coder/.github/workflows/docker-base.yaml

name: docker-base

on:
  push:
    branches:
      - main
    paths:
      - scripts/Dockerfile.base
      - scripts/Dockerfile

  pull_request:
    # Self-reference on `pull_request` is intentional: a PR that edits this
    # workflow runs the build to verify the YAML is well-formed and the
    # base image still builds. Pushes are gated separately by
    # `push: ${{ github.event_name != 'pull_request' }}` on the
    # depot/build-push-action below, so a PR builds the image but never
    # publishes it. See DOCS-129 for the broader workflow-self-reference
    # audit.
    paths:
      - scripts/Dockerfile.base
      - .github/workflows/docker-base.yaml

  schedule:
    # Run every week at 09:43 on Monday, Wednesday and Friday. We build this
    # frequently to ensure that packages are up-to-date.
    - cron: "43 9 * * 1,3,5"

  workflow_dispatch:

permissions:
  contents: read

# Avoid running multiple jobs for the same commit.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-docker-base

jobs:
  build:
    permissions:
      # Necessary for depot.dev authentication.
      id-token: write
      # Necessary to push docker images to ghcr.io.
      packages: write
    runs-on: ubuntu-latest
    if: github.repository_owner == 'coder'
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Docker login
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create empty base-build-context directory
        run: mkdir base-build-context

      - name: Install depot.dev CLI
        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1

      # This uses OIDC authentication, so no auth variables are required.
      - name: Build base Docker image via depot.dev
        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
        with:
          project: wl5hnrrkns
          context: base-build-context
          file: scripts/Dockerfile.base
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          provenance: true
          pull: true
          no-cache: true
          push: ${{ github.event_name != 'pull_request' }}
          tags: |
            ghcr.io/coder/coder-base:latest

      - name: Verify that images are pushed properly
        if: github.event_name != 'pull_request'
        run: |
          # retry 10 times with a 5 second delay as the images may not be
          # available immediately
          for i in {1..10}; do
            rc=0
            raw_manifests=$(docker buildx imagetools inspect --raw ghcr.io/coder/coder-base:latest) || rc=$?
            if [[ "$rc" -eq 0 ]]; then
              break
            fi
            if [[ "$i" -eq 10 ]]; then
              echo "Failed to pull manifests after 10 retries"
              exit 1
            fi
            echo "Failed to pull manifests, retrying in 5 seconds"
            sleep 5
          done

          manifests=$(
            echo "$raw_manifests" | \
              jq -r '.manifests[].platform | .os + "/" + .architecture + (if .variant then "/" + .variant else "" end)'
          )

          # Verify all 3 platforms are present.
          set -euxo pipefail
          echo "$manifests" | grep -q linux/amd64
          echo "$manifests" | grep -q linux/arm64
          echo "$manifests" | grep -q linux/arm/v7