docker.yml

name: Build and push docker image

on:
  workflow_run:
    workflows: [ "Build and Release" ]
    types: [ completed ]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Image tag to build and push'
        required: true
        default: 'latest'
      publish_latest:
        description: 'Also update latest for a stable version tag'
        required: false
        type: boolean
        default: false
      use_release_binaries:
        description: 'Package published static binaries for a stable version tag'
        required: false
        type: boolean
        default: false

permissions:
  contents: read

# workflow_run is an automatic trigger, so this job cannot use a GitHub-hosted
# runner. Image builds need a Docker daemon, which only the dind label provides.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_sha || github.sha }}
  cancel-in-progress: false

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  build-and-push:
    if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
    runs-on: dind-sm-standard-2
    timeout-minutes: 60

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}

      - name: Resolve image tags
        id: image
        env:
          EVENT_NAME: ${{ github.event_name }}
          MANUAL_TAG: ${{ github.event.inputs.tag }}
          PUBLISH_LATEST: ${{ github.event.inputs.publish_latest }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
            image_tag="$MANUAL_TAG"
          else
            workspace_version=$(awk -F'"' '/^version = "/ { print $2; exit }' Cargo.toml)
            image_tag="v${workspace_version}"
          fi

          if [[ ! "$image_tag" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]]; then
            echo "Invalid Docker image tag: $image_tag"
            exit 1
          fi

          {
            echo "version=${image_tag#v}"
            echo "version_tag=${image_tag}"
            echo 'tags<<EOF'
            echo "rustfs/rc:${image_tag}"
            if [[ ( "$EVENT_NAME" == "workflow_run" || "$PUBLISH_LATEST" == "true" ) && "$image_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo 'rustfs/rc:latest'
            fi
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

      - name: Install release download tools
        if: github.event.inputs.use_release_binaries == 'true'
        uses: ./.github/actions/setup-self-hosted
        with:
          profile: github-cli file

      - name: Prepare release binaries
        if: github.event.inputs.use_release_binaries == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ steps.image.outputs.version_tag }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Release binary images require a stable version tag"
            exit 1
          fi

          release_dir=$(mktemp -d)
          trap 'rm -rf "$release_dir"' EXIT
          for arch in amd64 arm64; do
            archive="rustfs-cli-linux-${arch}-${RELEASE_TAG}.tar.gz"
            gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \
              --pattern "$archive" --pattern "$archive.sha256" --dir "$release_dir"
            (cd "$release_dir" && sha256sum --check "$archive.sha256")
            mkdir -p "release-binaries/$arch"
            tar -xzOf "$release_dir/$archive" rc > "release-binaries/$arch/rc"
            chmod 755 "release-binaries/$arch/rc"
            binary_info=$(file -b "release-binaries/$arch/rc")
            if ! grep -Eiq 'statically linked|static-pie linked' <<< "$binary_info"; then
              echo "Release binary must be statically linked: $arch"
              exit 1
            fi
            case "$arch" in
              amd64) machine='x86-64' ;;
              arm64) machine='aarch64' ;;
            esac
            if ! grep -Eiq "ELF 64-bit.*$machine" <<< "$binary_info"; then
              echo "Release binary has an unexpected architecture: $arch"
              exit 1
            fi
          done

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Log in to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          file: ${{ github.event.inputs.use_release_binaries == 'true' && 'Dockerfile.release' || 'Dockerfile' }}
          build-args: ${{ github.event.inputs.use_release_binaries == 'true' && format('RC_VERSION={0}', steps.image.outputs.version) || '' }}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.image.outputs.tags }}