Memoh/.github/workflows/docker.yml

name: Docker

on:
  push:
    branches: [main, "v*.*"]
    tags: ["v*"]
    paths-ignore:
      - "docs/**"
      - "**.md"
      - "devenv/**"
  release:
    types: [published]
  pull_request:
    branches: [main, "v*.*"]
    paths-ignore:
      - "docs/**"
      - "**.md"
      - "devenv/**"
  workflow_dispatch:

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: true

env:
  PUSH: ${{ github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/v') || startsWith(github.ref, 'refs/tags/') || github.event_name == 'release') }}
  REGISTRY: ghcr.io

permissions:
  contents: read
  packages: write
  id-token: write

jobs:
  build:
    name: build ${{ matrix.image }}${{ matrix.variant != '' && format(' ({0})', matrix.variant) || '' }} ${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
    strategy:
      fail-fast: false
      matrix:
        image: [server, web, browser, sparse]
        platform: [linux/amd64, linux/arm64]
        variant: [""]
        include:
          - image: server
            dockerfile: docker/Dockerfile.server
          - image: web
            dockerfile: docker/Dockerfile.web
          - image: browser
            dockerfile: docker/Dockerfile.browser
          - image: sparse
            dockerfile: docker/Dockerfile.sparse
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
          # Browser single-engine variants
          - image: browser
            variant: chromium
            dockerfile: docker/Dockerfile.browser
            platform: linux/amd64
            runner: ubuntu-latest
          - image: browser
            variant: chromium
            dockerfile: docker/Dockerfile.browser
            platform: linux/arm64
            runner: ubuntu-24.04-arm
          - image: browser
            variant: firefox
            dockerfile: docker/Dockerfile.browser
            platform: linux/amd64
            runner: ubuntu-latest
          - image: browser
            variant: firefox
            dockerfile: docker/Dockerfile.browser
            platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set up Go
        if: matrix.image == 'server'
        uses: actions/setup-go@v5
        with:
          go-version: '1.25'
          cache: true

      - name: Pre-warm Go mod cache
        if: matrix.image == 'server'
        run: |
          mkdir -p .go-cache
          GOMODCACHE=$(pwd)/.go-cache go mod download

      - name: Login to Docker Hub
        if: env.PUSH == 'true'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        if: env.PUSH == 'true'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Resolve artifact key
        id: resolve
        run: |
          VARIANT="${{ matrix.variant }}"
          if [ -n "$VARIANT" ]; then
            ARTIFACT_KEY="${{ matrix.image }}-${VARIANT}"
          else
            ARTIFACT_KEY="${{ matrix.image }}"
          fi
          echo "artifact_key=${ARTIFACT_KEY}" >> "$GITHUB_OUTPUT"

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          platforms: ${{ matrix.platform }}
          outputs: ${{ env.PUSH == 'true' && format('type=image,"name={0}/{1}/{2}",push-by-digest=true,name-canonical=true,push=true,compression=zstd', env.REGISTRY, github.repository_owner, matrix.image) || '' }}
          build-contexts: ${{ matrix.image == 'server' && format('gomodcache={0}/.go-cache', github.workspace) || '' }}
          build-args: |
            VERSION=${{ github.ref_name }}
            COMMIT_HASH=${{ github.sha }}
            VITE_API_URL=/api
            VITE_AGENT_URL=/agent
            ${{ matrix.variant != '' && format('BROWSER_CORES={0}', matrix.variant) || '' }}
          cache-from: |
            type=gha,scope=${{ steps.resolve.outputs.artifact_key }}-${{ matrix.platform }}
            type=registry,ref=${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.image }}:buildcache-${{ steps.resolve.outputs.artifact_key }}-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
          cache-to: |
            type=gha,scope=${{ steps.resolve.outputs.artifact_key }}-${{ matrix.platform }},mode=max
            ${{ env.PUSH == 'true' && format('type=registry,ref={0}/{1}/{2}:buildcache-{3}-{4},mode=max,compression=zstd', env.REGISTRY, github.repository_owner, matrix.image, steps.resolve.outputs.artifact_key, matrix.platform == 'linux/amd64' && 'amd64' || 'arm64') || '' }}

      - name: Export digest
        if: env.PUSH == 'true'
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        if: env.PUSH == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: digests__${{ steps.resolve.outputs.artifact_key }}__${{ strategy.job-index }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: publish ${{ matrix.image }}${{ matrix.variant_label != '' && format(' ({0})', matrix.variant_label) || '' }}
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/v') || startsWith(github.ref, 'refs/tags/') || github.event_name == 'release')
    needs: build
    strategy:
      matrix:
        include:
          - image: server
            artifact_key: server
            variant_label: ""
            raw_tag_prefix: ""
            tag_suffix: ""
          - image: web
            artifact_key: web
            variant_label: ""
            raw_tag_prefix: ""
            tag_suffix: ""
          - image: browser
            artifact_key: browser
            variant_label: ""
            raw_tag_prefix: ""
            tag_suffix: ""
          - image: browser
            artifact_key: browser-chromium
            variant_label: chromium
            raw_tag_prefix: "chromium-"
            tag_suffix: "-chromium"
          - image: browser
            artifact_key: browser-firefox
            variant_label: firefox
            raw_tag_prefix: "firefox-"
            tag_suffix: "-firefox"
          - image: sparse
            artifact_key: sparse
            variant_label: ""
            raw_tag_prefix: ""
            tag_suffix: ""
    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests__${{ matrix.artifact_key }}__*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            memohai/${{ matrix.image }}
            ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
          tags: |
            type=raw,value=${{ matrix.raw_tag_prefix }}dev,enable=${{ github.ref == 'refs/heads/main' }}
            type=raw,value=${{ matrix.raw_tag_prefix }}${{ github.ref_name }}-dev,enable=${{ startsWith(github.ref, 'refs/heads/v') }}
            type=raw,value=${{ matrix.raw_tag_prefix }}latest,enable=${{ github.event_name == 'release' || (startsWith(github.ref, 'refs/tags/') && !contains(github.ref_name, '-')) }}
            type=ref,event=pr
            type=semver,pattern={{version}}${{ matrix.tag_suffix }}
            type=semver,pattern={{major}}.{{minor}}${{ matrix.tag_suffix }}
            type=semver,pattern={{major}}${{ matrix.tag_suffix }}

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf 'ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}@sha256:%s ' *)
        env:
          DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta.outputs.json }}