docker-image.yml

name: docker-image

# Builds and publishes the multi-arch Docker image for CLIProxyAPIPlus.
#
# Triggers:
#   - push of any v* tag (works when a PAT pushes the tag; sync-release-tag.yml
#     pushes via GITHUB_TOKEN and explicitly dispatches this workflow because
#     GITHUB_TOKEN events do not cascade)
#   - workflow_dispatch with optional `tag` input
#
# Runner: self-hosted `cliproxy` (docker host LXC). QEMU + buildx produce both
# linux/amd64 and linux/arm64 from a single x64 host.
#
# Registries:
#   - GHCR: ghcr.io/<owner>/cli-proxy-api-plus using built-in GITHUB_TOKEN
#   - Docker Hub: tamntlib/cli-proxy-api-plus when DOCKERHUB_TOKEN is
#     configured (DOCKERHUB_USERNAME is optional; defaults to tamntlib)

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Existing tag to build, e.g. v6.9.45-0'
        required: false
        type: string
  push:
    tags:
      - 'v*'

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  APP_NAME: CLIProxyAPI
  GHCR_REGISTRY: ghcr.io
  GHCR_IMAGE_NAME: ${{ github.repository_owner }}/cli-proxy-api-plus
  DOCKERHUB_IMAGE_NAME: tamntlib/cli-proxy-api-plus

permissions:
  contents: read
  packages: write

concurrency:
  group: docker-image-${{ inputs.tag || github.ref_name }}
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Resolve build ref
        id: ref
        run: |
          REF="${{ inputs.tag }}"
          if [ -z "${REF}" ]; then REF="${GITHUB_REF_NAME}"; fi
          echo "ref=${REF}" >> "$GITHUB_OUTPUT"

      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.ref.outputs.ref }}
          fetch-depth: 0

      - name: Refresh models catalog
        run: |
          git fetch --depth 1 https://github.com/router-for-me/models.git main
          git show FETCH_HEAD:models.json > internal/registry/models/models.json

      - name: Set up QEMU (for arm64 emulation on x64 self-hosted runner)
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GHCR_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Detect Docker Hub credentials
        id: dockerhub
        env:
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          if [ -n "${DOCKERHUB_TOKEN}" ]; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Login to Docker Hub
        if: steps.dockerhub.outputs.enabled == 'true'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME || 'tamntlib' }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Lowercase image names
        id: img
        run: |
          GHCR_IMG="${GHCR_REGISTRY}/${GHCR_IMAGE_NAME}"
          GHCR_IMG_LC="$(echo "${GHCR_IMG}" | tr '[:upper:]' '[:lower:]')"
          DOCKERHUB_IMG_LC="$(echo "${DOCKERHUB_IMAGE_NAME}" | tr '[:upper:]' '[:lower:]')"
          {
            echo "ghcr_ref=${GHCR_IMG_LC}"
            echo "dockerhub_ref=${DOCKERHUB_IMG_LC}"
          } >> "$GITHUB_OUTPUT"

      - name: Build metadata
        id: meta
        run: |
          VERSION="${{ steps.ref.outputs.ref }}"
          COMMIT="$(git rev-parse --short HEAD)"
          BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          {
            echo "version=${VERSION}"
            echo "commit=${COMMIT}"
            echo "build_date=${BUILD_DATE}"
          } >> "$GITHUB_OUTPUT"

      - name: Build tag list
        id: tags
        env:
          GHCR_REF: ${{ steps.img.outputs.ghcr_ref }}
          DOCKERHUB_REF: ${{ steps.img.outputs.dockerhub_ref }}
          VERSION: ${{ steps.meta.outputs.version }}
          DOCKERHUB_ENABLED: ${{ steps.dockerhub.outputs.enabled }}
        run: |
          {
            echo "tags<<EOF"
            echo "${GHCR_REF}:${VERSION}"
            echo "${GHCR_REF}:latest"
            if [ "${DOCKERHUB_ENABLED}" = "true" ]; then
              echo "${DOCKERHUB_REF}:${VERSION}"
              echo "${DOCKERHUB_REF}:latest"
            fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Build and push (multi-arch)
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            VERSION=${{ steps.meta.outputs.version }}
            COMMIT=${{ steps.meta.outputs.commit }}
            BUILD_DATE=${{ steps.meta.outputs.build_date }}
          tags: ${{ steps.tags.outputs.tags }}

      - name: Summary
        env:
          GHCR_REF: ${{ steps.img.outputs.ghcr_ref }}
          DOCKERHUB_REF: ${{ steps.img.outputs.dockerhub_ref }}
          VERSION: ${{ steps.meta.outputs.version }}
          DOCKERHUB_ENABLED: ${{ steps.dockerhub.outputs.enabled }}
        run: |
          {
            echo "## Published"
            echo "- \`${GHCR_REF}:${VERSION}\`"
            echo "- \`${GHCR_REF}:latest\`"
            if [ "${DOCKERHUB_ENABLED}" = "true" ]; then
              echo "- \`${DOCKERHUB_REF}:${VERSION}\`"
              echo "- \`${DOCKERHUB_REF}:latest\`"
              echo
              echo "Pull: \`docker pull ${DOCKERHUB_REF}:${VERSION}\`"
            else
              echo
              echo "Docker Hub skipped: configure \`DOCKERHUB_TOKEN\` to publish \`${DOCKERHUB_REF}\`. Set \`DOCKERHUB_USERNAME\` only if the login account is not \`tamntlib\`."
              echo
              echo "Pull: \`docker pull ${GHCR_REF}:${VERSION}\`"
            fi
          } >> "$GITHUB_STEP_SUMMARY"