docker.yml

name: Build and Publish Multi-Arch Docker Image

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      platforms:
        description: 'Platforms to build (comma-separated)'
        default: 'linux/amd64,linux/arm64,linux/arm/v7'
        required: false
        type: string
      release_tag:
        description: 'Release version tag (e.g., 1.2.3). If provided, also tags as latest.'
        required: false
        type: string

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/autonomy-logic/openplc-runtime
          tags: |
            # latest tag only for stable releases (no pre-release suffix like -rc, -beta, etc.)
            type=raw,value=latest,enable=${{ (startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-')) || inputs.release_tag != '' }}
            # Version tag from git tag (e.g., v1.2.3 -> v1.2.3, v1.2.3-rc.1 -> v1.2.3-rc.1)
            type=semver,pattern={{raw}}
            # Version tag for manual runs with release_tag
            type=raw,value=${{ inputs.release_tag }},enable=${{ inputs.release_tag != '' }}

      - name: Build and Push Multi-Arch Image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          platforms: ${{ inputs.platforms || 'linux/amd64,linux/arm64,linux/arm/v7' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # Bake the GitHub release tag (or the workflow_dispatch
          # release_tag override) into the image so /api/version can
          # report it back to clients.  Falls back to the Dockerfile
          # default ("dev") for ad-hoc builds without a release tag.
          build-args: |
            RUNTIME_VERSION=${{ inputs.release_tag != '' && inputs.release_tag || github.ref_name }}