Taskfile.docker.yml

version: '3'

silent: true

tasks:
  docker:login:
    desc: Login to hub.docker.com and ghcr.io
    cmds:
      - |
        set -eu
        docker_username='{{.DOCKER_USERNAME}}'
        github_username='{{.GITHUB_USERNAME}}'
        has_dockerhub=false
        has_ghcr=false

        if [ -n "$docker_username" ] && [ -n "${DOCKER_TOKEN:-}" ]; then
          has_dockerhub=true
        fi

        if [ -n "$github_username" ] && [ -n "${GITHUB_TOKEN:-}" ]; then
          has_ghcr=true
        fi

        if [ "$has_dockerhub" = false ] && [ "$has_ghcr" = false ]; then
          echo "❌ No registry credentials provided. Set DOCKER_USERNAME/DOCKER_TOKEN or GITHUB_USERNAME/GITHUB_TOKEN."
          exit 1
        fi

        if [ "$has_dockerhub" = true ]; then
          echo "Logging into Docker Hub as $docker_username"
          printf '%s' "${DOCKER_TOKEN}" | docker login -u "$docker_username" --password-stdin
        else
          echo "⚠️ Skipping Docker Hub login (missing DOCKER_USERNAME/DOCKER_TOKEN)"
        fi

        if [ "$has_ghcr" = true ]; then
          echo "Logging into GHCR as $github_username"
          printf '%s' "${GITHUB_TOKEN}" | docker login ghcr.io -u "$github_username" --password-stdin
        else
          echo "⚠️ Skipping GHCR login (missing GITHUB_USERNAME/GITHUB_TOKEN)"
        fi

  docker:cmds:
    desc: Show full docker build command
    cmds:
      - echo -e '{{.DOCKER_BUILD_START}} {{.DOCKER_BUILD_FINISH}}' | {{.SED}} 's/--/ \\\n  --/g'

  docker:build:
    desc: Build Docker image
    cmds:
      - docker buildx create --use
      - '{{.DOCKER_BUILD_START}} {{.DOCKER_BUILD_FINISH}}'

  docker:build:local:
    desc: Build local runnable Docker image for current architecture
    cmds:
      - |
        set -eu
        arch="$(uname -m)"
        case "${arch}" in
          x86_64|amd64) target_arch="amd64" ;;
          aarch64|arm64) target_arch="arm64" ;;
          *)
            echo "❌ Unsupported local architecture: ${arch}"
            exit 1
            ;;
        esac

        docker build \
          --build-arg TARGETARCH="${target_arch}" \
          --tag "{{.DOCKER_NAME}}:{{.VERSION_FULL}}{{.VERSION_SUFFIX}}" \
          --file Dockerfile \
          .

  docker:test:local:
    desc: Run container-structure-test action locally (requires local build)
    deps:
      - task: docker:build:local
    requires:
      vars: [CONFIG]
    cmds:
      - |
        set -eu
        image='{{default "" .IMAGE}}'
        image_from_oci_layout='{{default "" .IMAGE_FROM_OCI_LAYOUT}}'
        config='{{.CONFIG}}'

        if [ -z "${image}" ] && [ -z "${image_from_oci_layout}" ]; then
          echo "❌ Provide IMAGE=<image-ref> or IMAGE_FROM_OCI_LAYOUT=<path>"
          exit 1
        fi
        if [ -n "${image}" ] && [ -n "${image_from_oci_layout}" ]; then
          echo "❌ IMAGE and IMAGE_FROM_OCI_LAYOUT are mutually exclusive"
          exit 1
        fi
        if [ ! -S /var/run/docker.sock ] && [ '{{default "docker" .DRIVER}}' = 'docker' ]; then
          echo "❌ Docker socket not available at /var/run/docker.sock (required for DRIVER=docker)"
          exit 1
        fi

        docker run --rm \
          -v "$PWD:/github/workspace" \
          -w /github/workspace \
          -v /var/run/docker.sock:/var/run/docker.sock \
          -e INPUT_IMAGE="${image}" \
          -e INPUT_IMAGE_FROM_OCI_LAYOUT="${image_from_oci_layout}" \
          -e INPUT_CONFIG="${config}" \
          -e INPUT_DRIVER='{{default "docker" .DRIVER}}' \
          -e INPUT_PLATFORM='{{default "" .PLATFORM}}' \
          -e INPUT_PULL='{{default "false" .PULL}}' \
          -e INPUT_SAVE='{{default "false" .SAVE}}' \
          -e INPUT_QUIET='{{default "false" .QUIET}}' \
          -e INPUT_NO_COLOR='{{default "false" .NO_COLOR}}' \
          -e INPUT_OUTPUT='{{default "text" .OUTPUT}}' \
          -e INPUT_TEST_REPORT='{{default "" .TEST_REPORT}}' \
          -e INPUT_JUNIT_SUITE_NAME='{{default "" .JUNIT_SUITE_NAME}}' \
          -e INPUT_METADATA='{{default "" .METADATA}}' \
          -e INPUT_RUNTIME='{{default "" .RUNTIME}}' \
          -e INPUT_FORCE='{{default "false" .FORCE}}' \
          -e INPUT_DEFAULT_IMAGE_TAG='{{default "" .DEFAULT_IMAGE_TAG}}' \
          -e INPUT_IGNORE_REF_ANNOTATION='{{default "false" .IGNORE_REF_ANNOTATION}}' \
          -e INPUT_DEBUG='{{default "false" .DEBUG}}' \
          devopsinfra/action-container-structure-test:v1

  docker:test:smoke:
    desc: Smoke test local action image with container-structure-test
    deps:
      - task: docker:build:local
    cmds:
      - |
        set -eu
        task docker:test:local \
          IMAGE="{{.DOCKER_NAME}}:{{.VERSION_FULL}}{{.VERSION_SUFFIX}}" \
          CONFIG="tests/docker/local-image.yml" \
          DRIVER=docker \
          OUTPUT=text

  docker:build:inspect:
    desc: Inspect built Docker image
    cmds:
      - |
        image_inspect_out=$(docker image inspect {{.DOCKER_NAME}}:{{.VERSION_FULL}}{{.VERSION_SUFFIX}} | jq -r)
        echo -e "\nℹ️ Docker image inspect:"
        echo "$image_inspect_out" | jq

  docker:push:
    desc: Build and push Docker images
    deps:
      - task: docker:login
    cmds:
      - docker buildx create --use
      - '{{.DOCKER_BUILD_START}} --push {{.DOCKER_BUILD_FINISH}}'

  docker:push:inspect:
    desc: Inspect built Docker image
    cmds:
      - |
        set -eu
        image="{{.DOCKER_NAME}}:{{.VERSION_FULL}}{{.VERSION_SUFFIX}}"

        echo -e "\nℹ️ Trying local image inspect: $image"
        set +e
        image_inspect_out=$(docker image inspect "$image" 2>/dev/null || true)
        rc=$?
        set -e

        # Validate that docker inspect returned a non-empty array with an Id
        has_local=0
        if [ "$rc" -eq 0 ] && [ -n "$image_inspect_out" ]; then
          if echo "$image_inspect_out" | jq -e 'type=="array" and (length > 0) and \
              (.[0].Id != null and .[0].Id != "")' >/dev/null 2>&1; then
            has_local=1
          fi
        fi

        if [ "$has_local" -eq 1 ]; then
          echo -e "\n✅ Local image found. Docker image inspect:"
          echo "$image_inspect_out" | jq
          image_sha=$(echo "$image_inspect_out" | jq -r '.[0].Id // empty')
          if [ -n "$image_sha" ]; then
            echo -e "\nℹ️ Docker manifest inspect (local):"
            docker manifest inspect "${image}@${image_sha}" | jq || true
          fi
          exit 0
        fi

        echo -e "\nℹ️ Local image not found or inspect returned empty; inspecting remote with buildx imagetools..."
        set +e
        raw=$(docker buildx imagetools inspect --raw "$image" 2>/dev/null || true)
        set -e

        if [ -z "$raw" ]; then
          echo "❌ Failed to inspect remote image with buildx imagetools: $image"
          exit 1
        fi

        echo -e "\n✅ Remote manifest/index (raw):"
        echo "$raw" | jq

        echo -e "\nℹ️ Attempting to pull and inspect per-platform manifests:"
        echo "$raw" | jq -r '.manifests[]?.digest' | while IFS= read -r digest; do
          if [ -z "$digest" ] || [ "$digest" = "null" ]; then
            continue
          fi
          ref="${image%@*}@${digest}"
          echo -e "\nℹ️ Pulling $ref (may fail for some registries)..."
          set +e
          docker pull "$ref" >/dev/null 2>&1 || true
          pulled_rc=$?
          set -e
          if [ "$pulled_rc" -eq 0 ]; then
            echo "ℹ️ Inspecting pulled image $ref"
            docker image inspect "$ref" | jq || true
          else
            echo "⚠️ Could not pull $ref; skipping image inspect"
          fi
        done