build.yml

name: Build and Push Docker image

on:
  push:
    branches:
      - main
    tags:
      - '[0-9]+.[0-9]+.[0-9]+*'
    paths-ignore:
      - '**/*.md'
      - 'LICENSE'
      - '.editorconfig'
      - '.gitignore'
      - '.gitattributes'
      - '.pre-commit-config.yaml'
      - 'Taskfile.yml'
      - 'compose.yaml'
      - 'compose.*.yaml'
      - 'requirements.dev.txt'
      - 'tests/**'
      - 'scripts/**'
      - '.devcontainer/**'
      - '.github/**'
      - '!.github/workflows/build.yml'

env:
  CONTAINER_REPO_OWNER: toshy
  CONTAINER_APP_NAME: qr-code-api

jobs:
  build_and_push:
    name: Build and push image
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Resolve tags
        id: tags
        shell: bash
        run: |
          IMAGE="ghcr.io/${{ env.CONTAINER_REPO_OWNER }}/${{ env.CONTAINER_APP_NAME }}"
          TAGS=""

          if [ "${{ github.ref_type }}" = "tag" ]; then
            # Tag push: publish the version tag and (for stable semver) moving tags.
            VERSION_TAG="${{ github.ref_name }}"
            TAGS="$IMAGE:$VERSION_TAG"

            if [[ "$VERSION_TAG" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
              MAJOR="${BASH_REMATCH[1]}"
              MINOR="${BASH_REMATCH[2]}"
              TAGS="$TAGS"$'\n'"$IMAGE:$MAJOR"
              TAGS="$TAGS"$'\n'"$IMAGE:$MAJOR.$MINOR"

              # Only move :latest if this tag is the highest stable semver tag
              # in the repository. Prevents a slower-finishing maintenance
              # release (e.g. 1.2.4) from overwriting :latest after a newer
              # release (e.g. 2.0.2) was already published.
              HIGHEST_TAG=$(git tag -l \
                | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
                | sort -V | tail -1)
              if [ "$VERSION_TAG" = "$HIGHEST_TAG" ]; then
                TAGS="$TAGS"$'\n'"$IMAGE:latest"
              else
                echo "::notice title=Skipping :latest::$VERSION_TAG is not the highest stable tag (highest is $HIGHEST_TAG)"
              fi
            fi
          else
            # Branch push to main: publish a traceable :main-<sha> tag only.
            # :latest is intentionally release-driven (set only by stable tag pushes)
            # so that an unrelated commit on main doesn't overwrite a published release.
            SHORT_SHA="$(git rev-parse --short HEAD)"
            TAGS="$IMAGE:main-$SHORT_SHA"
          fi

          {
            echo "tags<<EOF"
            echo "$TAGS"
            echo "EOF"
          } >> $GITHUB_OUTPUT

      - name: Build Zensical site (required at runtime)
        shell: bash
        run: |
          MAJOR_VERSION=v$(ls -1 ./docs/version | grep -E '^v[0-9]+' | sed 's/^v//' | sort -n | tail -1)
          sed "s|\$MAJOR_VERSION|$MAJOR_VERSION|g" zensical.toml > .zensical.runtime.toml
          docker run --rm \
            -u "$(id -u):$(id -g)" \
            -v "${PWD}:/docs" \
            zensical/zensical:0.0 \
            build -f .zensical.runtime.toml
          rm -f .zensical.runtime.toml

      - uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push Image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          platforms: linux/amd64
          target: prod
          tags: ${{ steps.tags.outputs.tags }}