build-docker-image.yml

name: Build and Push Docker Images

on:
  push:
    branches:
      - main
    paths:
      - 'docker-bake.hcl'
  workflow_dispatch:

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      release: ${{ steps.extract.outputs.release }}
      app: ${{ steps.extract.outputs.app }}
      registry_user: ${{ steps.extract.outputs.registry_user }}
      should_build: ${{ steps.check.outputs.should_build }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Extract variables from docker-bake.hcl
        id: extract
        run: |
          RELEASE=$(grep 'variable "RELEASE"' -A 2 docker-bake.hcl | grep 'default' | sed 's/.*"\(.*\)"/\1/')
          APP=$(grep 'variable "APP"' -A 2 docker-bake.hcl | grep 'default' | sed 's/.*"\(.*\)"/\1/')
          REGISTRY_USER=$(grep 'variable "REGISTRY_USER"' -A 2 docker-bake.hcl | grep 'default' | sed 's/.*"\(.*\)"/\1/')

          echo "release=${RELEASE}" >> $GITHUB_OUTPUT
          echo "app=${APP}" >> $GITHUB_OUTPUT
          echo "registry_user=${REGISTRY_USER}" >> $GITHUB_OUTPUT

          echo "Current RELEASE: ${RELEASE}"
          echo "Current APP: ${APP}"
          echo "Current REGISTRY_USER: ${REGISTRY_USER}"

      - name: Check if RELEASE changed
        id: check
        run: |
          # For manual triggers, always build
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            echo "should_build=true" >> $GITHUB_OUTPUT
            echo "Manual trigger - will build"
            exit 0
          fi

          # Check if docker-bake.hcl was modified
          git diff HEAD^ HEAD docker-bake.hcl > /tmp/diff.txt

          if grep -E '^\+.*variable "RELEASE"' /tmp/diff.txt || \
             grep -E '^\+.*default = ' /tmp/diff.txt | grep -E 'RELEASE' -B 2; then
            echo "should_build=true" >> $GITHUB_OUTPUT
            echo "RELEASE changed - will build"
          else
            echo "should_build=false" >> $GITHUB_OUTPUT
            echo "No RELEASE changes detected - skipping build"
          fi

  build-and-push:
    needs: detect-changes
    if: needs.detect-changes.outputs.should_build == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      images: ${{ steps.list-images.outputs.images }}
      images_json: ${{ steps.list-images.outputs.images_json }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Free up disk space
        run: |
          sudo swapoff -a
          sudo rm -rf /swapfile /usr/share/dotnet /usr/local/lib/android /opt/ghc
          sudo apt clean
          df -h

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            image=moby/buildkit:latest
            network=host
          buildkitd-flags: --debug

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create temporary docker-bake override file
        run: |
          # Create an override file that forces ghcr.io
          cat > docker-bake.override.hcl << 'EOF'
          target "default" {
            inherits = ["default"]
            tags = ["ghcr.io/${{ github.repository_owner }}/${{ needs.detect-changes.outputs.app }}:${{ needs.detect-changes.outputs.release }}"]
          }
          EOF

          echo "Override file created:"
          cat docker-bake.override.hcl

      - name: Build and push Docker image
        run: |
          echo "Building and pushing Docker image to ghcr.io..."

          # Show what will be built
          echo "Configuration:"
          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl --print default

          echo ""
          echo "Starting build..."

          # Build with both files - override will take precedence for tags
          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl --push default

          echo "Build completed!"

      - name: Verify image was pushed
        run: |
          IMAGE="ghcr.io/${{ github.repository_owner }}/${{ needs.detect-changes.outputs.app }}:${{ needs.detect-changes.outputs.release }}"
          echo "Verifying image: $IMAGE"

          # Wait for registry to update
          sleep 10

          # Try to pull the image
          docker pull $IMAGE && echo "✅ SUCCESS: Image verified: $IMAGE" || echo "❌ FAILED: Could not pull image: $IMAGE"

      - name: List built image
        id: list-images
        run: |
          RELEASE="${{ needs.detect-changes.outputs.release }}"
          APP="${{ needs.detect-changes.outputs.app }}"
          REGISTRY="ghcr.io"
          REGISTRY_USER="${{ github.repository_owner }}"

          # Create the image name
          IMAGE="${REGISTRY}/${REGISTRY_USER}/${APP}:${RELEASE}"

          # Create JSON for easier parsing by third-party tools
          IMAGES_JSON=$(echo "[\"${IMAGE}\"]" | jq -c '.')

          # Output for GitHub Actions
          echo "images<<EOF" >> $GITHUB_OUTPUT
          echo "$IMAGE" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

          echo "images_json=${IMAGES_JSON}" >> $GITHUB_OUTPUT

          # Also write to a file that can be downloaded
          echo "$IMAGE" > built-images.txt
          echo "$IMAGES_JSON" > built-images.json

      - name: Upload image list artifacts
        uses: actions/upload-artifact@v4
        with:
          name: docker-images-list
          path: |
            built-images.txt
            built-images.json
          retention-days: 90

      - name: Display built image
        run: |
          echo "Successfully built and pushed the following image:"
          cat built-images.txt
          echo ""
          echo "JSON format:"
          cat built-images.json

  create-summary:
    needs: [detect-changes, build-and-push]
    if: needs.detect-changes.outputs.should_build == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Create job summary
        run: |
          echo "## Docker Image Built" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Application:** ${{ needs.detect-changes.outputs.app }}" >> $GITHUB_STEP_SUMMARY
          echo "**Release:** ${{ needs.detect-changes.outputs.release }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Image Pushed to GitHub Container Registry:" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "${{ needs.build-and-push.outputs.images }}" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### To pull this image:" >> $GITHUB_STEP_SUMMARY
          echo '```bash' >> $GITHUB_STEP_SUMMARY
          echo "docker pull ${{ needs.build-and-push.outputs.images }}" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Note:** If the image is private, make it public at:" >> $GITHUB_STEP_SUMMARY
          echo "https://github.com/${{ github.repository_owner }}?tab=packages" >> $GITHUB_STEP_SUMMARY