publish.yaml

name: publish

# Build, test and publish official Docker images.
# - Triggers: Pushes to master and scheduled weekly runs.
# - Runs on: Only the official repository (FirebirdSQL/firebird-docker)
#
# Multi-arch: builds amd64 and arm64 natively on separate runners,
# pushes images by digest (no staging tags), then assembles multi-arch
# manifests via `docker buildx imagetools create`.

on:
  push:
    branches:
      - master

  schedule:
    - cron: "0 0 * * 1"  # Every Monday at midnight

  workflow_dispatch:  # Allows manual dispatch

# Only a single instance of this workflow can be in execution at a given time.
concurrency:
  group: ${{ github.workflow }}

jobs:
  build-and-test:
    if: ${{ github.repository == 'FirebirdSQL/firebird-docker' }}
    strategy:
      fail-fast: false
      matrix:
        arch: [amd64, arm64]
        include:
          - arch: amd64
            runner: ubuntu-latest
          - arch: arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Install tools
        shell: pwsh
        run: |
          Install-Module InvokeBuild -Force
          Install-Module PSFirebird -MinimumVersion '1.0.0' -Force

      - name: Build
        shell: pwsh
        run: |
          Invoke-Build Build

      - name: Test
        shell: pwsh
        run: |
          Invoke-Build Test

      - name: Run tag unit tests
        # Verifies Get-ImageTags produces correct Docker tags (pure logic, no Docker required).
        # Tag logic is arch-independent — run once on amd64 to avoid duplication.
        if: matrix.arch == 'amd64'
        shell: pwsh
        run: |
          Install-Module Pester -Force -SkipPublisherCheck
          Invoke-Pester src/tags.tests.ps1 -Output Detailed -CI

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Push image digests
        shell: pwsh
        run: |
          Invoke-Build Push-Digests

      - name: Upload digests
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ matrix.arch }}
          path: generated/digests-*.json
          if-no-files-found: error
          retention-days: 1

  create-manifests:
    if: ${{ github.repository == 'FirebirdSQL/firebird-docker' }}
    needs: build-and-test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download digests
        uses: actions/download-artifact@v8
        with:
          path: generated
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Install tools
        shell: pwsh
        run: |
          Install-Module InvokeBuild -Force
          Install-Module PSFirebird -MinimumVersion '1.0.0' -Force

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Create and push multi-arch manifests
        shell: pwsh
        run: |
          Invoke-Build Publish-Manifests

  # Generates all Dockerfiles and updates README.md, then commits them back to the repo.
  # This ensures Dockerfile links in README.md are always valid on GitHub.
  update-repo:
    if: ${{ github.repository == 'FirebirdSQL/firebird-docker' }}
    needs: create-manifests
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install tools
        shell: pwsh
        run: |
          Install-Module InvokeBuild -Force
          Install-Module PSFirebird -MinimumVersion '1.0.0' -Force

      - name: Generate Dockerfiles and update README
        shell: pwsh
        run: |
          Invoke-Build Prepare
          Invoke-Build Update-Readme

      - name: Commit and push changes
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add generated/ README.md
          if git diff --cached --quiet; then
            echo "No changes to commit"
          else
            git commit -m "chore: update generated Dockerfiles and README [skip ci]"
            git push
          fi