name: Build

on:
  workflow_call:

env:
  DOCKER_META_IMAGES: |
    darthsim/imgproxy
    ghcr.io/imgproxy/imgproxy
  DOCKER_META_TAGS: |
    type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
    type=ref,event=branch,enable=${{ startsWith(github.ref, 'refs/heads/test/') }}
    type=ref,event=tag
    type=semver,pattern=v{{major}}.{{minor}}
    type=semver,pattern=v{{major}}

jobs:
  build:
    if: github.repository_owner == 'imgproxy'
    strategy:
      matrix:
        build:
          - arch: amd64
            dockerPlatform: linux/amd64
            image: linux-5.0
          - arch: arm64
            dockerPlatform: linux/arm64/v8
            image: arm-3.0
    runs-on:
      - codebuild-imgproxy-${{ github.run_id }}-${{ github.run_attempt }}
      - image:${{ matrix.build.image }}
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ${{ env.DOCKER_META_IMAGES }}
          tags: ${{ env.DOCKER_META_TAGS }}
          flavor: |
            latest=false
            suffix=-${{ matrix.build.arch }}

      - name: Login to Docker Hub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
        with:
          platforms: ${{ matrix.build.dockerPlatform }}

      - name: Build and push
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
          file: ./docker/Dockerfile
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          platforms: ${{ matrix.build.dockerPlatform }}
          provenance: false
          push: true
          outputs: type=image,oci-mediatypes=true

  push_manifests:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ${{ env.DOCKER_META_IMAGES }}
          tags: ${{ env.DOCKER_META_TAGS }}
          flavor: |
            latest=false
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: index

      - name: Login to Docker Hub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
        with:
          platforms: ${{ matrix.build.dockerPlatform }}

      - name: Push manifests
        run: |
          ANNOTATIONS=""
          for annotation in "${{ join(fromJSON(steps.meta.outputs.json).annotations, '" "') }}"
          do
            ANNOTATIONS="$ANNOTATIONS --annotation '$annotation'";
          done

          for tag in ${{ join(fromJSON(steps.meta.outputs.json).tags, ' ') }}
          do
            sh -c "docker buildx imagetools create ${ANNOTATIONS} -t $tag ${tag}-amd64 ${tag}-arm64"
          done

