name: Docker

on:
  push:
    branches:
      - main
  pull_request:
    paths:
      - '.github/workflows/docker.yml'
      - 'Dockerfile'
  workflow_call:
    inputs:
      tag:
        description: 'Docker tag'
        required: true
        type: string
  workflow_dispatch:
    inputs:
      tag:
        description: 'Docker tag'
        required: true
        type: string

jobs:
  set-context:
    name: Set Context
    runs-on: ubuntu-slim
    permissions: {}
    outputs:
      checkout-ref: ${{ steps.vars.outputs.checkout-ref }}
      docker-tag: ${{ steps.vars.outputs.docker-tag }}
      repository-lc: ${{ steps.vars.outputs.repository-lc }}
    steps:
      - name: Define variables
        id: vars
        run: |
          if [[ "${{ github.event_name }}" == "push" ]]; then
            {
              echo "checkout-ref=main"
              echo "docker-tag=latest"
            } >> "$GITHUB_OUTPUT"
          elif [[ "${{ github.event_name }}" == "pull_request" ]]; then
            {
              echo "checkout-ref=pr"
              echo "docker-tag=pr-${{ github.event.pull_request.number }}"
            } >> "$GITHUB_OUTPUT"
          else
            {
              echo "checkout-ref=${INPUTS_TAG}"
              echo "docker-tag=${INPUTS_TAG}"
            } >> "$GITHUB_OUTPUT"
          fi
          echo "repository-lc=${REPOSITORY,,}" >> "$GITHUB_OUTPUT"
        env:
          REPOSITORY: ${{ github.repository }}
          INPUTS_TAG: ${{ inputs.tag }}

  build-amd64:
    name: Build AMD64 Image
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    needs: set-context
    steps:
      - &checkout-step-pr
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: needs.set-context.outputs.checkout-ref == 'pr'
        with:
          persist-credentials: false
      - &checkout-step-ref
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: needs.set-context.outputs.checkout-ref != 'pr'
        with:
          ref: ${{ needs.set-context.outputs.checkout-ref }}
          persist-credentials: false
      - uses: ./.github/actions/docker-build
        with:
          platform: amd64
          token: ${{ secrets.GITHUB_TOKEN }}

  build-arm64:
    name: Build ARM64 Image
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: read
      packages: write
    needs: set-context
    steps:
      - *checkout-step-pr
      - *checkout-step-ref
      - uses: ./.github/actions/docker-build
        with:
          platform: arm64
          token: ${{ secrets.GITHUB_TOKEN }}

  merge:
    name: Create Multi-Platform Image
    runs-on: ubuntu-24.04
    permissions:
      packages: write
    needs:
      - set-context
      - build-amd64
      - build-arm64
    steps:
    - name: Download digests
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        path: /tmp/digests
        pattern: digests-*
        merge-multiple: true
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
    - name: Login to GitHub registry
      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
      with:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
        registry: ghcr.io
    - name: Create manifest list and push
      working-directory: /tmp/digests
      run: >-
        docker buildx imagetools create
        -t "ghcr.io/${{ needs.set-context.outputs.repository-lc }}:${{ needs.set-context.outputs.docker-tag }}"
        $(printf 'ghcr.io/${{ needs.set-context.outputs.repository-lc }}@sha256:%s ' *)