From c49086d56033f9a93afb3f70bc3ffa8353b53ee4 Mon Sep 17 00:00:00 2001
From: NotAShelf <raf@notashelf.dev>
Date: Mon, 23 Oct 2023 11:01:47 +0300
Subject: [PATCH] CI: separate docker build and docker publish steps

---
 .github/workflows/docker.yml | 50 ++++++++++++++++++++++++++++--------
 1 file changed, 39 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 0236af6c9..84bcf4865 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,8 +1,8 @@
 name: "Publish Docker Image"
 
 env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
+  USERNAME: "${{ github.actor }}"
+  IMAGE_NAME: "${{ github.repository }}"
 
 on:
   pull_request:
@@ -32,25 +32,53 @@ jobs:
         uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
 
-      - name: Log into ghcr
+      - name: Build Exposed Docker Image
+        run: nix build .#docker-nix --print-build-logs
+
+      - name: Publish Docker Image
+        run: |
+          # make the image an acutal file instead of a symlink
+          cp -v result docker-image
+
+      - name: Upload Build Artifact
+        uses: actions/upload-artifact@master
+        with:
+          name: docker-image
+          path: docker-image
+
+  publish-to-github:
+    name: "Publish Docker Image (Github Packages)"
+    runs-on: ubuntu-latest
+    needs: build-docker-image
+
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Receive Build Artifact
+        uses: actions/download-artifact@master
+        with:
+          name: docker-image
+          path: docker-image
+
+      - name: Log into ghcr.io
         uses: docker/login-action@master
         with:
-          registry: "${{ env.REGISTRY }}"
-          username: "${{ github.actor }}"
+          registry: "ghcr.io"
+          username: "${{ env.USERNAME }}"
           password: "${{ secrets.GITHUB_TOKEN }}"
 
-      - name: Build Exposed Docker Image
-        run: nix build .#docker-nix --print-build-logs
-
       - name: Publish Docker Image
         run: |
           #!/usr/bin/env bash
           set -eu
 
-          docker login "${{ env.REGISTRY }}" --username "${{ github.actor}}" --password "${{ secrets.GITHUB_TOKEN}}"
-
           # load the built image
-          docker load -i result &&
+          docker load -i docker-image &&
 
           # publish the loaded image
           docker push neovim-flake-nix:latest