portainer-updater.yml

name: portainer-updater

on:
  workflow_dispatch:
  push:
    branches:
      - 'develop'
      - 'release/*'
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
    branches:
      - 'develop'
      - 'release/*'
      - 'feat/*'
      - 'fix/*'
      - 'refactor/*'

env:
  DOCKER_HUB_REPO: portainerci/portainer-updater

jobs:
  build_images:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        config:
          - { platform: linux, arch: amd64, version: "" }
          # - { platform: linux, arch: arm64, version: "" }
          # - { platform: linux, arch: arm, version: "" }
          # - { platform: linux, arch: ppc64le, version: "" }
          - { platform: windows, arch: amd64, version: 1809 }
          # - { platform: windows, arch: amd64, version: ltsc2022 }
    steps:
      - name: "[preparation] checkout"
        uses: actions/checkout@v4.1.1

      - name: "[preparation] set up qemu"
        uses: docker/setup-qemu-action@v3.2.0

      - name: "[preparation] set up docker context for buildx"
        run: docker context create builders

      - name: "[preparation] set up docker buildx"
        uses: docker/setup-buildx-action@v3.6.1
        with:
          endpoint: builders
          driver-opts: image=moby/buildkit:v0.16.0

      - name: "[preparation] docker login"
        uses: docker/login-action@v3.3.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}

      - name: "[metadata] generate image tags"
        id: meta
        uses: docker/metadata-action@v5.5.1
        with:
          images: ${{ env.DOCKER_HUB_REPO }}

      - name: "[build] build and push by digest"
        id: build
        uses: docker/build-push-action@v6.7.0
        with:
          platforms: ${{ matrix.config.platform }}/${{ matrix.config.arch }}
          file: build/${{ matrix.config.platform }}/Dockerfile
          build-args: |
            GIT_COMMIT=$(git log -1 --format=%h)
            OSVERSION=${{ matrix.config.version }}
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,name=${{ env.DOCKER_HUB_REPO }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha
          cache-to: type=gha,mode=max
          attests: |
            type=sbom
            type=provenance,mode=max

      - name: "[build] export digest"
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"          
      
      - name: "[build] upload digest"
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ matrix.config.platform }}${{ matrix.config.version }}-${{ matrix.config.arch }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  build_manifests:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    needs: [build_images]
    steps:
      - name: "[preparation] download digests"
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: "[preparation] setup manifest name"
        run: |
          if [[ "${GITHUB_REF_NAME}" =~ ^release/.*$ ]]; then
            # use the release branch name as the tag for release branches
            # for instance, release/2.19 becomes 2.19
            CONTAINER_IMAGE_TAG=$(echo $GITHUB_REF_NAME | cut -d "/" -f 2)
          elif [ "${GITHUB_EVENT_NAME}" == "pull_request" ]; then
            # use pr${{ github.event.number }} as the tag for pull requests
            # for instance, pr123
            CONTAINER_IMAGE_TAG="pr${{ github.event.number }}"
          else
            # replace / with - in the branch name
            # for instance, feature/1.0.0 -> feature-1.0.0
            CONTAINER_IMAGE_TAG=$(echo $GITHUB_REF_NAME | sed 's/\//-/g')
          fi

      - name: "[metadata] generate image tags"
        id: meta
        uses: docker/metadata-action@v5.5.1
        with:
          images: ${{ env.DOCKER_HUB_REPO }}
          tags: |
            type=raw,value=${CONTAINER_IMAGE_TAG}

      - name: "[preparation] set up docker context for buildx"
        run: docker context create builders

      - name: "[preparation] set up docker buildx"
        uses: docker/setup-buildx-action@v3.0.0
        with:
          endpoint: builders
          driver-opts: image=moby/buildkit:v0.16.0

      - name: "[preparation] docker login"
        uses: docker/login-action@v3.0.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}

      - name: "[build] create manifest list and push"
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.DOCKER_HUB_REPO }}@sha256:%s ' *)          
      
      - name: "[validate] inspect image"
        run: |
          docker buildx imagetools inspect ${{ env.DOCKER_HUB_REPO }}:${{ steps.meta.outputs.version }}