remark42/.github/workflows/ci-build.yml

name: build

on:
  push:
    branches:
    tags:
    paths:
      - ".github/workflows/ci-build.yml"
      - "backend/**"
      - "frontend/apps/**"
      - ".dockerignore"
      - "docker-init.sh"
      - "Dockerfile"
      - "!**.md"
      - "!frontend/packages/**"
  pull_request:
    paths:
      - ".github/workflows/ci-build.yml"
      - "backend/**"
      - "frontend/apps/**"
      - ".dockerignore"
      - "docker-init.sh"
      - "Dockerfile"
      - "!**.md"

jobs:
  # Build without pushing for PRs and non-master branches
  build-test:
    name: Build test (non-master)
    if: ${{ github.ref != 'refs/heads/master' && !startsWith(github.ref, 'refs/tags/') }}
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v5

      - name: set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: free disk space
        run: |
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf /usr/local/share/boost
          docker system prune -af

      - name: build docker image without pushing
        run: |
          docker buildx build \
              --build-arg SKIP_BACKEND_TEST=true --build-arg SKIP_FRONTEND_TEST=true \
              --platform linux/arm64 .

      - name: build example docker image without pushing
        run: |
          docker buildx build \
              --build-arg SKIP_BACKEND_TEST=true --build-arg SKIP_FRONTEND_TEST=true \
              --platform linux/arm64 -f backend/_example/memory_store/Dockerfile .

  # Build and push for master and tags using native runners
  build-push:
    name: Build ${{ matrix.platform }}
    if: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/') }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
            artifact-name: linux-amd64
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
            artifact-name: linux-arm64
    runs-on: ${{ matrix.runner }}

    steps:
      - uses: actions/checkout@v5

      - name: set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: free disk space
        run: |
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf /usr/local/share/boost
          docker system prune -af

      - name: login to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.PKG_TOKEN }}

      - name: login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: umputun
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: prepare build args
        id: prep
        run: |
          ref="$(echo ${GITHUB_REF} | cut -d'/' -f3)"
          echo "ref=${ref}" >> $GITHUB_OUTPUT
          echo "GITHUB_REF=${GITHUB_REF}, GITHUB_SHA=${GITHUB_SHA}, GIT_BRANCH=${ref}"

      - name: build and push to ghcr.io
        id: build-ghcr
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
          build-args: |
            SKIP_BACKEND_TEST=true
            SKIP_FRONTEND_TEST=true
            CI=github
            GITHUB_SHA=${{ github.sha }}
            GIT_BRANCH=${{ steps.prep.outputs.ref }}
            GITHUB_REF=${{ github.ref }}
          outputs: type=image,name=ghcr.io/umputun/remark42,push-by-digest=true,name-canonical=true,push=true

      - name: build and push to Docker Hub
        id: build-dockerhub
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
          build-args: |
            SKIP_BACKEND_TEST=true
            SKIP_FRONTEND_TEST=true
            CI=github
            GITHUB_SHA=${{ github.sha }}
            GIT_BRANCH=${{ steps.prep.outputs.ref }}
            GITHUB_REF=${{ github.ref }}
          outputs: type=image,name=umputun/remark42,push-by-digest=true,name-canonical=true,push=true

      - name: export digests
        run: |
          mkdir -p /tmp/digests/ghcr /tmp/digests/dockerhub
          digest_ghcr="${{ steps.build-ghcr.outputs.digest }}"
          digest_dockerhub="${{ steps.build-dockerhub.outputs.digest }}"
          touch "/tmp/digests/ghcr/${digest_ghcr#sha256:}"
          touch "/tmp/digests/dockerhub/${digest_dockerhub#sha256:}"

      - name: upload ghcr digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-ghcr-${{ matrix.artifact-name }}
          path: /tmp/digests/ghcr/*
          if-no-files-found: error
          retention-days: 1

      - name: upload dockerhub digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-dockerhub-${{ matrix.artifact-name }}
          path: /tmp/digests/dockerhub/*
          if-no-files-found: error
          retention-days: 1

  # Merge digests and create multi-arch manifest
  merge-push:
    name: Create multi-arch manifest
    runs-on: ubuntu-latest
    needs: build-push

    steps:
      - name: download ghcr digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests/ghcr
          pattern: digests-ghcr-*
          merge-multiple: true

      - name: download dockerhub digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests/dockerhub
          pattern: digests-dockerhub-*
          merge-multiple: true

      - name: verify all digests present
        run: |
          for registry in ghcr dockerhub; do
            expected=2
            actual=$(ls /tmp/digests/${registry} | wc -l)
            if [ "$actual" -ne "$expected" ]; then
              echo "Expected $expected digests for ${registry}, found $actual"
              ls -la /tmp/digests/${registry}
              exit 1
            fi
            echo "All $expected digests present for ${registry}"
          done

      - name: set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: login to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.PKG_TOKEN }}

      - name: login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: umputun
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: prepare tags
        id: prep
        run: |
          ref="$(echo ${GITHUB_REF} | cut -d'/' -f3)"
          echo "ref=${ref}" >> $GITHUB_OUTPUT

          # for master branch, tag with branch name only
          if [[ "${GITHUB_REF}" == "refs/heads/master" ]]; then
            echo "ghcr_tags=-t ghcr.io/umputun/remark42:${ref}" >> $GITHUB_OUTPUT
            echo "dockerhub_tags=-t umputun/remark42:${ref}" >> $GITHUB_OUTPUT
          fi

          # for tags, include both version and latest
          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            echo "ghcr_tags=-t ghcr.io/umputun/remark42:${ref} -t ghcr.io/umputun/remark42:latest" >> $GITHUB_OUTPUT
            echo "dockerhub_tags=-t umputun/remark42:${ref} -t umputun/remark42:latest" >> $GITHUB_OUTPUT
          fi

      - name: create ghcr manifest and push
        working-directory: /tmp/digests/ghcr
        run: |
          docker buildx imagetools create \
            ${{ steps.prep.outputs.ghcr_tags }} \
            $(printf 'ghcr.io/umputun/remark42@sha256:%s ' *)

      - name: create dockerhub manifest and push
        working-directory: /tmp/digests/dockerhub
        run: |
          docker buildx imagetools create \
            ${{ steps.prep.outputs.dockerhub_tags }} \
            $(printf 'umputun/remark42@sha256:%s ' *)

      - name: remote deployment to remark42.com from master
        if: ${{ github.ref == 'refs/heads/master' }}
        env:
          UPDATER_KEY: ${{ secrets.UPDATER_KEY }}
        run: curl -s https://jess.umputun.com/update/remark42-core/${UPDATER_KEY}