build-image.yml

name: build-image

on:
  push:
    branches:
      - main
    tags:
      - '*'
  workflow_dispatch:
    inputs:
      http_proxy:
        description: Optional build HTTP proxy
        required: false
        default: ''
        type: string
      https_proxy:
        description: Optional build HTTPS proxy
        required: false
        default: ''
        type: string
      no_proxy:
        description: Optional build NO_PROXY list
        required: false
        default: ''
        type: string
      platforms:
        description: docker buildx platforms
        required: false
        default: linux/amd64,linux/arm64
        type: string

permissions:
  contents: read
  packages: write

env:
  IMAGE_REPO: ghcr.io/${{ github.repository }}
  DEFAULT_HTTP_PROXY: ''
  DEFAULT_HTTPS_PROXY: ''
  DEFAULT_NO_PROXY: ''
  DEFAULT_PLATFORMS: linux/amd64,linux/arm64

jobs:
  build:
    runs-on: ubuntu-latest
    environment: run-gemma-4

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Resolve build settings
        id: vars
        shell: bash
        env:
          INPUT_HTTP_PROXY: ${{ github.event.inputs.http_proxy }}
          INPUT_HTTPS_PROXY: ${{ github.event.inputs.https_proxy }}
          INPUT_NO_PROXY: ${{ github.event.inputs.no_proxy }}
          INPUT_PLATFORMS: ${{ github.event.inputs.platforms }}
          GITHUB_REF_TYPE_VALUE: ${{ github.ref_type }}
          GITHUB_REF_NAME_VALUE: ${{ github.ref_name }}
          GITHUB_SHA_VALUE: ${{ github.sha }}
        run: |
          choose() {
            local preferred="$1"
            local fallback="$2"

            if [[ -n "$preferred" ]]; then
              printf '%s' "$preferred"
            else
              printf '%s' "$fallback"
            fi
          }

          image_version="sha-${GITHUB_SHA_VALUE::7}"
          if [[ "${GITHUB_REF_TYPE_VALUE}" == "tag" ]]; then
            image_version="${GITHUB_REF_NAME_VALUE}"
          fi

          echo "http_proxy=$(choose "$INPUT_HTTP_PROXY" "$DEFAULT_HTTP_PROXY")" >> "$GITHUB_OUTPUT"
          echo "https_proxy=$(choose "$INPUT_HTTPS_PROXY" "$DEFAULT_HTTPS_PROXY")" >> "$GITHUB_OUTPUT"
          echo "no_proxy=$(choose "$INPUT_NO_PROXY" "$DEFAULT_NO_PROXY")" >> "$GITHUB_OUTPUT"
          echo "platforms=$(choose "$INPUT_PLATFORMS" "$DEFAULT_PLATFORMS")" >> "$GITHUB_OUTPUT"
          echo "image_version=${image_version}" >> "$GITHUB_OUTPUT"
          echo "build_date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets[format('{0}_{1}', 'GHCR', 'TOKEN')] != '' && github.repository_owner || github.actor }}
          password: ${{ secrets[format('{0}_{1}', 'GHCR', 'TOKEN')] != '' && secrets[format('{0}_{1}', 'GHCR', 'TOKEN')] || secrets.GITHUB_TOKEN }}

      - name: Compute image tags
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_REPO }}
          tags: |
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
            type=sha,prefix=sha-,enable=${{ github.ref == 'refs/heads/main' }}
            type=ref,event=tag

      - name: Build and push image
        id: push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          push: true
          platforms: ${{ steps.vars.outputs.platforms }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: false
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            REPO_URL=https://github.com/${{ github.repository }}
            VCS_REF=${{ github.sha }}
            BUILD_DATE=${{ steps.vars.outputs.build_date }}
            IMAGE_VERSION=${{ steps.vars.outputs.image_version }}
            HTTP_PROXY=${{ steps.vars.outputs.http_proxy }}
            HTTPS_PROXY=${{ steps.vars.outputs.https_proxy }}
            NO_PROXY=${{ steps.vars.outputs.no_proxy }}
            http_proxy=${{ steps.vars.outputs.http_proxy }}
            https_proxy=${{ steps.vars.outputs.https_proxy }}
            no_proxy=${{ steps.vars.outputs.no_proxy }}

      - name: Write publish summary
        if: success()
        shell: bash
        env:
          OWNER_TYPE: ${{ github.event.repository.owner.type }}
          OWNER_NAME: ${{ github.repository_owner }}
          PACKAGE_NAME: ${{ github.event.repository.name }}
          IMAGE_REPO_VALUE: ${{ env.IMAGE_REPO }}
          PUBLISHED_TAGS: ${{ steps.meta.outputs.tags }}
        run: |
          if [[ "${OWNER_TYPE}" == "Organization" ]]; then
            package_url="https://github.com/orgs/${OWNER_NAME}/packages/container/package/${PACKAGE_NAME}"
          else
            package_url="https://github.com/users/${OWNER_NAME}/packages/container/package/${PACKAGE_NAME}"
          fi

          {
            echo "## Published image"
            echo
            echo "- Package: ${IMAGE_REPO_VALUE}"
            echo "- GitHub Packages: ${package_url}"
            echo "- Platforms: ${{ steps.vars.outputs.platforms }}"
            echo "- Digest: ${{ steps.push.outputs.digest }}"
            echo
            echo "### Published tags"
            while IFS= read -r tag; do
              if [[ -n "${tag}" ]]; then
                echo "- ${tag}"
              fi
            done <<< "${PUBLISHED_TAGS}"
          } >> "$GITHUB_STEP_SUMMARY"