iot-dc3/.github/workflows/docker-ci.yml

name: Docker Image

on:
  push:
    tags:
      - dc3.release.*
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: docker-image-${{ github.ref }}
  cancel-in-progress: true

env:
  PROFILE: pro
  DOCKER_REGISTRY_DEFAULT: pnoker
  DOCKER_REGISTRY_ALIYUN: registry.cn-beijing.aliyuncs.com/dc3

jobs:
  build-push:
    runs-on: ubuntu-latest
    timeout-minutes: 180
    permissions:
      contents: read
      actions: write   # for GitHub Actions cache (--cache-to type=gha)
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Extract variables
        id: variables
        run: |
          set -euo pipefail
          # Read project.version from pom.xml without invoking Maven (the
          # whole build runs inside Docker now; the runner does not need
          # a JDK at all). iot-dc3's <version> is inherited from <parent>.
          VERSION=$(awk -F'[<>]' '/<parent>/,/<\/parent>/{if($2=="version") print $3}' pom.xml | head -1)
          SERIES="$VERSION"
          if [[ "$VERSION" == *.*.* ]]; then
            SERIES="${VERSION%.*}"
          fi
          echo "service_version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "service_series=$SERIES" >> "$GITHUB_OUTPUT"

      - name: Set QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login Docker Default Registry
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login Docker Aliyun Registry
        uses: docker/login-action@v3
        with:
          registry: registry.cn-beijing.aliyuncs.com
          username: ${{ vars.ALIYUN_DOCKERHUB_USERNAME }}
          password: ${{ secrets.ALIYUN_DOCKERHUB_TOKEN }}

      - name: Build and push all images
        env:
          SERVICE_VERSION: ${{ steps.variables.outputs.service_version }}
          SERVICE_SERIES: ${{ steps.variables.outputs.service_series }}
        run: |
          set -euo pipefail

          services=(
            dc3-gateway
            dc3-center-agentic
            dc3-center-auth
            dc3-center-data
            dc3-center-manager
            dc3-center-single
            dc3-driver-listening-virtual
            dc3-driver-modbus-tcp
            dc3-driver-mqtt
            dc3-driver-opc-da
            dc3-driver-opc-ua
            dc3-driver-plcs7
            dc3-driver-virtual
          )

          for name in "${services[@]}"; do
            echo "Building and pushing: $name"
            # Single root-level Dockerfile defines a target stage per service.
            # The shared `builder` stage (mvn package) runs ONCE for the
            # whole reactor; BuildKit reuses it across every target image.
            # GHA cache (type=gha) persists the builder stage between runs so
            # subsequent CI invocations only rebuild what actually changed.
            docker buildx build \
              --platform linux/arm64,linux/amd64 \
              --file Dockerfile \
              --target "$name" \
              --build-arg PROFILE="$PROFILE" \
              --cache-from type=gha,scope=dc3-builder \
              --cache-to type=gha,scope=dc3-builder,mode=max \
              --push \
              --tag "$DOCKER_REGISTRY_DEFAULT/$name:latest" \
              --tag "$DOCKER_REGISTRY_DEFAULT/$name:$SERVICE_SERIES" \
              --tag "$DOCKER_REGISTRY_DEFAULT/$name:$SERVICE_VERSION" \
              --tag "$DOCKER_REGISTRY_ALIYUN/$name:latest" \
              --tag "$DOCKER_REGISTRY_ALIYUN/$name:$SERVICE_SERIES" \
              --tag "$DOCKER_REGISTRY_ALIYUN/$name:$SERVICE_VERSION" \
              .
          done

  release:
    runs-on: ubuntu-latest
    needs: build-push
    if: startsWith(github.ref, 'refs/tags/dc3.release.')
    timeout-minutes: 20
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Extract variables
        id: variables
        run: |
          set -euo pipefail
          VERSION=$(awk -F'[<>]' '/<parent>/,/<\/parent>/{if($2=="version") print $3}' pom.xml | head -1)
          echo "service_version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Generate release notes
        id: release_notes
        env:
          SERVICE_VERSION: ${{ steps.variables.outputs.service_version }}
          SERVICE_WORKSPACE: ${{ github.workspace }}
        run: |
          set -euo pipefail

          {
            echo "release_notes<<RELEASE_NOTES_EOF"
            echo ""
            perl -pe 's/\$\{SERVICE_VERSION\}/$ENV{SERVICE_VERSION}/g' "$SERVICE_WORKSPACE/dc3/doc/TITLE.md"
            echo ""
            perl -pe 's/\$\{SERVICE_VERSION\}/$ENV{SERVICE_VERSION}/g' "$SERVICE_WORKSPACE/dc3/doc/CHANGE.md"
            echo ""
            perl -pe 's/\$\{SERVICE_VERSION\}/$ENV{SERVICE_VERSION}/g' "$SERVICE_WORKSPACE/dc3/doc/USAGE.md"
            echo "RELEASE_NOTES_EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          name: ${{ steps.variables.outputs.service_version }}
          body: ${{ steps.release_notes.outputs.release_notes }}
          tag_name: ${{ github.ref_name }}
          draft: false
          prerelease: false
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}