# Builds both images and publishes them to GitHub Container Registry:
#   ghcr.io/<owner>/liquiflux-xray-api:{latest,<VERSION>}
#   ghcr.io/<owner>/liquiflux-xray-scanner:{latest,<VERSION>}
# Pull requests build only (nothing is pushed). Actions are pinned by commit.
name: images

on:
  push:
    branches: [main]
    paths-ignore: ["**.md", "unraid/**", "images/**", "ca_profile.xml", "LICENSE"]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: images-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: liquiflux-xray-api
            context: api
            file: api/Dockerfile
          - name: liquiflux-xray-scanner
            context: .
            file: scanner/Dockerfile
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Free disk space (the scanner image is ~3 GB)
        if: matrix.name == 'liquiflux-xray-scanner'
        run: sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL

      - name: Image name and version
        id: v
        run: |
          echo "image=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/${{ matrix.name }}" >> "$GITHUB_OUTPUT"
          echo "version=$(tr -d '[:space:]' < VERSION)" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - if: github.event_name != 'pull_request'
        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ steps.v.outputs.image }}
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=${{ steps.v.outputs.version }},enable={{is_default_branch}}
            type=sha,format=short
          labels: |
            org.opencontainers.image.title=${{ matrix.name }}
            org.opencontainers.image.version=${{ steps.v.outputs.version }}

      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.file }}
          platforms: linux/amd64
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: false
          cache-from: type=gha,scope=${{ matrix.name }}
          cache-to: type=gha,mode=max,scope=${{ matrix.name }}