publish.yml

# This workflow automatically builds and publishes the docker image
# for every push to the `main` branch. We rely on branch protection
# to ensure that all changes to `main` have gone through a PR, and
# on the separate `tests` workflow to ensure that every PR properly
# increments the version info in a way that's safe to publish.

name: Publish docker images from main

on:
  push:
    branches:
      - main
    paths:
      - 'Dockerfile'

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Set up QEMU for Docker
        uses: docker/setup-qemu-action@v3
        with:
            platforms: arm64

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3

      - name: Cache docker build artifacts
        uses: actions/cache@v4
        with:
          path: |
            /tmp/buildx-cache/
          key: docker-buildx-${{ hashFiles('./Makefile', './Dockerfile', './scripts/*') }}
          restore-keys: |
            docker-buildx-

      - name: Log in to Github Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and publish the images
        run: make publish

      - name: Only keep the latest images in docker cache
        run: |
          rm -rf /tmp/buildx-cache
          mv /tmp/buildx-cache-new /tmp/buildx-cache