SealShare/.gitea/workflows/docker.yml

name: docker

on:
  push:
    branches:
      - main
    tags:
      - "v*.*.*"
  pull_request:
    branches:
      - main

permissions:
  contents: write
  packages: write

jobs:
  test:
    runs-on: ubuntu-latest
    environment: Testing
    strategy:
      matrix:
        php-version: ["8.5"]

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php-version }}
          extensions: pcntl
          tools: composer:v2
          coverage: xdebug

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: "24"

      - name: Install Node Dependencies
        run: npm ci

      - name: Install Dependencies
        run: composer install --no-interaction --prefer-dist --optimize-autoloader

      - name: Copy Environment File
        run: cp .env.example .env

      - name: Generate Application Key
        run: php artisan key:generate

      - name: Build Assets
        run: npm run build

      - name: Install Playwright Browsers
        run: npx playwright install --with-deps chromium

      - name: Run Tests
        run: ./vendor/bin/pest

  build-and-push:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      # The runner is an arm64 server, so the amd64 image's final stage is emulated. QEMU 8.x
      # crashes running x86_64 programs on an arm64 host (QEMU issue 2168, "QEMU internal
      # SIGSEGV {code=MAPERR, addr=0x20}") and 10.2 segfaults on this runner too; 9.2.2 was
      # checked on the runner's host: node, composer and install-php-extensions all run.
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        with:
          image: tonistiigi/binfmt:qemu-v9.2.2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      # Gitea's job token cannot publish packages yet: REGISTRY_TOKEN is an access token with
      # package write rights, owned by the account that pushes (gitea.actor).
      - name: Log in to the Gitea container registry
        if: gitea.event_name != 'pull_request'
        uses: docker/login-action@v4
        with:
          registry: gitea.nonameweb.ch
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: gitea.nonameweb.ch/nonameweb/sealshare
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=ref,event=branch
            type=sha

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: ${{ gitea.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=registry,ref=gitea.nonameweb.ch/nonameweb/sealshare:buildcache
          cache-to: ${{ gitea.event_name != 'pull_request' && 'type=registry,ref=gitea.nonameweb.ch/nonameweb/sealshare:buildcache,mode=max' || '' }}

  release:
    runs-on: ubuntu-latest
    needs: build-and-push
    if: startsWith(gitea.ref, 'refs/tags/v')
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Take the release notes from the changelog
        run: |
          version="${{ gitea.ref_name }}"
          awk -v heading="## [${version#v}]" 'index($0, heading) == 1 { found = 1; next } found && /^## \[/ { exit } found { print }' CHANGELOG.md > release-notes.md
          test -s release-notes.md

      - name: Create the Gitea release
        uses: https://gitea.com/actions/gitea-release-action@v1
        with:
          body_path: release-notes.md