latest.yaml

name: Publish latest to Docker Hub

# Replaces Docker Hub's Automated Builds, which retires on 2027-04-01:
# https://docs.docker.com/docker-hub/repos/manage/builds/migrate/

on:
  push:
    branches:
      - master

permissions:
  contents: read

# Back-to-back merges must not publish an older commit's build as `latest`.
concurrency:
  group: dockerhub-latest-${{ github.ref }}
  cancel-in-progress: true

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    environment: dockerhub-publish
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Build and test the image
        uses: ./.github/actions/build-test

      # `password` is omitted deliberately: setting it switches the action out of
      # OIDC mode and back to static credentials.
      - name: Log in to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        env:
          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
        with:
          username: civisanalytics

      # `provenance: false` keeps this a plain single-platform manifest. Buildx
      # otherwise attaches attestations as extra manifests inside an image index,
      # which not every client that pulls this image can handle.
      - name: Build and push
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          target: production
          push: true
          tags: civisanalytics/datascience-python:latest
          provenance: false
          sbom: false