docker.yml

name: Docker

# A pull request and a push to master build the image and smoke test it, so a
# Dockerfile that no longer builds is found before a release. Neither
# publishes: the image is published when the release workflow calls this one.
# The master build also keeps the layer cache warm, since a pull request and a
# tag can each read master's cache and neither can read the other's.
on:
  push:
    branches: [ "master" ]
  pull_request:
    branches: [ "master" ]
  workflow_call:
    inputs:
      release:
        description: Publish the image for this tag, and add it to the release notes
        type: boolean
        default: false

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}-lichess-bot

# a new push to the same ref makes the build in progress redundant
concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    # the arm64 half of the published image is built under emulation
    timeout-minutes: 90
    # the last two are for the attestation
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    outputs:
      digest: ${{ steps.push.outputs.digest }}
      # named here because a reusable workflow's inputs cannot read the env
      # context
      image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Read the engine version
        id: version
        run: |
          # the same read as tag-release.yml and prepare-release.yml. A grep
          # for the first version line finds `version.workspace = true`
          version=$(python3 -c "import tomllib; print(tomllib.load(open('Cargo.toml','rb'))['workspace']['package']['version'])")
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0

      - name: Build for testing
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: docker/Dockerfile
          build-args: ARCHE_VERSION=${{ steps.version.outputs.version }}
          load: true
          tags: arche-lichess-bot:test
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Smoke test
        run: docker/smoke_test.sh arche-lichess-bot:test

      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
        if: inputs.release

      - name: Log in to the container registry
        if: inputs.release
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Collect image metadata
        if: inputs.release
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=tag
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha

      - name: Build and push
        if: inputs.release
        id: push
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: docker/Dockerfile
          build-args: ARCHE_VERSION=${{ steps.version.outputs.version }}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          # Buildkit's own attestations, which travel in the image index and
          # are what `docker buildx imagetools inspect` reads. Only on this
          # step: the smoke test build loads into the local docker, and that
          # exporter takes neither.
          provenance: mode=max
          sbom: true

      # github's attestation, filed against this repository and looked up by
      # digest, which is what `gh attestation verify` asks for. push-to-registry
      # puts it beside the image as well. How to check it is in docs/LICHESS.md.
      - name: Attest the published image
        if: inputs.release
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

  release-notes:
    needs: build
    if: inputs.release
    permissions:
      contents: write
    uses: ./.github/workflows/release-note.yml
    with:
      marker: arche:image
      line: "Docker image: `${{ needs.build.outputs.image }}` (`${{ needs.build.outputs.digest }}`)"