publish.yml

name: Publish Docker image

permissions:
    contents: read

on:
    release:
        types: [released]

env:
    HUB_TOOL_VERSION: 0.4.6

jobs:
    build-image:
        runs-on: ubuntu-latest
        strategy:
            fail-fast: false
            max-parallel: 4
            matrix:
                include:
                    - { platform: "linux/arm/v6", internal-tag: "armv6" }
                    - { platform: "linux/arm/v7", internal-tag: "armv7" }
                    - { platform: "linux/arm64/v8", internal-tag: "arm64v8" }
                    - { platform: "linux/386", internal-tag: "386" }
                    - { platform: "linux/ppc64le", internal-tag: "ppc64le" }
                    - { platform: "linux/amd64", internal-tag: "amd64" }
                    - { platform: "linux/riscv64", internal-tag: "riscv64" }
        steps:
            - name: Checkout repository
              uses: actions/checkout@v6
            # https://github.com/docker/setup-qemu-action
            - name: Set up QEMU
              uses: docker/setup-qemu-action@v3
            # https://github.com/docker/setup-buildx-action
            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v3
            - name: Login to DockerHub
              uses: docker/login-action@v3
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_REPOSITORY_LOGIN }}
                  password: ${{ secrets.DOCKER_REPOSITORY_PASSWORD }}
            - name: Build and push image
              run: make docker-build
              env:
                  DOCKER_BUILDKIT: 1
                  BUILDKIT_MULTI_PLATFORM: "false"
                  PLATFORM: ${{ matrix.platform }}
                  IMAGE_TAG: "docker.io/botsudo/docker-rustpython:${{ matrix.internal-tag }}-latest"
                  ACTION: push
                  # Disable provenance to remove the attestation from the pushed image
                  # See: https://github.com/docker/buildx/issues/1509
                  # It makes: docker.io/botsudo/docker-rustpython:<arch>-latest a manifest list
                  # And docker manifest create does not like that
                  EXTRA_ARGS: "--provenance=false"

    create-final-image:
        runs-on: ubuntu-latest
        needs: build-image
        name: Create the image manifest
        steps:
            - name: Login to DockerHub
              uses: docker/login-action@v3
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_REPOSITORY_LOGIN }}
                  password: ${{ secrets.DOCKER_REPOSITORY_PASSWORD }}
            - name: Create the manifest
              run: |
                  docker manifest create docker.io/botsudo/docker-rustpython:latest \
                      docker.io/botsudo/docker-rustpython:armv6-latest \
                      docker.io/botsudo/docker-rustpython:armv7-latest \
                      docker.io/botsudo/docker-rustpython:arm64v8-latest \
                      docker.io/botsudo/docker-rustpython:386-latest \
                      docker.io/botsudo/docker-rustpython:ppc64le-latest \
                      docker.io/botsudo/docker-rustpython:amd64-latest \
                      docker.io/botsudo/docker-rustpython:riscv64-latest \
                      --amend
            - name: Push the manifest
              run: docker manifest push docker.io/botsudo/docker-rustpython:latest
            - name: Inspect the manifest
              run: docker manifest inspect docker.io/botsudo/docker-rustpython:latest
    tags-cleanup:
        runs-on: ubuntu-latest
        needs: create-final-image
        name: Cleanup build tags
        steps:
            - name: Install Docker hub-tool
              run: |
                  curl -sL https://github.com/docker/hub-tool/releases/download/v${{ env.HUB_TOOL_VERSION }}/hub-tool-linux-amd64.tar.gz -o hub-tool-linux.tar.gz
                  tar --strip-components=1 -xzf ./hub-tool-linux.tar.gz
                  ./hub-tool --version
            - name: Login hub-tool
              run: |
                  # Fool the login command (https://github.com/docker/hub-tool/pull/198)
                  # ./hub-tool login
                  # Token commands thank to https://stackoverflow.com/a/59334315/5155484
                  HUB_TOKEN=$(curl -s -H "Content-Type: application/json" -X POST -d "{\"username\": \"$DOCKER_USERNAME\", \"password\": \"$DOCKER_PASSWORD\"}" https://hub.docker.com/v2/users/login/ | jq -r .token)
                  USERNAME="$(printf '%s:' "$DOCKER_USERNAME" | base64 -w0)"
                  USER_PASS="$(printf '%s:%s' "$DOCKER_USERNAME" "$DOCKER_PASSWORD" | base64 -w0)"
                  mkdir -p ~/.docker/
                  printf '{"auths": {"hub-tool": {"auth": "%s"}, "hub-tool-refresh-token": {"auth": "%s"}, "hub-tool-token": { "auth": "%s", "identitytoken": "%s"}}}' \
                    "$USER_PASS" "$USERNAME" \
                    "$USERNAME" "$HUB_TOKEN" \
                    > ~/.docker/config.json
              env:
                  DOCKER_USERNAME: ${{ secrets.DOCKER_REPOSITORY_LOGIN }}
                  DOCKER_PASSWORD: ${{ secrets.DOCKER_REPOSITORY_PASSWORD }}
            - name: Remove the temporary images via hub-tool
              run: |
                  ./hub-tool tag rm --verbose --force docker.io/botsudo/docker-rustpython:armv6-latest || true
                  ./hub-tool tag rm --verbose --force docker.io/botsudo/docker-rustpython:armv7-latest || true
                  ./hub-tool tag rm --verbose --force docker.io/botsudo/docker-rustpython:arm64v8-latest || true
                  ./hub-tool tag rm --verbose --force docker.io/botsudo/docker-rustpython:386-latest || true
                  ./hub-tool tag rm --verbose --force docker.io/botsudo/docker-rustpython:ppc64le-latest || true
                  ./hub-tool tag rm --verbose --force docker.io/botsudo/docker-rustpython:amd64-latest || true
                  ./hub-tool tag rm --verbose --force docker.io/botsudo/docker-rustpython:riscv64-latest || true
                  ./hub-tool tag ls --verbose docker.io/botsudo/docker-rustpython
            - name: Logout hub-tool
              if: always()
              run: rm ~/.docker/config.json