docker-build.yml

name: Build & Push Bluecherry (from .deb)

on:
  push:
    branches: [ "dev-ci", "master", "main" ]
    tags:     [ "v*" ]
  workflow_dispatch:
    inputs:
      deb_url:
        description: "Override .deb URL (optional)"
        required: false
      image_tag:
        description: "Override image tag (optional; otherwise auto)"
        required: false

concurrency:
  group: docker-build-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write

    env:
      DEFAULT_DEB_URL: http://dl.bluecherrydvr.com/pool/noble/bluecherry_3.1.14_amd64.deb
      IMAGE_NAME: bluecherrydvr/bluecherry

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # Decide the deb URL (input or default)
      - name: Decide deb url
        id: decide-deb
        run: |
          set -euo pipefail
          URL="${{ inputs.deb_url || env.DEFAULT_DEB_URL }}"
          echo "deb_url=${URL}" >> "$GITHUB_OUTPUT"
          echo "Using .deb: $URL"

      - name: Compute SHA256 of .deb
        id: sha
        run: |
          set -euo pipefail
          curl -fsSL "${{ steps.decide-deb.outputs.deb_url }}" -o /tmp/bluecherry.deb
          SHA="$(sha256sum /tmp/bluecherry.deb | awk '{print $1}')"
          echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
          echo "SHA256: $SHA"

      # Generate tags & labels automatically
      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.IMAGE_NAME }}
          labels: |
            org.opencontainers.image.title=Bluecherry
            org.opencontainers.image.description=Dockerized Bluecherry Server from .deb
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.created=${{ steps.meta.outputs.created }}
          tags: |
            # explicit override from workflow_dispatch
            type=raw,value=${{ inputs.image_tag }},enable=${{ inputs.image_tag != '' }}
            # semver tags when pushing Git tags like v3.1.14
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            # master/main -> latest
            type=ref,event=branch,enable=${{ github.ref_name == 'master' || github.ref_name == 'main' }},value=latest
            # dev-ci branch -> dev-ci
            type=raw,value=dev-ci,enable=${{ github.ref_name == 'dev-ci' }}
            # always include branch name
            type=ref,event=branch
            # short SHA tag (immutable)
            type=sha,format=short
            # date tag (immutable-ish)
            type=raw,value={{date 'YYYYMMDD-HHmmss'}}

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build & push
        id: build
        uses: docker/build-push-action@v6
        env:
          BUILDKIT_PROGRESS: plain
        with:
          context: ./actions
          file: ./actions/Dockerfile
          push: true
          pull: true
          platforms: linux/amd64
          # Use tags & labels from metadata-action
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            INSTALL_METHOD=deb
            BLUECHERRY_DEB_URL=${{ steps.decide-deb.outputs.deb_url }}
            BLUECHERRY_DEB_SHA256=${{ steps.sha.outputs.sha }}
          cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache
          cache-to:   type=registry,ref=${{ env.IMAGE_NAME }}:buildcache,mode=max
          provenance: false
          sbom: false

      - name: Show pushed digest(s)
        run: |
          echo "Digests:"
          echo "${{ steps.build.outputs.digest }}"
          echo "Tags:"
          echo "${{ steps.meta.outputs.tags }}"

      - name: Job summary
        run: |
          {
            echo "## Bluecherry Image Pushed"
            echo ""
            echo "- **Image**: \`${{ env.IMAGE_NAME }}\`"
            echo "- **Digest**: \`${{ steps.build.outputs.digest }}\`"
            echo "- **Tags:**"
            echo '```'
            echo "${{ steps.meta.outputs.tags }}"
            echo '```'
            echo "- **.deb SHA256**: \`${{ steps.sha.outputs.sha }}\`"
          } >> "$GITHUB_STEP_SUMMARY"