build-docker.yml

name: Build and Push Docker Images
permissions:
  contents: write
  packages: write
  id-token: write

on:
  workflow_run:
    workflows: ["Release"]
    types: [completed]
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  ORGANIZATION: 256foundation

jobs:
  build:
    name: Build Docker Images
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
    permissions:
      contents: read
      packages: write
      id-token: write
    
    strategy:
      matrix:
        component: [hydrapool, grafana, prometheus]
        include:
          - component: hydrapool
            dockerfile: docker/Dockerfile.hydrapool
            context: .
            image_name: hydrapool
          - component: grafana
            dockerfile: docker/Dockerfile.grafana
            context: .
            image_name: hydrapool-grafana
          - component: prometheus
            dockerfile: docker/Dockerfile.prometheus
            context: .
            image_name: hydrapool-prometheus

    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.workflow_run.head_sha || github.ref }}
          fetch-depth: 0

      - name: Get release tag
        id: get_tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_run" ]; then
            TAG=$(git describe --tags --exact-match ${{ github.event.workflow_run.head_sha }} 2>/dev/null || echo "")
            if [ -z "$TAG" ]; then
              echo "No tag found for commit, using sha"
              TAG="${{ github.event.workflow_run.head_sha }}"
            fi
          else
            TAG="${{ github.ref_name }}"
          fi
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "Found tag: $TAG"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Login to GitHub Container Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.ORGANIZATION }}/${{ matrix.image_name }}
          tags: |
            type=semver,pattern={{version}},value=${{ steps.get_tag.outputs.tag }}
            type=semver,pattern={{major}}.{{minor}},value=${{ steps.get_tag.outputs.tag }}
            type=raw,value=latest
            type=sha
          labels: |
            org.opencontainers.image.description=Hydrapool ${{ matrix.component }} image
            org.opencontainers.image.vendor=${{ env.ORGANIZATION }}
            org.opencontainers.image.licenses=AGPL-3.0
            org.opencontainers.image.visibility=public

      - name: Build and push
        id: build
        uses: docker/build-push-action@v3
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.dockerfile }}
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Sign the images
        if: github.event_name != 'pull_request'
        run: |
          images="${{ steps.meta.outputs.tags }}"
          for tag in ${images}; do
            echo "Signing ${tag}@${{ steps.build.outputs.digest }}"
            cosign sign --yes "${tag}@${{ steps.build.outputs.digest }}"
          done
        env:
          COSIGN_EXPERIMENTAL: 1