dockerhub.yml

# This workflow uses secrets stored in a specific github environment called `dockerhub-publish`.
# It needs to be created in repository settings->environments
# Add the dockerhub username and password in secrets named:
#    DOCKERHUB_USERNAME
#    DOCKERHUB_PASSWORD
# Add the dockerhub repo path in a secret named:
#    DOCKERHUB_REPO
# This workflow will use them automatically.
## Notes:
# - The workflow_dispatch event will be named latest only on dockerhub.
# - The push event is used to automatically trigger the workflow when a new tag is pushed to the repository.
# - The metadata action is used to extract the version from the tag and generate the appropriate Docker tags.
# - The build-push-action is used to build and push the Docker image to Docker Hub.
# - The cache-from and cache-to actions are used to cache the Docker image layers between builds.
# -- If you don't want to have a build cache image, you can remove the cache-from and cache-to actions,
# -- or you can set it to another dockerhub repo (e.g. user/different-dockerhub-repo)
# - The sbom action is used to generate a Software Bill of Materials (SBOM) for the Docker image.

name: Publish Docker images

on:
    workflow_dispatch:
    push:
        tags:
            - 'v*'

jobs:
  publish-image:
    name: Push Docker image to Docker Hub
    environment: dockerhub-publish
    runs-on: ubuntu-latest
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Check out the repo
        uses: actions/checkout@v4

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ secrets.DOCKERHUB_REPO }}
          tags: |
            type=semver,pattern={{version}},event=push
            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
            type=raw,value={{branch}},enable=${{ github.ref != format('refs/heads/{0}', 'main') }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          file: './Dockerfile'
          push: true
          platforms: linux/amd64,linux/arm64
          cache-from: type=registry,ref=${{ secrets.DOCKERHUB_REPO }}:buildcache
          cache-to: type=registry,ref=${{ secrets.DOCKERHUB_REPO }}:buildcache,mode=max
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          sbom: true