docker-publish.yml

name: Docker

on:
  release:
    types:
      - published
  push:
    branches:
      - master
    tags: '*'
    paths:
      - Dockerfile
      - cronitor.py
      - entrypoint.sh
      - release
      - beta-release
      - .github/workflows/docker-publish.yml
  pull_request:
    types:
      - opened
      - synchronize
    paths:
      - Dockerfile
      - cronitor.py
      - entrypoint.sh
      - release
      - beta-release
      - .github/workflows/docker-publish.yml

# Define environment variables
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  codeql:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: 3.11
      - uses: github/codeql-action/init@v3
        with:
          languages: python
      - uses: github/codeql-action/autobuild@v3
      - uses: github/codeql-action/analyze@v3

  build-stable:
    if: |
      github.repository == '${{ github.repository }}' &&
      (
        github.event_name == 'push' ||
        github.event_name == 'release' ||
        (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
      )
    needs: [codeql]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log into registry ${{ env.REGISTRY }}
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: groenator
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set release tag as environment variable
        id: set-stable-tag
        run: |
          echo -e "LATEST_TAG=$(cat release)" >> $GITHUB_ENV

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          flavor: |
            latest=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
          images: |
            ghcr.io/groenator/iptvboss-docker
          tags: |
            type=ref,event=pr
            type=semver,pattern=v{{major}}.{{minor}}.{{patch}}
            type=semver,pattern=v{{major}}.{{minor}}
            type=semver,pattern=v{{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v') }}
            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
            type=raw,value=${{ env.LATEST_TAG }},enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}

      # Build and push Stable Image
      - name: Short commit
        id: shortcommit
        run: echo "{name}={value}::$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Build and push final image
        uses: docker/build-push-action@v5
        with:
          platforms: linux/amd64,linux/arm64
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            LATEST_TAG=${{ env.LATEST_TAG }}
          tags: ${{ steps.meta.outputs.tags }}
          push: true
          context: .
      - name: Clean Buildx Cache
        run: docker buildx prune -f --all

  build-beta:
    if: |
      github.repository == '${{ github.repository }}' &&
      (
        github.event_name == 'push' ||
        github.event_name == 'release' ||
        (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
      )
    needs: [codeql]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log into registry ${{ env.REGISTRY }}
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: groenator
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set release tag as environment variable
        id: set-beta-tag
        run: |
          echo -e "BETA_TAG=$(cat beta-release)" >> $GITHUB_ENV

      - name: Extract Docker metadata
        id: meta-beta
        uses: docker/metadata-action@v5
        with:
          flavor: |
            beta-latest=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
          images: |
            ghcr.io/groenator/iptvboss-docker-beta
          tags: |
            type=ref,event=pr
            type=semver,pattern=v{{major}}.{{minor}}
            type=semver,pattern=v{{major}}.{{minor}}.{{patch}}
            type=semver,pattern=v{{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v') }}
            type=raw,value=beta-latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
            type=raw,value=${{ env.BETA_TAG }},enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}

      # Build and push Beta Image
      - name: Short commit
        id: shortcommit
        run: echo "{name}={value}::$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Build and push final image
        uses: docker/build-push-action@v5
        with:
          platforms: linux/amd64,linux/arm64
          labels: ${{ steps.meta-beta.outputs.labels }}
          build-args: |
            BETA_TAG=${{ env.BETA_TAG }}
          tags: ${{ steps.meta-beta.outputs.tags }}
          push: true
          context: .
      - name: Clean Buildx Cache
        run: docker buildx prune -f --all