container.yml

name: Container

on:
  push:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  tagging:
    name: Determine Tags
    runs-on: ubuntu-20.04
    permissions:
      contents: read
      packages: read
    outputs:
      FINAL_TAG: ${{ steps.tags.outputs.FINAL_TAG }}
      SHA_TAG: ${{ steps.tags.outputs.SHA_TAG }}

    steps:
      - name: Log in to Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      - name: Extract Docker Metadata
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
        id: meta
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            # Tag event produce a semver tag. This will capture tags that begin
            # vX.Y.Z and X.Y.Z.
            type=semver,pattern={{version}},event=tag
            # All other push events (no PR, no semver tag), produce a SHA tag
            type=sha,format=long

      - name: Determine Final Tag
        id: tags
        run: |
          ALL_TAGS="${{ steps.meta.outputs.tags }}"
          SEMVER_TAG=$(echo "$ALL_TAGS" | grep -E '^ghcr.io/.+:[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?' || true)
          SHA_TAG=$(echo "$ALL_TAGS" | grep sha- || true)

          if [ -n "$SEMVER_TAG" ]; then
            FINAL_TAG="$SEMVER_TAG"
          else
            FINAL_TAG="$SHA_TAG"
          fi

          echo "SHA_TAG=$SHA_TAG" >> $GITHUB_OUTPUT
          echo "FINAL_TAG=$FINAL_TAG" >> $GITHUB_OUTPUT

      - name: Debug Tags
        run: |
          echo "SHA_TAG: ${{ steps.tags.outputs.SHA_TAG }}"
          echo "FINAL_TAG: ${{ steps.tags.outputs.FINAL_TAG }}"

  build:
    needs: tagging
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-20.04
          - arch: arm64
            runner: arm-4core-linux-ubuntu24.04
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          sparse-checkout: .

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      - name: Log in to the Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata for Docker
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
        id: meta
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,format=long

      - name: Build and push Docker image
        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
        with:
          file: Dockerfile
          tags: ${{ needs.tagging.outputs.SHA_TAG }}-${{ matrix.arch }}
          push: true
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=registry,ref=ghcr.io/datadog/lading:cache
          cache-to: type=registry,ref=ghcr.io/datadog/lading:cache,mode=max

  manifest:
    name: Create Multi-Arch Manifest
    needs: 
      - tagging
      - build
    runs-on: ubuntu-20.04
    permissions:
      contents: read
      packages: write

    steps:
      - name: Log in to Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      - name: Create and Push Multiarch Manifest
        run: |
          docker buildx imagetools create \
            --tag "${{ needs.tagging.outputs.FINAL_TAG }}" \
            "${{ needs.tagging.outputs.SHA_TAG }}-amd64" \
            "${{ needs.tagging.outputs.SHA_TAG }}-arm64"