name: Docker Build and Publish on: workflow_call: inputs: tag_name: description: 'Git tag name (e.g., v1.0.0)' required: false type: string release: types: [published] push: tags: - 'v*.*.*' workflow_dispatch: inputs: tag_name: description: 'Git tag name (e.g., v1.0.0)' required: false type: string env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} # Docker Hub mirror. Unlike IMAGE_NAME this cannot be derived from # ${{ github.repository }} — the Docker Hub namespace is its own account and # does not track where the git repo lives. Needs the DOCKERHUB_USERNAME / # DOCKERHUB_TOKEN secrets. DOCKERHUB_IMAGE: docker.io/dastron/garage-ware jobs: build: strategy: fail-fast: false matrix: include: - platform: linux/amd64 runner: ubuntu-latest arch: amd64 - platform: linux/arm64 runner: ubuntu-24.04-arm arch: arm64 runs-on: ${{ matrix.runner }} permissions: contents: read packages: write steps: - name: Checkout repository uses: actions/checkout@v7 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v4 - name: Log in to Container Registry uses: docker/login-action@v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Log in to Docker Hub uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Extract image labels id: meta uses: docker/metadata-action@v6 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} labels: | org.opencontainers.image.title=Garage-ware org.opencontainers.image.description=Self-hosted Garage S3 cluster management plane org.opencontainers.image.vendor=${{ github.repository_owner }} org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }} org.opencontainers.image.revision=${{ github.sha }} org.opencontainers.image.licenses=MIT # One build, pushed by digest to both registries at once. The quotes # around the name list are load-bearing: buildx parses this string as CSV, # so the comma between the two names would otherwise split the field. - name: Build and push by digest id: build uses: docker/build-push-action@v7 with: context: . file: ./docker/Dockerfile platforms: ${{ matrix.platform }} labels: ${{ steps.meta.outputs.labels }} outputs: type=image,"name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},${{ env.DOCKERHUB_IMAGE }}",push-by-digest=true,name-canonical=true,push=true cache-from: type=gha,scope=build-${{ matrix.arch }} cache-to: type=gha,mode=max,scope=build-${{ matrix.arch }} build-args: | POCKETBASE_VERSION=0.39.10 NEXT_PUBLIC_POCKETBASE_URL=/ - name: Export digest run: | mkdir -p /tmp/digests digest="${{ steps.build.outputs.digest }}" touch "/tmp/digests/${digest#sha256:}" - name: Upload digest uses: actions/upload-artifact@v7 with: name: digests-${{ matrix.arch }} path: /tmp/digests/* if-no-files-found: error retention-days: 1 merge: runs-on: ubuntu-latest needs: build permissions: contents: read packages: write steps: - name: Download digests uses: actions/download-artifact@v8 with: path: /tmp/digests pattern: digests-* merge-multiple: true - name: Set up Docker Buildx uses: docker/setup-buildx-action@v4 - name: Log in to Container Registry uses: docker/login-action@v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Log in to Docker Hub uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Extract metadata (tags) id: meta uses: docker/metadata-action@v6 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=raw,value=${{ inputs.tag_name }},enable=${{ inputs.tag_name != '' }} type=ref,event=tag type=raw,value=latest - name: Create manifest list and push working-directory: /tmp/digests run: | docker buildx imagetools create \ --annotation "index:org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}" \ --annotation "index:org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }}" \ --annotation "index:org.opencontainers.image.description=Self-hosted Garage S3 cluster management plane" \ --annotation "index:org.opencontainers.image.licenses=MIT" \ $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *) - name: Extract metadata (Docker Hub tags) id: meta-dockerhub uses: docker/metadata-action@v6 with: images: ${{ env.DOCKERHUB_IMAGE }} tags: | type=raw,value=${{ inputs.tag_name }},enable=${{ inputs.tag_name != '' }} type=ref,event=tag type=raw,value=latest # Same digests, second manifest list: the build job already pushed every # per-arch image to Docker Hub, so the sources resolve there and nothing # is copied across registries here. - name: Create Docker Hub manifest list and push working-directory: /tmp/digests env: DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta-dockerhub.outputs.json }} run: | docker buildx imagetools create \ --annotation "index:org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}" \ --annotation "index:org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }}" \ --annotation "index:org.opencontainers.image.description=Self-hosted Garage S3 cluster management plane" \ --annotation "index:org.opencontainers.image.licenses=MIT" \ $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ $(printf "${DOCKERHUB_IMAGE}@sha256:%s " *) - name: Inspect image run: | docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} - name: Inspect Docker Hub image run: | docker buildx imagetools inspect ${{ env.DOCKERHUB_IMAGE }}:${{ steps.meta-dockerhub.outputs.version }} - name: Generate build summary run: | echo "## Docker Build Summary" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "- **Platforms:** linux/amd64, linux/arm64" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo '```' >> $GITHUB_STEP_SUMMARY echo "${{ steps.meta.outputs.tags }}" >> $GITHUB_STEP_SUMMARY echo "${{ steps.meta-dockerhub.outputs.tags }}" >> $GITHUB_STEP_SUMMARY echo '```' >> $GITHUB_STEP_SUMMARY