docker.yml

name: Build and Push Docker Image

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      version:
        description: 'Already published version to rebuild (e.g. 2026.9.4)'
        required: true

permissions:
  contents: read
  security-events: write

jobs:
  docker:
    runs-on: ubuntu-26.04
    steps:
      # The tag being built, not the default branch. The image is built from this
      # checkout now, so a dispatched rebuild of an older version has to stand on
      # that version's tag — otherwise it would tag main's code with an old
      # release's number. On a release event this is the tag anyway; naming it
      # keeps the two paths the same.
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.version || github.ref }}

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Extract version
        id: version
        env:
          RAW: ${{ github.event_name == 'workflow_dispatch' && inputs.version || github.ref_name }}
        run: echo "VERSION=${RAW#v}" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Login to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            maksimtech/patchradar:latest
            maksimtech/patchradar:${{ steps.version.outputs.VERSION }}
          # From the source this tag points at, not from the index.
          #
          # This step used to install patchradar==<the new version> from PyPI while
          # publish.yml was still uploading it. A fixed `sleep 60` lost that race
          # (2026.9.4), polling the index narrowed it, and apkradar still lost it by
          # fifteen seconds on 2026-10-03 — because the poll runs on the runner and
          # the multi-platform build resolves the index again, per platform, from
          # whichever edge answers. Nothing that waits can close that; not asking
          # does.
          #
          # `local` is the branch docker-build-check.yml builds, and that workflow now
          # runs on every push and pull request rather than by hand alone. It had to:
          # this workflow publishes as it builds, so until then the first attempt at
          # building the image was the one that released it.
          build-args: |
            PATCHRADAR_SOURCE=local
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Docker Scout CVE scan
        uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0
        with:
          command: cves
          image: maksimtech/patchradar:${{ steps.version.outputs.VERSION }}
          only-severities: critical,high
          exit-code: false
          sarif-file: scout-results.sarif
      - name: Upload Scout SARIF
        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        if: always()
        with:
          sarif_file: scout-results.sarif