docker.yml

name: "Docker"

on:
  workflow_dispatch:

  push:

  schedule:
    - cron: "0 8 * * 1"

permissions:
  contents: read

jobs:
  lint:
    name: "Lint & unit tests"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod

      - name: VERSION format
        run: grep -Eqx '[0-9]{4}\.[0-9]{2}\.[0-9]{2}(\.[0-9]+)?' VERSION || { echo "::error file=VERSION::expected YYYY.MM.DD or YYYY.MM.DD.N, got '$(cat VERSION)'"; exit 1; }

      - name: go vet
        run: go vet ./...

      - name: go test
        run: go test -race ./...

      - name: staticcheck
        uses: dominikh/staticcheck-action@v1
        with:
          install-go: false
          # v0.8.1 (latest release) can't read go1.27.2 export data ("export
          # data version 5 is greater than maximum supported version 4").
          # Pinned to a master commit verified against go1.27.2; switch
          # back to a release tag once one newer than v0.8.1 ships.
          version: "452d5bb86b45"

      - name: govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

      - name: shellcheck
        run: shellcheck .docker/viewdoc.sh

      - name: hadolint
        run: |
          for f in Dockerfile .docker/kasm/Dockerfile .docker/webtop/Dockerfile; do
            echo "::group::$f"
            docker run --rm -i -v "$PWD/.hadolint.yaml:/.config/hadolint.yaml:ro" hadolint/hadolint < "$f"
            echo "::endgroup::"
          done

  test:
    name: "Test (${{ matrix.variant }})"
    needs: lint
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - variant: control-center
            dockerfile: Dockerfile
          - variant: viewer-kasm
            dockerfile: .docker/kasm/Dockerfile
          - variant: viewer-webtop
            dockerfile: .docker/webtop/Dockerfile
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build image for testing
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          push: false
          tags: dockette/viewdoc:${{ matrix.variant }}-test
          platforms: linux/amd64
          load: true

  build:
    name: "Build (${{ matrix.variant }})"
    needs: test
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - variant: control-center
            dockerfile: Dockerfile
          - variant: viewer-kasm
            dockerfile: .docker/kasm/Dockerfile
          - variant: viewer-webtop
            dockerfile: .docker/webtop/Dockerfile
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      # Only a push needs credentials; pull requests from forks and Dependabot
      # have no access to the secrets (same as dockette/.github docker.yml).
      - name: Login to DockerHub
        if: github.ref == 'refs/heads/master'
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Read VERSION
        id: version
        run: echo "version=$(cat VERSION)" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      # dockette/viewdoc:<variant>             rolling, latest master
      # dockette/viewdoc:<variant>-<VERSION>   release (YYYY.MM.DD); like other
      #                                         dockette versions it's rebuilt
      #                                         by the weekly schedule
      # dockette/viewdoc:<variant>-<sha>       immutable, for rollbacks / pinning
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: dockette/viewdoc
          flavor: latest=false
          tags: |
            type=raw,value=${{ matrix.variant }}
            type=raw,value=${{ matrix.variant }}-${{ steps.version.outputs.version }}
            type=sha,prefix=${{ matrix.variant }}-,format=short
          labels: |
            org.opencontainers.image.version=${{ steps.version.outputs.version }}

      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          push: ${{ github.ref == 'refs/heads/master' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            VERSION=${{ steps.version.outputs.version }}
          platforms: linux/amd64,linux/arm64
          cache-from: type=gha,scope=${{ matrix.variant }}
          cache-to: type=gha,scope=${{ matrix.variant }}

  # Tags the commit and publishes a GitHub release for VERSION the first
  # time it reaches master with all images pushed (make release bumps it).
  release:
    name: "Release"
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Create release if VERSION is new
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          v="$(cat VERSION)"
          if gh release view "$v" >/dev/null 2>&1; then
            echo "Release $v already exists"
            exit 0
          fi
          gh release create "$v" --target "$GITHUB_SHA" --title "$v" --generate-notes

  docs:
    name: "Docs"
    needs: build
    if: github.ref == 'refs/heads/master'
    uses: dockette/.github/.github/workflows/dockerhub-description.yml@master
    secrets: inherit
    with:
      image: "dockette/viewdoc"