docker-workflow.yml

name: Docker Build & Push
permissions:
  contents: read
on:
  workflow_call:
    inputs:
      push:
        description: 'Whether to push the Docker images'
        required: false
        default: false
        type: boolean

jobs:
  docker:
    permissions:
      actions: write
      contents: read
      packages: write
      id-token: write
    runs-on: ubuntu-24.04-arm
    name: "Build and Push Sitrep Image"
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # `git describe` below needs the tags and enough history to count commits since
          # the last one. The default shallow fetch has neither, and --always would quietly
          # degrade to a bare SHA rather than failing.
          fetch-depth: 0

      - name: Download UI build artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ui-build
          path: ui/build/
      
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "stable"
      - uses: ko-build/setup-ko@61b4d1d396f5b2e7d6bb6fefdce3dc38d1a13445 # v0.10

      - name: Install Go dependencies
        run: go mod download

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ghcr.io/f-eld-ch/sitrep
          tags: |
            # Release tags are published by GoReleaser. This workflow builds branch images.
            type=raw,value=stable,enable=${{ github.ref == format('refs/heads/{0}', 'main') }},priority=910
            type=raw,value=develop,enable={{is_default_branch}},priority=905
            # priority 900
            type=semver,pattern={{major}}.{{minor}},prefix=v
            type=semver,pattern={{major}},prefix=v
            # priority 700
            type=edge,branch=develop
            # priority 600
            type=ref,event=branch
            type=ref,event=pr,prefix=pr-,enable=true
      - name: Prepare Image Tags and Labels
        id: image_tags_labels
        run: |
          # prepare tags
          tags=""
          separator=""
          prefix=${KO_DOCKER_REPO}
          IFS=$'\n'
          for tag in ${DOCKER_METADATA_OUTPUT_TAGS}; do
            tags="$tags${separator}${tag#${prefix}:}"
            separator=","
          done
          echo "tags=$tags" >> $GITHUB_OUTPUT

          # prepare labels
          labels=""
          IFS=$'\n'
          separator=""
          for label in ${DOCKER_METADATA_OUTPUT_LABELS}; do
            labels="${labels}${separator}--image-label '$label'"
            separator=" "
          done
          echo "labels=$labels" >> $GITHUB_OUTPUT
      - name: Ko Build
        run: |
          # Deliberately `git describe` rather than the image tag from metadata-action.
          # That yields the literal "develop" on the default branch, "stable" on main and
          # "pr-N" on pull requests — only tagged releases got a real version, and most
          # deploys are not tagged. This anchors every build to the last release and counts
          # from it (v26.8.0-64-g136b9bf0), and is byte-identical to what the UI bakes in,
          # so the two never disagree. The image tags themselves are unaffected: they come
          # from image_tags_labels below.
          SITREP_VERSION="$(git describe --tags --always)"
          if [ -z "$SITREP_VERSION" ]; then
            echo "::error::git describe produced an empty version; refusing to build an unversioned image"
            exit 1
          fi
          echo "Stamping version: $SITREP_VERSION"
          export SITREP_VERSION
          ko build --bare . --tags ${{ steps.image_tags_labels.outputs.tags }} ${{ steps.image_tags_labels.outputs.labels }}