Create docker-image.yml

from @Entepotenz

.github/workflows/docker-image.yml

@@ -0,0 +1,170 @@
+---
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: Create and publish a Docker image
+
+on:
+  schedule:
+    - cron: "5 4 * * 0" # At 04:05 on Sunday
+  push:
+    branches:
+      - "**"
+    tags:
+      - "v*.*.*"
+  pull_request:
+    branches:
+      - "main"
+
+# cancel a currently running workflow from the same PR, branch or tag when a new workflow is triggered
+# source: https://stackoverflow.com/questions/66335225/how-to-cancel-previous-runs-in-the-pr-when-you-push-new-commitsupdate-the-curre/67939898#67939898
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY_GITHUB: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+  BUILD_PLATFORMS: "linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7"
+  BASE_IMAGE: "library/alpine:latest"
+
+jobs:
+  check-pre-condition:
+    name: evaluate if container should be build
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      condition_met: ${{ steps.set_output.outputs.run_jobs }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - id: string_lower_case
+        uses: Entepotenz/change-string-case-action-min-dependencies@v1
+        with:
+          string: ${{ env.IMAGE_NAME }}
+
+      - name: Docker Image Update Checker
+        id: baseupdatecheck
+        uses: lucacome/docker-image-update-checker@v1
+        with:
+          base-image: ${{ env.BASE_IMAGE }}
+          image: ${{ steps.string_lower_case.outputs.lowercase }}:latest
+
+      - name: determine if we should build
+        id: set_output
+        env:
+          IMAGE_NEEDS_UPDATE: ${{ steps.baseupdatecheck.outputs.needs-updating }}
+          GIT_EVENT_NAME: ${{ github.event_name }}
+        run: |
+          if [ "$IMAGE_NEEDS_UPDATE" = "true" ] || [ "$GIT_EVENT_NAME" = "push" ] || [ "$GIT_EVENT_NAME" = "pull_request" ]; then
+            echo "run_jobs=true" >> "$GITHUB_OUTPUT"
+            echo "### We need to build a new docker image! :rocket:" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "run_jobs=false" >> "$GITHUB_OUTPUT"
+            echo "### Everything is already up-to-date!" >> "$GITHUB_STEP_SUMMARY"
+          fi
+          { 
+            echo "IMAGE_NEEDS_UPDATE:='$IMAGE_NEEDS_UPDATE'"
+            echo "GIT_EVENT_NAME:='$GIT_EVENT_NAME'"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    needs: [check-pre-condition]
+    if: needs.check-pre-condition.outputs.condition_met == 'true'
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+      # id-token: write # needed for signing the images with GitHub OIDC Token
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # - name: Install Cosign
+      #   uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        if: github.event_name != 'pull_request'
+        with:
+          registry: ${{ env.REGISTRY_GITHUB }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.TOKEN }}
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v3 
+        if: github.event_name != 'pull_request'
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE_NAME }},${{ env.REGISTRY_GITHUB }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+          flavor: |
+            latest=auto
+            prefix=
+            suffix=
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        id: build-and-push
+        with:
+          context: .
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          pull: true
+          file: Dockerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Docker Hub Description
+        uses: peter-evans/dockerhub-description@v4
+        if: github.event_name != 'pull_request'
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          repository: ${{ env.IMAGE_NAME }}
+          readme-filepath: ./README.md
+
+      # - name: Extract metadata (tags, labels) for Docker
+      #   id: docker_meta
+      #   uses: docker/metadata-action@v5
+      #   with:
+      #     images: ${{ env.REGISTRY_GITHUB }}/${{ env.IMAGE_NAME }}
+      #     tags: |
+      #       type=sha,format=long
+
+      # # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+      # - name: Sign image with a key
+      #   run: |
+      #     cosign sign --yes --key env://COSIGN_PRIVATE_KEY "${TAGS}@${DIGEST}"
+      #   env:
+      #     TAGS: ${{ steps.docker_meta.outputs.tags }}
+      #     COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+      #     COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+      #     DIGEST: ${{ steps.build-and-push.outputs.digest }}
+
+      # - name: Sign the images with GitHub OIDC Token
+      #   env:
+      #     DIGEST: ${{ steps.build-and-push.outputs.digest }}
+      #     TAGS: ${{ steps.docker_meta.outputs.tags }}
+      #   run: cosign sign --yes "${TAGS}@${DIGEST}"