Aether/.github/workflows/docker-publish.yml

name: Build and Publish Docker Image

on:
  push:
    branches: [master, main]
    tags: ['v*']
  workflow_dispatch:
    inputs:
      build_base:
        description: 'Rebuild base image'
        required: false
        default: false
        type: boolean

env:
  REGISTRY: ghcr.io
  BASE_IMAGE_NAME: ${{ github.repository }}-base
  APP_IMAGE_NAME: ${{ github.repository }}

jobs:
  check-base-changes:
    runs-on: ubuntu-latest
    outputs:
      base_changed: ${{ steps.check.outputs.base_changed }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Check if base image needs rebuild
        id: check
        run: |
          if [ "${{ github.event.inputs.build_base }}" == "true" ]; then
            echo "base_changed=true" >> $GITHUB_OUTPUT
            exit 0
          fi

          # Check if base-related files changed
          if git diff --name-only HEAD~1 HEAD | grep -qE '^(Dockerfile\.base|pyproject\.toml|frontend/package.*\.json)$'; then
            echo "base_changed=true" >> $GITHUB_OUTPUT
          else
            echo "base_changed=false" >> $GITHUB_OUTPUT
          fi

  build-base:
    needs: check-base-changes
    if: needs.check-base-changes.outputs.base_changed == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata for base image
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}
          tags: |
            type=raw,value=latest
            type=sha,prefix=

      - name: Build and push base image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.base
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64

  build-app:
    needs: [check-base-changes, build-base]
    if: always() && (needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata for app image
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=

      - name: Update Dockerfile.app to use registry base image
        run: |
          sed -i "s|FROM aether-base:latest|FROM ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest|g" Dockerfile.app

      - name: Build and push app image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.app
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64