OF-Scraper/.github/workflows/docker-daily.yml

name: Docker Daily Build

on:
  push:
    branches:
      - '**'
    tags-ignore:
      - '**'
permissions:
  contents: read
  packages: write
  id-token: write

jobs:
  generate_version:
    name: Generate Version Info
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.VERSION }}
      short_hash: ${{ steps.version.outputs.SHORT_HASH }}
      commit_timestamp: ${{ steps.version.outputs.COMMIT_TIMESTAMP }}
      base_version: ${{ steps.version.outputs.BASE_VERSION }}
      is_newer_than_last_successful_run: ${{ steps.version.outputs.IS_NEWER_THAN_LAST_SUCCESSFUL_RUN }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Make script executable
        run: chmod +x ./scripts/commit_version.sh
      - name: Generate Version and Git Info
        id: version
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_WORKFLOW_REF: ${{ github.workflow_ref }}
          GITHUB_REF: ${{ github.ref }}
          GITHUB_EVENT_BEFORE: ${{ github.event.before }}
        run: ./scripts/commit_version.sh

  build_and_publish_docker:
    name: Build and Publish Docker to ${{ matrix.registry.name }}
    needs: [generate_version]
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        registry:
          - id: ghcr
            name: GitHub Packages
            sign: false
          - id: dockerhub
            name: Docker Hub
            sign: true

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4 

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to ${{ matrix.registry.name }}
        uses: docker/login-action@v3
        with:
          registry: ${{ matrix.registry.id == 'ghcr' && 'ghcr.io' || 'docker.io' }}
          username: ${{ matrix.registry.id == 'ghcr' && github.actor || secrets.DOCKERHUB_USERNAME }}
          password: ${{ matrix.registry.id == 'ghcr' && secrets.GITHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}

      - name: Extract Docker metadata (Normal Image)
        id: meta_normal
        uses: docker/metadata-action@v5
        with:
          images: ${{ matrix.registry.id == 'ghcr' && format('ghcr.io/{0}', github.repository) || 'datawhores/of-scraper' }}
          tags: |
            type=ref,event=branch
            type=raw,value=${{ needs.generate_version.outputs.base_version }}-${{ needs.generate_version.outputs.short_hash }}-${{ needs.generate_version.outputs.commit_timestamp }}
            type=raw,value=${{ needs.generate_version.outputs.base_version }}-${{ needs.generate_version.outputs.short_hash }}
            type=raw,value=latest,enable=${{ needs.generate_version.outputs.is_newer_than_last_successful_run }}

      - name: Build and push Normal Docker image
        id: build-and-push-normal 
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile 
          push: true
          tags: ${{ steps.meta_normal.outputs.tags }}
          labels: ${{ steps.meta_normal.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64
          provenance: false # Disable provenance to avoid unknown/unknown
          sbom: false       # Disable sbom to avoid unknown/unknown
          build-args: |
            BUILD_VERSION=${{ needs.generate_version.outputs.version }}

      # This part needs adjustment to sign both images.
      - name: Install Cosign
        if: matrix.registry.sign == true
        uses: sigstore/cosign-installer@v3.5.0

      - name: Write signing key to disk
        if: matrix.registry.sign == true
        run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
        shell: bash

      - name: Sign the published Docker images
        if: matrix.registry.sign == true
        env:
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
          COSIGN_EXPERIMENTAL: "true"
        run: |
          # Get all tags for the normal image
          NORMAL_IMAGE_TAGS="${{ steps.meta_normal.outputs.tags }}"
          # Get the digest of the normal image
          NORMAL_IMAGE_DIGEST="${{ steps.build-and-push-normal.outputs.digest }}"

          echo "Signing Normal Image: ${NORMAL_IMAGE_TAGS} @ ${NORMAL_IMAGE_DIGEST}"
          echo "$NORMAL_IMAGE_TAGS" | xargs -I {} cosign sign --yes --key cosign.key {}@$NORMAL_IMAGE_DIGEST