metapi/.github/workflows/publish-ghcr.yml

name: 手动发布 GHCR 镜像

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 镜像标签
        required: false
        default: latest

permissions:
  contents: read
  packages: write

concurrency:
  # The tag is the shared output resource; serialize runs targeting the same tag.
  group: ghcr-publish-${{ inputs.tag }}
  cancel-in-progress: false

jobs:
  validate_tag:
    name: 校验镜像标签
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.validate.outputs.tag }}
    steps:
      - name: 校验 Docker 标签格式
        id: validate
        shell: bash
        env:
          INPUT_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          if [[ ! "$INPUT_TAG" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]]; then
            echo "Invalid Docker tag: $INPUT_TAG" >&2
            exit 1
          fi
          printf 'tag=%s\n' "$INPUT_TAG" >> "$GITHUB_OUTPUT"

  publish-ghcr-arch:
    name: 发布 GHCR 镜像（${{ matrix.arch }}）
    needs: validate_tag
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    env:
      GHCR_IMAGE: ghcr.io/${{ github.repository }}
      IMAGE_TAG: ${{ needs.validate_tag.outputs.tag }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            platform: linux/amd64
            runner: ubuntu-latest
          - arch: arm64
            platform: linux/arm64
            runner: ubuntu-24.04-arm
          - arch: armv7
            platform: linux/arm/v7
            runner: ubuntu-latest

    steps:
      - name: 检出仓库
        uses: actions/checkout@v7

      - name: 设置 Buildx
        uses: docker/setup-buildx-action@v4

      - name: 为 armv7 启用 QEMU
        if: matrix.arch == 'armv7'
        uses: docker/setup-qemu-action@v4

      - name: 登录 GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 生成镜像元数据
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.GHCR_IMAGE }}
          tags: |
            type=raw,value=${{ needs.validate_tag.outputs.tag }}

      - name: 为每个架构追加后缀
        id: arch-tags
        shell: bash
        run: |
          set -euo pipefail
          rm -f tags.txt
          while IFS= read -r tag; do
            [ -n "$tag" ] || continue
            echo "${tag}-${{ matrix.arch }}" >> tags.txt
          done <<< "${{ steps.meta.outputs.tags }}"
          {
            echo 'tags<<EOF'
            cat tags.txt
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

      - name: 构建并推送 ${{ matrix.platform }} 镜像
        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/Dockerfile
          platforms: ${{ matrix.platform }}
          push: true
          tags: ${{ steps.arch-tags.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=ghcr-${{ matrix.arch }}
          cache-to: type=gha,mode=max,scope=ghcr-${{ matrix.arch }}

  publish-ghcr-manifest:
    name: 发布 GHCR Manifest
    needs: [validate_tag, publish-ghcr-arch]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      GHCR_IMAGE: ghcr.io/${{ github.repository }}
      IMAGE_TAG: ${{ needs.validate_tag.outputs.tag }}

    steps:
      - name: 检出仓库
        uses: actions/checkout@v7

      - name: 设置 Buildx
        uses: docker/setup-buildx-action@v4

      - name: 登录 GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 创建多架构 manifest
        shell: bash
        run: |
          set -euo pipefail
          tag="${GHCR_IMAGE}:${IMAGE_TAG}"
          docker buildx imagetools create \
            --tag "$tag" \
            "${tag}-amd64" \
            "${tag}-arm64" \
            "${tag}-armv7"