snipe-it/.github/workflows/docker-ubuntu.yml

# Snipe-IT Docker image build for hub.docker.com
name: Docker images (Ubuntu)

# Run this Build for all pushes to 'master' or develop branch, or tagged releases.
# Also run for PRs to ensure PR doesn't break Docker build process
on:
  push:
    branches:
      - master
      - develop
    tags:
      - 'v**'
  # Weekly rebuild so the rolling 'v{major}-latest' tag picks up base-OS
  # security patches (e.g. Ubuntu apt package updates) even when no new
  # Snipe-IT version has been tagged. Does NOT touch immutable vX.Y.Z tags.
  schedule:
    - cron: '0 6 * * 1'
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

  pull_request:

permissions:
  contents: read

jobs:
  docker:
    # Ensure this job never runs on forked repos. It's only executed for 'grokability/snipe-it'
    if: github.repository == 'grokability/snipe-it'
    runs-on: ubuntu-latest
    env:
      # Define tags to use for Docker images based on Git tags/branches (for docker/metadata-action)
      # For a new commit on default branch (master), use the literal tag 'latest' on Docker image.
      # For a new commit on other branches, use the branch name as the tag for Docker image.
      # For a new tag, copy that tag name as the tag for Docker image.
      IMAGE_TAGS: |
        type=raw,value=latest,enable=${{ endsWith(github.ref, github.event.repository.default_branch) }}
        type=ref,event=branch,enable=${{ !endsWith(github.ref, github.event.repository.default_branch) }}
        type=ref,event=tag
        type=semver,pattern=v{{major}}-latest
      # Define default tag "flavor" for docker/metadata-action per
      # https://github.com/docker/metadata-action#flavor-input
      # We turn off 'latest' tag by default.
      TAGS_FLAVOR: |
        latest=false

    steps:
      # https://github.com/actions/checkout
      - name: Checkout codebase
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      # On a scheduled run there's no tag/branch push event to derive the ref
      # from, so explicitly check out the most recent published release tag
      # before building - this is what gets rebuilt to refresh v{major}-latest.
      - name: Checkout latest release tag (scheduled runs only)
        if: github.event_name == 'schedule'
        run: |
          git fetch --tags
          latest_tag=$(git tag -l 'v*' --sort=-v:refname | head -n1)
          echo "Rebuilding latest release tag: $latest_tag"
          git checkout "$latest_tag"

      # https://github.com/docker/setup-buildx-action
      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v4

      # https://github.com/docker/login-action
      - name: Login to DockerHub
        # Only login if not a PR, as PRs only trigger a Docker build and not a push
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}

      ###############################################
      # Build/Push the 'snipe/snipe-it' image
      ###############################################
      # https://github.com/docker/metadata-action
      # Get Metadata for docker_build step below
      - name: Sync metadata (tags, labels) from GitHub to Docker for 'snipe-it' image
        id: meta_build
        uses: docker/metadata-action@v6
        with:
          images: snipe/snipe-it
          # On schedule, metadata-action can't derive tags from github.ref
          # (it still points at the default branch) - only emit v{major}-latest.
          tags: ${{ github.event_name == 'schedule' && 'type=semver,pattern=v{{major}}-latest' || env.IMAGE_TAGS }}
          flavor: ${{ env.TAGS_FLAVOR }}

      # https://github.com/docker/build-push-action
      - name: Build and push 'snipe-it' image
        id: docker_build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          # For pull requests, we run the Docker build (to ensure no PR changes break the build),
          # but we ONLY do an image push to DockerHub if it's NOT a PR
          push: ${{ github.event_name != 'pull_request' }}
          # Use tags / labels provided by 'docker/metadata-action' above
          tags: ${{ steps.meta_build.outputs.tags }}
          labels: ${{ steps.meta_build.outputs.labels }}