docker-publish.yml

name: Publish Docker Image

on:
  schedule:
    - cron: '40 2 * * *'
  pull_request:
    branches:
      - main
    paths:
      - Dockerfile
      - rootfs/**
  push:
    branches:
      - main
    paths:
      - Dockerfile
      - rootfs/**
  workflow_dispatch:

env:
  IMAGE_BASE: library/debian:stable-slim
  REPO_NAME: ${{ github.event.repository.name }}
  REGISTRY_URL: ${{ github.event_name != 'pull_request' &&
                    'docker.io' ||
                    'ghcr.io' }}
  REGISTRY_USERNAME: ${{ github.event_name != 'pull_request' &&
                         secrets.DOCKERHUB_USERNAME ||
                         github.repository_owner }}
  REGISTRY_PASSWORD: ${{ github.event_name != 'pull_request' &&
                         secrets.DOCKERHUB_PASSWORD ||
                         secrets.GITHUB_TOKEN }}

jobs:

  variables:
    runs-on: ubuntu-latest
    outputs:
      image_name: ${{ steps.split.outputs.image_name }}
    steps:
      - name: Set name of image
        if: github.event_name != 'pull_request'
        id: split
        run: echo "image_name=${REPO_NAME#*-}" >> $GITHUB_OUTPUT

  check:
    needs: variables
    runs-on: ubuntu-latest
    env:
      IMAGE_NAME: ${{ needs.variables.outputs.image_name }}
    outputs:
      image-needs-updating: ${{ steps.check.outputs.needs-updating }}
    steps:
      - name: Check if update available
        id: check
        uses: lucacome/docker-image-update-checker@v1.2.1
        with:
          base-image: ${{ env.IMAGE_BASE }}
          image: ${{ env.REGISTRY_USERNAME }}/${{ env.IMAGE_NAME }}
        if: github.event_name == 'schedule'

  build:

    needs: [check, variables]

    env:
      IMAGE_NAME: ${{ needs.variables.outputs.image_name }}

    if: |
      github.event_name != 'schedule' ||
      needs.check.outputs.image-needs-updating == 'true'

    runs-on: ubuntu-latest
    permissions:
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log into registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY_URL }}
          username: ${{ env.REGISTRY_USERNAME }}
          password: ${{ env.REGISTRY_PASSWORD }}

      - name: Extract Docker metadata
        if: github.event_name != 'pull_request'
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.REGISTRY_URL }}/${{ env.REGISTRY_USERNAME }}/${{ env.IMAGE_NAME }}
          flavor: |
            latest=false
          labels: |
            org.opencontainers.image.base.name=docker.io/${{ env.IMAGE_BASE }}
          tags: |
            type=sha
            type=schedule,pattern={{date 'YYYYMMDD'}}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Extract Docker PR tag
        if: github.event_name == 'pull_request'
        id: meta_pr
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.REGISTRY_URL }}/${{ env.REGISTRY_USERNAME }}/${{ env.REPO_NAME }}
          flavor: |
            latest=false
          tags: |
            type=sha
            type=ref,event=pr

      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@v5
        env:
          ACTIONS_RUNTIME_TOKEN: ''
        with:
          context: .
          build-args: |
            BASE_IMAGE=${{ env.IMAGE_BASE }}
          push: true
          tags: |
            ${{ steps.meta.outputs.tags }}
            ${{ steps.meta_pr.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}