distribution/.github/workflows/build.yml

name: build

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches:
      - 'main'
      - 'release/*'
    tags:
      - 'v*'
  pull_request:

env:
  DOCKERHUB_SLUG: distribution/distribution
  GHCR_SLUG: ghcr.io/${{ github.repository }}

permissions:
  contents: read # to fetch code (actions/checkout)

jobs:
  test:
    env:
      # Setting GOTOOLCHAIN to local tells go
      # to to use the bundled Go version rather
      # than fetching the toolchain according to
      # toolchain directive found in go.mod.
      GOTOOLCHAIN: local
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        go:
          - 1.25.x
          - 1.26.2
        target:
          - test-coverage
          - test-s3-storage
          - test-azure-storage
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      -
        name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ matrix.go }}
          cache: false
      -
        name: Test
        run: |
          make ${{ matrix.target }}
      -
        name: Codecov
        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
        with:
          directory: ./

  build:
    permissions:
      contents: write # to create GitHub release (softprops/action-gh-release)
      packages: write # so we can push the image to GHCR

    runs-on: ubuntu-latest
    needs:
      - test
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
        with:
          images: |
            ${{ env.DOCKERHUB_SLUG }}
            ${{ env.GHCR_SLUG }}
          ### versioning strategy
          ### push semver tag v3.2.1 on main (default branch)
          # distribution/distribution:3.2.1
          # distribution/distribution:3.2
          # distribution/distribution:3
          # distribution/distribution:latest
          ### push semver prelease tag v3.0.0-beta.1 on main (default branch)
          # distribution/distribution:3.0.0-beta.1
          ### push on main
          # distribution/distribution:edge
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=ref,event=pr
            type=edge
          labels: |
            org.opencontainers.image.title=Distribution
            org.opencontainers.image.description=The toolkit to pack, ship, store, and distribute container content
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Log in to GitHub Container registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
      -
        name: Build artifacts
        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
        with:
          source: .
          targets: artifact-all
      -
        name: Rename provenance
        run: |
          for pdir in ./bin/*/; do
            (
              cd "$pdir"
              binname=$(find . -name '*.tar.gz')
              filename=$(basename "${binname%.tar.gz}")
              mv "provenance.json" "${filename}.provenance.json"
            )
          done
      -
        name: Move and list artifacts
        run: |
          mv ./bin/**/* ./bin/
          tree -nh ./bin
      -
        name: Upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: registry
          path: ./bin/*
          if-no-files-found: error
      -
        name: Build image
        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
        with:
          source: .
          files: |
            ./docker-bake.hcl
            ${{ steps.meta.outputs.bake-file }}
          targets: image-all
          push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
      -
        name: GitHub Release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        if: startsWith(github.ref, 'refs/tags/')
        with:
          draft: true
          files: |
            bin/*.tar.gz
            bin/*.provenance.json
            bin/*.sha256
        env:
          GITHUB_TOKEN: ${{ github.token }}