incr/.forgejo/workflows/build.yml

name: Build and Push Docker Image

on:
  # Tags only. A release merges to main and is tagged at the same commit, so a
  # branch trigger here would build and push the image twice.
  push:
    tags: ['v*']

jobs:
  build:
    runs-on: docker
    container:
      image: catthehacker/ubuntu:act-latest

    steps:
      - uses: https://data.forgejo.org/actions/checkout@v4

      - name: Set up QEMU
        uses: https://data.forgejo.org/docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: https://data.forgejo.org/docker/setup-buildx-action@v3

      - name: Login to Forgejo Registry
        uses: https://data.forgejo.org/docker/login-action@v3
        with:
          registry: forge.lvl0.xyz
          username: ${{ github.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Determine tags
        id: meta
        run: |
          TAG="${{ github.ref_name }}"
          echo "tags=forge.lvl0.xyz/lvl0/incr:${TAG},forge.lvl0.xyz/lvl0/incr:latest" >> $GITHUB_OUTPUT

      - name: Build and push
        uses: https://data.forgejo.org/docker/build-push-action@v5
        with:
          context: .
          file: docker/production/Dockerfile
          # arm64 is deliberate: nothing of ours deploys to it, but the image is
          # published for self-hosters and dropping it would exclude ARM boxes.
          # It is emulated via QEMU, so keep the Dockerfile free of compilation.
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=registry,ref=forge.lvl0.xyz/lvl0/incr:buildcache
          cache-to: type=registry,ref=forge.lvl0.xyz/lvl0/incr:buildcache,mode=max