{ env.REPO_LOWER }}
          tags: |
            type=ref,event=branch
            type=ref,event=tag
            type=raw,value=latest,enable={{is_default_branch}}
            type=sha

      - name: Set up Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3

      - name: Build and push (CPU)
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            TORCH_INDEX_URL=https://download.pytorch.org/whl/cpu

      - name: Build and push (GPU)
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v5
        with:
          context: .
          push: true
          tags: ghcr.io/${{ env.REPO_LOWER }}:gpu
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            TORCH_INDEX_URL=https://download.pytorch.org/whl/cu121

  release-on-main:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    needs: build-and-push
    permissions:
      contents: write
    steps:
      - name: Create Release after successful build
        uses: actions/github-script@v7
        with:
          script: |
            const { owner, repo } = context.repo;
            let latestTag = 'v0.0.0';
            try {
              const { data: releases } = await github.rest.repos.listReleases({ owner, repo, per_page: 1 });
              if (releases.length > 0) { latestTag = releases[0].tag_name || latestTag; }
            } catch (e) { /* no releases yet */ }

            const m = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(latestTag);
            let major = 0, minor = 0, patch = 0;
            if (m) { major = parseInt(m[1]); minor = parseInt(m[2]); patch = parseInt(m[3]); }
            const newTag = `v${major}.${minor}.${patch + 1}`;

            await github.rest.repos.createRelease({
              owner,
              repo,
              tag_name: newTag,
              name: `Release ${newTag}`,
              draft: false,
              prerelease: false,
              target_commitish: context.sha,
              generate_release_notes: true,
            });