docker-image.yml

---
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: Create and publish a Docker image

on:
  schedule:
    - cron: "5 4 * * 0" # At 04:05 on Sunday
  push:
    branches:
      - "**"
    tags:
      - "v*.*.*"
  pull_request:
    branches:
      - "main"

# cancel a currently running workflow from the same PR, branch or tag when a new workflow is triggered
# source: https://stackoverflow.com/questions/66335225/how-to-cancel-previous-runs-in-the-pr-when-you-push-new-commitsupdate-the-curre/67939898#67939898
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  REGISTRY_GITHUB: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  BUILD_PLATFORMS: "linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7"
  BASE_IMAGE: "library/alpine:latest"

jobs:
  check-pre-condition:
    name: evaluate if container should be build
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    outputs:
      condition_met: ${{ steps.set_output.outputs.run_jobs }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - id: string_lower_case
        uses: Entepotenz/change-string-case-action-min-dependencies@v1
        with:
          string: ${{ env.IMAGE_NAME }}

      - name: Docker Image Update Checker
        id: baseupdatecheck
        uses: lucacome/docker-image-update-checker@v2
        with:
          base-image: ${{ env.BASE_IMAGE }}
          image: ${{ steps.string_lower_case.outputs.lowercase }}:latest

      - name: determine if we should build
        id: set_output
        env:
          IMAGE_NEEDS_UPDATE: ${{ steps.baseupdatecheck.outputs.needs-updating }}
          GIT_EVENT_NAME: ${{ github.event_name }}
        run: |
          if [ "$IMAGE_NEEDS_UPDATE" = "true" ] || [ "$GIT_EVENT_NAME" = "push" ] || [ "$GIT_EVENT_NAME" = "pull_request" ]; then
            echo "run_jobs=true" >> "$GITHUB_OUTPUT"
            echo "### We need to build a new docker image! :rocket:" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "run_jobs=false" >> "$GITHUB_OUTPUT"
            echo "### Everything is already up-to-date!" >> "$GITHUB_STEP_SUMMARY"
          fi
          { 
            echo "IMAGE_NEEDS_UPDATE:='$IMAGE_NEEDS_UPDATE'"
            echo "GIT_EVENT_NAME:='$GIT_EVENT_NAME'"
          } >> "$GITHUB_STEP_SUMMARY"

  build-and-push-image:
    runs-on: ubuntu-latest
    needs: [check-pre-condition]
    if: needs.check-pre-condition.outputs.condition_met == 'true'
    timeout-minutes: 20
    permissions:
      contents: read
      packages: write
      # id-token: write # needed for signing the images with GitHub OIDC Token

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # - name: Install Cosign
      #   uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        if: github.event_name != 'pull_request'
        with:
          registry: ${{ env.REGISTRY_GITHUB }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.TOKEN }}

      - name: Login to DockerHub
        uses: docker/login-action@v3 
        if: github.event_name != 'pull_request'
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_NAME }},${{ env.REGISTRY_GITHUB }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
          flavor: |
            latest=auto
            prefix=
            suffix=

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        id: build-and-push
        with:
          context: .
          platforms: ${{ env.BUILD_PLATFORMS }}
          pull: true
          file: Dockerfile
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      
      - name: Docker Hub Description
        uses: peter-evans/dockerhub-description@v4
        if: github.event_name != 'pull_request'
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
          repository: ${{ env.IMAGE_NAME }}
          readme-filepath: ./README.md

      # - name: Extract metadata (tags, labels) for Docker
      #   id: docker_meta
      #   uses: docker/metadata-action@v5
      #   with:
      #     images: ${{ env.REGISTRY_GITHUB }}/${{ env.IMAGE_NAME }}
      #     tags: |
      #       type=sha,format=long

      # # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
      # - name: Sign image with a key
      #   run: |
      #     cosign sign --yes --key env://COSIGN_PRIVATE_KEY "${TAGS}@${DIGEST}"
      #   env:
      #     TAGS: ${{ steps.docker_meta.outputs.tags }}
      #     COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
      #     COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
      #     DIGEST: ${{ steps.build-and-push.outputs.digest }}

      # - name: Sign the images with GitHub OIDC Token
      #   env:
      #     DIGEST: ${{ steps.build-and-push.outputs.digest }}
      #     TAGS: ${{ steps.docker_meta.outputs.tags }}
      #   run: cosign sign --yes "${TAGS}@${DIGEST}"