stemdeckapp--stemdeck/.github/workflows/docker-publish.yml

name: Docker Publish

# Builds the server container (build/Dockerfile) and pushes it to GHCR so it can
# be pulled by self-hosted deployments and the Unraid Community Applications app
# (ghcr.io/stemdeckapp/stemdeck). The image keeps the default Linux x86_64 torch
# wheel, which is the CUDA build -- so the same image runs on CPU by default and
# uses the GPU automatically when started with `--runtime=nvidia` (see the
# Unraid template in templates/unraid/).

on:
  # Every merge to main publishes a rolling :edge image. The version is derived
  # from git (hatch-vcs style); :edge never clobbers :latest.
  push:
    branches: [main]
  release:
    # prereleased: a prerelease is published -> push the version tag only.
    # released:    a stable release is published, OR a prerelease is promoted to
    #              a full/Latest release -> push the version tag AND :latest.
    # (Listening to these two instead of `published` avoids a double run on a
    # stable publish, which fires both `published` and `released`.)
    types: [prereleased, released]
  # Same as a main push but on demand, from any ref.
  workflow_dispatch:

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  IMAGE: ghcr.io/${{ github.repository_owner }}/stemdeck

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          # Full history + tags so git describe can derive a version on manual runs.
          fetch-depth: 0

      # Derive the version fed to the Dockerfile's VERSION build-arg (consumed as
      # SETUPTOOLS_SCM_PRETEND_VERSION, so it MUST be PEP 440-valid). On a
      # release, use the tag. Otherwise derive from git: `git describe --long`
      # yields `<tag>-<N>-g<sha>`, which is NOT PEP 440 -- rewrite the trailing
      # `-N-gSHA` into a `+N.gSHA` local segment (e.g. 0.8.0-alpha.5+3.gce86e8a).
      - name: resolve version
        id: ver
        run: |
          if [ "${{ github.event_name }}" = "release" ]; then
            v="${{ github.event.release.tag_name }}"
          else
            raw="$(git describe --tags --long 2>/dev/null || echo "0.0.0-0-g$(git rev-parse --short HEAD)")"
            v="$(printf '%s' "${raw#v}" | sed -E 's/-([0-9]+)-g([0-9a-f]+)$/+\1.g\2/')"
          fi
          echo "value=${v#v}" >> "$GITHUB_OUTPUT"

      - name: docker metadata (tags/labels)
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6.2.0
        with:
          images: ${{ env.IMAGE }}
          tags: |
            type=raw,value=edge,enable=${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
            type=raw,value=${{ steps.ver.outputs.value }},enable=${{ github.event_name == 'release' }}
            type=raw,value=latest,enable=${{ github.event_name == 'release' && github.event.action == 'released' }}

      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0

      - name: log in to GHCR
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
        with:
          context: .
          file: build/Dockerfile
          # Unraid is x86_64; arm64 has no CUDA torch and is not a target.
          platforms: linux/amd64
          push: true
          build-args: |
            VERSION=${{ steps.ver.outputs.value }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: false