docker-publish.yml

name: Docker

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

on:
  schedule:
    - cron: "32 19 * * *"
  push:
    # Publish semver tags as releases.
    tags: ["v*.*.*"]
  workflow_dispatch:
  workflow_call:

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}

jobs:
  docker_build:
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write

    steps:
      - uses: samueldr/lix-gha-installer-action@latest
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Determine whether to push
        id: docker_pushable
        run: echo should=${{ toJSON(github.event_name != 'merge_group') }} >>$GITHUB_OUTPUT

      - name: Build the docker images we care about
        run: |
          nix build .#tsnsrvOciImage-cross-aarch64-linux .#tsnsrvOciImage

      - name: Push to ghcr
        run: nix run .#pushImagesToGhcr --impure
        if: steps.docker_pushable.outputs.should == 'true'
        env:
          GH_TOKEN: ${{ github.token }}