docker-image.yml

name: docker-image

# Builds and publishes the multi-arch Docker image for CLIProxyAPIPlus.
#
# Triggers:
#   - push to main -> build & push :latest only
#   - push of any v* tag -> build & push :tag + :latest
#   - workflow_dispatch with optional `tag` input
#
# Architecture: native ARM64 / AMD64 partner jobs (no QEMU), merged into
# a single multi-arch manifest.
#
# Registries:
#   - GHCR: ghcr.io/<repository> (built-in GITHUB_TOKEN)
#   - Docker Hub: kaitranntt/cli-proxy-api-plus when DOCKERHUB_TOKEN is
#     configured (DOCKERHUB_USERNAME is optional; defaults to kaitranntt)

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Existing tag to build, e.g. v6.9.45-0'
        required: false
        type: string
  push:
    branches:
      - main
    tags:
      - 'v*'

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  GHCR_REGISTRY: ghcr.io
  GHCR_IMAGE_NAME: ${{ github.repository }}
  DOCKERHUB_IMAGE_NAME: kaitranntt/cli-proxy-api-plus

permissions:
  contents: read
  packages: write

concurrency:
  group: docker-image-${{ inputs.tag || github.ref_name }}
  cancel-in-progress: false

jobs:
  # ── shared metadata ──────────────────────────────────────────────────────
  meta:
    runs-on: ubuntu-latest
    outputs:
      ref: ${{ steps.ref.outputs.ref }}
      is_tag: ${{ steps.ref.outputs.is_tag }}
      version: ${{ steps.meta.outputs.version }}
      commit: ${{ steps.meta.outputs.commit }}
      build_date: ${{ steps.meta.outputs.build_date }}
      ghcr_ref: ${{ steps.img.outputs.ghcr_ref }}
      dockerhub_ref: ${{ steps.img.outputs.dockerhub_ref }}
      dockerhub_enabled: ${{ steps.dockerhub.outputs.enabled }}
      tag_version: ${{ steps.tags.outputs.tag_version }}
      tag_latest: ${{ steps.tags.outputs.tag_latest }}
    steps:
      - name: Resolve build ref
        id: ref
        run: |
          REF="${GITHUB_REF_NAME}"
          # workflow_dispatch may supply an explicit tag
          if [ -n "${{ inputs.tag }}" ]; then REF="${{ inputs.tag }}"; fi
          echo "ref=${REF}" >> "$GITHUB_OUTPUT"

          # Determine mode: tag push -> versioned, otherwise latest-only
          if echo "${GITHUB_REF}" | grep -q '^refs/tags/'; then
            echo "is_tag=true" >> "$GITHUB_OUTPUT"
          elif [ -n "${{ inputs.tag }}" ]; then
            echo "is_tag=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_tag=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.ref.outputs.ref }}
          fetch-depth: 0

      - name: Build metadata
        id: meta
        run: |
          VERSION="${{ steps.ref.outputs.ref }}"
          COMMIT="$(git rev-parse --short HEAD)"
          BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          {
            echo "version=${VERSION}"
            echo "commit=${COMMIT}"
            echo "build_date=${BUILD_DATE}"
          } >> "$GITHUB_OUTPUT"

      - name: Lowercase image names
        id: img
        run: |
          GHCR_IMG="${GHCR_REGISTRY}/${GHCR_IMAGE_NAME}"
          GHCR_IMG_LC="$(echo "${GHCR_IMG}" | tr '[:upper:]' '[:lower:]')"
          DOCKERHUB_IMG_LC="$(echo "${DOCKERHUB_IMAGE_NAME}" | tr '[:upper:]' '[:lower:]')"
          {
            echo "ghcr_ref=${GHCR_IMG_LC}"
            echo "dockerhub_ref=${DOCKERHUB_IMG_LC}"
          } >> "$GITHUB_OUTPUT"

      - name: Detect Docker Hub credentials
        id: dockerhub
        env:
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          if [ -n "${DOCKERHUB_TOKEN}" ]; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Build tag list
        id: tags
        env:
          GHCR_REF: ${{ steps.img.outputs.ghcr_ref }}
          VERSION: ${{ steps.meta.outputs.version }}
          IS_TAG: ${{ steps.ref.outputs.is_tag }}
        run: |
          # Always push to latest
          echo "tag_latest=${GHCR_REF}:latest" >> "$GITHUB_OUTPUT"

          if [ "${IS_TAG}" = "true" ]; then
            echo "tag_version=${GHCR_REF}:${VERSION}" >> "$GITHUB_OUTPUT"
          else
            # Branch push: version tag is same as latest (only latest pushed)
            echo "tag_version=${GHCR_REF}:latest" >> "$GITHUB_OUTPUT"
          fi

  # ── AMD64 build ──────────────────────────────────────────────────────────
  build-amd64:
    needs: meta
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.meta.outputs.ref }}
          fetch-depth: 0

      - name: Refresh models catalog
        run: |
          git fetch --depth 1 https://github.com/router-for-me/models.git main
          git show FETCH_HEAD:models.json > internal/registry/models/models.json

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GHCR_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        if: needs.meta.outputs.dockerhub_enabled == 'true'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME || 'kaitranntt' }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push (amd64)
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64
          push: true
          provenance: false
          build-args: |
            VERSION=${{ needs.meta.outputs.version }}
            COMMIT=${{ needs.meta.outputs.commit }}
            BUILD_DATE=${{ needs.meta.outputs.build_date }}
          tags: |
            ${{ needs.meta.outputs.tag_version }}-amd64
          cache-from: type=gha,scope=amd64
          cache-to: type=gha,mode=max,scope=amd64

  # ── ARM64 build ──────────────────────────────────────────────────────────
  build-arm64:
    needs: meta
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.meta.outputs.ref }}
          fetch-depth: 0

      - name: Refresh models catalog
        run: |
          git fetch --depth 1 https://github.com/router-for-me/models.git main
          git show FETCH_HEAD:models.json > internal/registry/models/models.json

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GHCR_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        if: needs.meta.outputs.dockerhub_enabled == 'true'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME || 'kaitranntt' }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push (arm64)
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/arm64
          push: true
          provenance: false
          build-args: |
            VERSION=${{ needs.meta.outputs.version }}
            COMMIT=${{ needs.meta.outputs.commit }}
            BUILD_DATE=${{ needs.meta.outputs.build_date }}
          tags: |
            ${{ needs.meta.outputs.tag_version }}-arm64
          cache-from: type=gha,scope=arm64
          cache-to: type=gha,mode=max,scope=arm64

  # ── Merge multi-arch manifest ────────────────────────────────────────────
  merge:
    needs: [meta, build-amd64, build-arm64]
    runs-on: ubuntu-latest
    steps:
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GHCR_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        if: needs.meta.outputs.dockerhub_enabled == 'true'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME || 'kaitranntt' }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Create and push multi-arch manifest (GHCR)
        env:
          TAG_VERSION: ${{ needs.meta.outputs.tag_version }}
          TAG_LATEST: ${{ needs.meta.outputs.tag_latest }}
          IS_TAG: ${{ needs.meta.outputs.is_tag }}
        run: |
          set -euo pipefail
          AMEND=""
          for SUFFIX in -amd64 -arm64; do
            docker pull "${TAG_VERSION}${SUFFIX}"
            AMEND="${AMEND} --amend ${TAG_VERSION}${SUFFIX}"
          done

          if [ "${IS_TAG}" = "true" ]; then
            docker manifest create ${TAG_VERSION} ${AMEND}
            docker manifest push ${TAG_VERSION}
          fi

          docker manifest create ${TAG_LATEST} ${AMEND}
          docker manifest push ${TAG_LATEST}

      - name: Create and push multi-arch manifest (Docker Hub)
        if: needs.meta.outputs.dockerhub_enabled == 'true'
        env:
          DOCKERHUB_REF: ${{ needs.meta.outputs.dockerhub_ref }}
          TAG_VERSION: ${{ needs.meta.outputs.tag_version }}
          IS_TAG: ${{ needs.meta.outputs.is_tag }}
        run: |
          set -euo pipefail
          VERSION_TAG="${DOCKERHUB_REF}:${TAG_VERSION##*:}"
          LATEST_TAG="${DOCKERHUB_REF}:latest"
          AMEND=""
          for SUFFIX in -amd64 -arm64; do
            AMEND="${AMEND} --amend ${TAG_VERSION}${SUFFIX}"
          done

          if [ "${IS_TAG}" = "true" ]; then
            docker manifest create ${VERSION_TAG} ${AMEND}
            docker manifest push ${VERSION_TAG}
          fi

          docker manifest create ${LATEST_TAG} ${AMEND}
          docker manifest push ${LATEST_TAG}

      - name: Summary
        env:
          GHCR_REF: ${{ needs.meta.outputs.ghcr_ref }}
          DOCKERHUB_REF: ${{ needs.meta.outputs.dockerhub_ref }}
          VERSION: ${{ needs.meta.outputs.version }}
          IS_TAG: ${{ needs.meta.outputs.is_tag }}
          DOCKERHUB_ENABLED: ${{ needs.meta.outputs.dockerhub_enabled }}
        run: |
          {
            echo "## Published"
            echo "- \`${GHCR_REF}:latest\`"
            if [ "${IS_TAG}" = "true" ]; then
              echo "- \`${GHCR_REF}:${VERSION}\`"
            fi
            if [ "${DOCKERHUB_ENABLED}" = "true" ]; then
              echo "- \`${DOCKERHUB_REF}:latest\`"
              if [ "${IS_TAG}" = "true" ]; then
                echo "- \`${DOCKERHUB_REF}:${VERSION}\`"
              fi
              echo
              echo "Pull: \`docker pull ${DOCKERHUB_REF}:latest\`"
            else
              echo
              echo "Pull: \`docker pull ${GHCR_REF}:latest\`"
            fi
          } >> "$GITHUB_STEP_SUMMARY"