docker.yml

name: Docker

on:
  pull_request:
  push:
    branches:
      - master
  merge_group:
  release:
    types:
      - published

permissions:
  contents: read

jobs:
  ubuntu:
    if: github.repository_owner == 'Homebrew'
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        version: ["18.04", "20.04", "22.04", "24.04"]
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Fetch origin/master from Git
        run: git fetch origin master

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3

      - name: Determine build attributes
        id: attributes
        run: |
          date="$(date --rfc-3339=seconds --utc)"
          brew_version="$(git describe --tags --dirty --abbrev=7)"

          DELIMITER="END_LABELS_$(LC_ALL=C tr -dc '[:alnum:]' </dev/urandom | head -c20)"
          cat <<EOS | tee -a "${GITHUB_OUTPUT}"
          labels<<${DELIMITER}
          org.opencontainers.image.created=${date}
          org.opencontainers.image.url=https://brew.sh
          org.opencontainers.image.documentation=https://docs.brew.sh
          org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}
          org.opencontainers.image.version=${brew_version}
          org.opencontainers.image.revision=${GITHUB_SHA}
          org.opencontainers.image.vendor=${GITHUB_REPOSITORY_OWNER}
          org.opencontainers.image.licenses=BSD-2-Clause
          ${DELIMITER}
          EOS

          tags=()
          if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
            tags+=(
              "ghcr.io/homebrew/ubuntu${{matrix.version}}:${brew_version}"
              "ghcr.io/homebrew/ubuntu${{matrix.version}}:latest"
              "homebrew/ubuntu${{matrix.version}}:${brew_version}"
              "homebrew/ubuntu${{matrix.version}}:latest"
            )
            if [[ "${{ matrix.version }}" == "22.04" ]]; then
              tags+=(
                "ghcr.io/homebrew/brew:${brew_version}"
                "ghcr.io/homebrew/brew:latest"
                "homebrew/brew:${brew_version}"
                "homebrew/brew:latest"
              )
            fi
          elif [[ "${GITHUB_EVENT_NAME}" == "push" &&
                  "${GITHUB_REF}" == "refs/heads/master" &&
                  "${{ matrix.version }}" == "22.04" ]]; then
            tags+=(
              "ghcr.io/homebrew/ubuntu${{ matrix.version }}:master"
              "homebrew/ubuntu${{matrix.version}}:master"
            )
          fi

          {
            if [[ "${#tags[@]}" -ne 0 ]]; then
              DELIMITER="END_TAGS_$(LC_ALL=C tr -dc '[:alnum:]' </dev/urandom | head -c20)"
              echo "tags<<${DELIMITER}"
              printf "%s\n" "${tags[@]}"
              echo "${DELIMITER}"
              echo "push=true"
            else
              echo "push=false"
            fi
          } | tee -a "${GITHUB_OUTPUT}"

      - name: Build Docker image
        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6
        with:
          context: .
          load: true
          tags: brew
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: version=${{ matrix.version }}
          labels: ${{ steps.attributes.outputs.labels }}

      - name: Run brew test-bot --only-setup
        run: docker run --rm brew brew test-bot --only-setup

      - name: Log in to GitHub Packages
        if: steps.attributes.outputs.push == 'true'
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
        with:
          registry: ghcr.io
          username: BrewTestBot
          password: ${{ secrets.HOMEBREW_BREW_GITHUB_PACKAGES_TOKEN }}

      - name: Log in to Docker Hub
        if: steps.attributes.outputs.push == 'true'
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
        with:
          username: brewtestbot
          password: ${{ secrets.HOMEBREW_BREW_DOCKER_TOKEN }}

      - name: Deploy the tagged Docker image
        if: steps.attributes.outputs.push == 'true'
        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6
        with:
          context: .
          push: true
          tags: ${{ steps.attributes.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: version=${{ matrix.version }}
          labels: ${{ steps.attributes.outputs.labels }}