winnow/.github/workflows/docker-publish.yml

name: Publish Docker Image

on:
  push:
    branches: ["dev"]
    paths-ignore:
      - "**.md"
      - "docs/**"
      - ".github/ISSUE_TEMPLATE/**"
      - ".github/PULL_REQUEST_TEMPLATE.md"
      - ".github/workflows/release.yml"
      - ".github/workflows/lint.yml"
      - ".github/dependabot.yml"
      - "uv.lock"
  workflow_call:
    inputs:
      tag:
        type: string
        required: false
        description: "Release tag, e.g. v0.4.1 — triggers :latest + versioned image tags"
      version:
        type: string
        required: false
        description: "Version string without v prefix, e.g. 0.4.1"

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: sudolulo/winnow

jobs:
  build:
    name: Build (linux/amd64)
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Free up disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
          sudo rm -rf /opt/hostedtoolcache/CodeQL /usr/share/swift
          sudo rm -rf "/usr/local/share/boost" "$AGENT_TOOLSDIRECTORY"
          docker system prune -af
          df -h

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log in to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute build version
        id: version
        run: |
          if [ -n "${{ inputs.version }}" ]; then
            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
          else
            echo "value=dev" >> "$GITHUB_OUTPUT"
          fi

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          file: ./Dockerfile
          platforms: ${{ matrix.platform }}
          build-args: VERSION=${{ steps.version.outputs.value }}
          cache-from: type=gha,scope=${{ matrix.platform }}
          cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digest-amd64
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: Merge multi-arch manifest
    runs-on: ubuntu-latest
    needs: build
    permissions:
      contents: read
      packages: write

    steps:
      - name: Download digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: /tmp/digests
          pattern: digest-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log in to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine image tags
        id: tags
        run: |
          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
          INPUT_TAG="${{ inputs.tag }}"
          if [ -n "$INPUT_TAG" ]; then
            echo "tag_args=-t ${IMAGE}:latest -t ${IMAGE}:${INPUT_TAG}" >> "$GITHUB_OUTPUT"
            echo "inspect_tag=${IMAGE}:latest" >> "$GITHUB_OUTPUT"
          else
            echo "tag_args=-t ${IMAGE}:dev" >> "$GITHUB_OUTPUT"
            echo "inspect_tag=${IMAGE}:dev" >> "$GITHUB_OUTPUT"
          fi

      - name: Create and push multi-arch manifest
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
            ${{ steps.tags.outputs.tag_args }} \
            $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ steps.tags.outputs.inspect_tag }}

      - name: Ensure package is public
        run: |
          gh api -X PATCH /user/packages/container/winnow \
            -f visibility=public || true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-cpu:
    name: Build CPU (amd64 + arm64)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Free up disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
          sudo rm -rf /opt/hostedtoolcache/CodeQL /usr/share/swift
          sudo rm -rf "/usr/local/share/boost" "$AGENT_TOOLSDIRECTORY"
          docker system prune -af
          df -h

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log in to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine CPU image tags
        id: cpu-tags
        run: |
          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
          INPUT_TAG="${{ inputs.tag }}"
          if [ -n "$INPUT_TAG" ]; then
            {
              echo "tags<<EOF"
              printf '%s\n' "${IMAGE}:cpu" "${IMAGE}:${INPUT_TAG}-cpu"
              echo "EOF"
            } >> "$GITHUB_OUTPUT"
            echo "inspect_tag=${IMAGE}:cpu" >> "$GITHUB_OUTPUT"
          else
            echo "tags=${IMAGE}:dev-cpu" >> "$GITHUB_OUTPUT"
            echo "inspect_tag=${IMAGE}:dev-cpu" >> "$GITHUB_OUTPUT"
          fi

      - name: Compute build version
        id: version
        run: |
          if [ -n "${{ inputs.version }}" ]; then
            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
          else
            echo "value=dev" >> "$GITHUB_OUTPUT"
          fi

      - name: Build and push CPU image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          build-args: |
            VARIANT=cpu
            VERSION=${{ steps.version.outputs.value }}
          cache-from: type=gha,scope=cpu
          cache-to: type=gha,mode=max,scope=cpu
          github-token: ${{ secrets.GITHUB_TOKEN }}
          push: true
          tags: ${{ steps.cpu-tags.outputs.tags }}

      - name: Inspect CPU image
        run: |
          docker buildx imagetools inspect ${{ steps.cpu-tags.outputs.inspect_tag }}

      - name: Ensure package is public
        run: |
          gh api -X PATCH /user/packages/container/winnow \
            -f visibility=public || true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-rocm:
    name: Build ROCm / AMD GPU (amd64)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Free up disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
          sudo rm -rf /opt/hostedtoolcache/CodeQL /usr/share/swift
          sudo rm -rf "/usr/local/share/boost" "$AGENT_TOOLSDIRECTORY"
          docker system prune -af
          df -h

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log in to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine ROCm image tags
        id: rocm-tags
        run: |
          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
          INPUT_TAG="${{ inputs.tag }}"
          if [ -n "$INPUT_TAG" ]; then
            {
              echo "tags<<EOF"
              printf '%s\n' "${IMAGE}:rocm" "${IMAGE}:${INPUT_TAG}-rocm"
              echo "EOF"
            } >> "$GITHUB_OUTPUT"
            echo "inspect_tag=${IMAGE}:rocm" >> "$GITHUB_OUTPUT"
          else
            echo "tags=${IMAGE}:dev-rocm" >> "$GITHUB_OUTPUT"
            echo "inspect_tag=${IMAGE}:dev-rocm" >> "$GITHUB_OUTPUT"
          fi

      - name: Compute build version
        id: version
        run: |
          if [ -n "${{ inputs.version }}" ]; then
            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
          else
            echo "value=dev" >> "$GITHUB_OUTPUT"
          fi

      - name: Build and push ROCm image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64
          build-args: |
            VARIANT=rocm
            VERSION=${{ steps.version.outputs.value }}
          cache-from: type=gha,scope=linux/amd64-rocm
          cache-to: type=gha,mode=max,scope=linux/amd64-rocm
          github-token: ${{ secrets.GITHUB_TOKEN }}
          push: true
          tags: ${{ steps.rocm-tags.outputs.tags }}

      - name: Inspect ROCm image
        run: |
          docker buildx imagetools inspect ${{ steps.rocm-tags.outputs.inspect_tag }}

      - name: Ensure package is public
        run: |
          gh api -X PATCH /user/packages/container/winnow \
            -f visibility=public || true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-intel:
    name: Build Intel GPU (amd64)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Free up disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
          sudo rm -rf /opt/hostedtoolcache/CodeQL /usr/share/swift
          sudo rm -rf "/usr/local/share/boost" "$AGENT_TOOLSDIRECTORY"
          docker system prune -af
          df -h

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log in to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine Intel image tags
        id: intel-tags
        run: |
          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
          INPUT_TAG="${{ inputs.tag }}"
          if [ -n "$INPUT_TAG" ]; then
            {
              echo "tags<<EOF"
              printf '%s\n' "${IMAGE}:intel" "${IMAGE}:${INPUT_TAG}-intel"
              echo "EOF"
            } >> "$GITHUB_OUTPUT"
            echo "inspect_tag=${IMAGE}:intel" >> "$GITHUB_OUTPUT"
          else
            echo "tags=${IMAGE}:dev-intel" >> "$GITHUB_OUTPUT"
            echo "inspect_tag=${IMAGE}:dev-intel" >> "$GITHUB_OUTPUT"
          fi

      - name: Compute build version
        id: version
        run: |
          if [ -n "${{ inputs.version }}" ]; then
            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
          else
            echo "value=dev" >> "$GITHUB_OUTPUT"
          fi

      - name: Build and push Intel image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64
          build-args: |
            VARIANT=intel
            VERSION=${{ steps.version.outputs.value }}
          cache-from: type=gha,scope=linux/amd64-intel
          cache-to: type=gha,mode=max,scope=linux/amd64-intel
          github-token: ${{ secrets.GITHUB_TOKEN }}
          push: true
          tags: ${{ steps.intel-tags.outputs.tags }}

      - name: Inspect Intel image
        run: |
          docker buildx imagetools inspect ${{ steps.intel-tags.outputs.inspect_tag }}

      - name: Ensure package is public
        run: |
          gh api -X PATCH /user/packages/container/winnow \
            -f visibility=public || true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}