name: Publish Docker image

on:
    release:
        types: [ published ]

env:
    REGISTRY: ghcr.io
    IMAGE_NAME: ${{ github.repository }}

jobs:
    push_to_registries:
        name: Push Docker image to multiple registries
        runs-on: ubuntu-latest
        permissions:
            packages: write
            contents: read
            attestations: write
            id-token: write
        steps:
            -   name: Check out the repo
                uses: actions/checkout@v4

            -   name: Log in to Docker Hub
                uses: docker/login-action@v3
                with:
                    username: ${{ secrets.DOCKER_USERNAME }}
                    password: ${{ secrets.DOCKER_PASSWORD }}

            -   name: Log in to the Container registry
                uses: docker/login-action@v3
                with:
                    registry: ghcr.io
                    username: ${{ github.actor }}
                    password: ${{ secrets.GITHUB_TOKEN }}

            -   name: Extract metadata (tags, labels) for Docker
                id: meta
                uses: docker/metadata-action@v5
                with:
                    images: |
                        maelgangloff/domain-watchdog
                        ghcr.io/${{ github.repository }}

            -   name: Set up QEMU
                uses: docker/setup-qemu-action@v3

            -   name: Set up Docker Buildx
                id: buildx
                uses: docker/setup-buildx-action@v3

            -   name: Build and push Docker images
                id: push
                uses: docker/build-push-action@v6
                with:
                    context: .
                    target: frankenphp_prod
                    push: true
                    tags: ${{ steps.meta.outputs.tags }}
                    labels: ${{ steps.meta.outputs.labels }}
                    platforms: linux/amd64,linux/arm64

            -   name: Generate artifact attestation
                uses: actions/attest-build-provenance@v1
                with:
                    subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
                    subject-digest: ${{ steps.push.outputs.digest }}
                    push-to-registry: true