docker.yml

---
name: Docker

# This workflow builds and pushes docker images to dockerhub
#
# Summary
#
# job docker-os-matrix:
# * creates tags <version>-alpine, <version>-debian and <version>-ubuntu for each release
# * creates tags <branch_name>-alpine, <branch_name>-debian and <branch_name>-ubuntu for all triggered branches
# * creates tags current-alpine, current-debian and current-ubuntu for releasebranch_8_3
# * creates tag latest for last stable release with ubuntu os

on:
  push:
    branches:
      - main
      - releasebranch_*
      - "!releasebranch_7_*"
    # tags: ['*.*.*']
    paths-ignore: [doc/**]
  pull_request:
    paths:
      - .github/workflows/docker.yml
      - Dockerfile
      - docker/**
      - "!docker/**.md"
  workflow_dispatch:
  release:
    types: [published]

permissions: {}

jobs:
  # Run for push to configured branches and all published releases.
  # Take care of different os.
  # For main branch, created tags are:
  #     main-alpine, main-debian, main-ubuntu
  # For releasebranch_8_3, created tags are:
  #     current-alpine, current-debian, current-ubuntu,
  #     releasebranch_8_3-alpine, releasebranch_8_3-debian, releasebranch_8_3-ubuntu
  # For a release, e.g. 8.3.0, created tags are:
  #     8.3.0-alpine, 8.3.0-debian, 8.3.0-ubuntu and latest (with ubuntu)
  build:
    runs-on: ubuntu-latest
    concurrency:
      group: >-
        ${{ github.workflow }}-${{ matrix.name }}-${{ github.event_name }}-
        ${{ github.event_name == 'pull_request' && github.head_ref || github.ref }}
      # Cancel in progress in pull requests.
      # Otherwise, limit to one in progress and one queued for each type.
      # Only the latest queued job per event type will be kept, older will be cancelled.
      # The already running job will be completed.
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: alpine
            os: alpine
            dockerfile: docker/alpine/Dockerfile
            build_args: |-
              GUI=without
          - name: debian
            os: debian
            dockerfile: docker/debian/Dockerfile
            build_args: |-
              GUI=without
          - name: ubuntu
            os: ubuntu
            dockerfile: docker/ubuntu/Dockerfile
            build_args: |-
              GUI=without
          - name: ubuntu_wxgui
            os: ubuntu
            dockerfile: docker/ubuntu/Dockerfile
            build_args: |-
              GUI=with

    permissions:
      artifact-metadata: write # For actions/attest-build-provenance
      attestations: write
      contents: read
      id-token: write
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false
      - name: Get the latest tag and release branches
        id: tag-branch
        run: |
          # Make sure tags are fetched
          git fetch --tags
          # Get sorted list of tags, keep the first that has a semver pattern (not RCs)
          latest_tag="$(git tag --sort=-v:refname \
            | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
            | head -n 1)"
          echo "latest_tag=${latest_tag}" >> "${GITHUB_OUTPUT}"
          echo "latest_tag is: ${latest_tag}"
          if [ -z "$latest_tag" ]; then
              echo "Error getting latest tag information"
              echo "error_latest=yes" >> "${GITHUB_OUTPUT}"
              exit 0
          fi
          latest_rel_branch="$(git branch --all --list 'origin/releasebranch_[0-9]_[0-9]' \
            --contains "${latest_tag}" --format "%(refname:lstrip=3)" || echo "")"
          echo "latest_rel_branch=${latest_rel_branch}" >> "${GITHUB_OUTPUT}"
          echo "latest_rel_branch is: ${latest_rel_branch}"
          if [ -z "$latest_rel_branch" ]; then
              echo "Error getting latest release branch information"
              echo "error_latest_rel_branch=yes" >> "${GITHUB_OUTPUT}"
              exit 0
          fi
          echo "error_latest=no" >> "${GITHUB_OUTPUT}"
          echo "error_latest_rel_branch=no" >> "${GITHUB_OUTPUT}"
      - name: Get enable values for meta step
        id: enable
        run: |
          latest="${{
            (github.ref || format('{0}{1}', 'refs/tags/', github.event.release.tag_name))
              == format('refs/tags/{0}', steps.tag-branch.outputs.latest_tag)
            && matrix.name == 'ubuntu' && steps.tag-branch.outputs.error_latest == 'no' }}"
          current="${{
            ( contains(fromJSON('["tag", "release"]'), github.event_name)
              && (github.ref || format('{0}{1}', 'refs/tags/', github.event.release.tag_name))
                  == format('refs/tags/{0}', steps.tag-branch.outputs.latest_tag)
            )
            || ( github.ref == format('refs/heads/{0}', steps.tag-branch.outputs.latest_rel_branch)
                  && steps.tag-branch.outputs.error_latest == 'no'
                  && steps.tag-branch.outputs.error_latest_rel_branch == 'no'
                )
          }}"
          echo "latest=${latest}" >> "${GITHUB_OUTPUT}"
          echo "latest is ${latest}"
          echo "current=${current}" >> "${GITHUB_OUTPUT}"
          echo "current is ${current}"
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: |
            name=docker.io/osgeo/grass-gis,enable=${{ github.repository_owner == 'OSGeo'
              && github.event_name != 'pull_request' }}
            name=ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=tag
            type=ref,event=branch
            type=ref,event=pr
            type=raw,value=current,enable=${{ steps.enable.outputs.current }}
            type=raw,value=latest,enable=${{ steps.enable.outputs.latest }},suffix=
          flavor: |
            latest=false
            suffix=-${{ matrix.name }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      - name: Login to GitHub Container Registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Docker Hub
        if: ${{ github.repository_owner == 'OSGeo' && github.event_name != 'pull_request' }}
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN  }}
      - name: Build and push
        id: docker_build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          push: ${{ github.event_name != 'pull_request' }}
          context: .
          build-args: ${{ matrix.build_args }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          file: ${{ matrix.dockerfile }}
          annotations: ${{ steps.meta.outputs.annotations }}
          provenance: mode=max
          sbom: true
          # Don't use cache for releases.
          no-cache: ${{ contains(fromJSON('["tag", "release"]'), github.event_name) && true }}
          # Don't use gha cache for releases. Cache is not used if `cache-from:` is empty
          cache-from: >-
            ${{ !contains(fromJSON('["tag", "release"]'), github.event_name)
                && format('type=gha,scope={0}', matrix.os) || '' }}
          cache-to: type=gha,mode=max,scope=${{ matrix.os }}
      - name: Image digest
        run: echo "${STEPS_DOCKER_BUILD_OUTPUTS_DIGEST}"
        env:
          STEPS_DOCKER_BUILD_OUTPUTS_DIGEST: ${{ steps.docker_build.outputs.digest }}
      - name: Attest docker.io image
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        # If there isn't a digest, an annotation cannot be added
        if: >-
          ${{ github.repository_owner == 'OSGeo' && github.event_name != 'pull_request'
            && steps.docker_build.outputs.digest }}
        id: attest
        with:
          subject-name: docker.io/osgeo/grass-gis
          subject-digest: ${{ steps.docker_build.outputs.digest }}
          push-to-registry: ${{ github.repository_owner == 'OSGeo' && github.event_name != 'pull_request' }}
      - name: Attest ghcr.io image
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        # If there isn't a digest, an annotation cannot be added
        if: ${{ steps.docker_build.outputs.digest }}
        id: attest-ghcr
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.docker_build.outputs.digest }}
          push-to-registry: ${{ github.event_name != 'pull_request' }}