pmg/.github/workflows/container.yml

name: Container Image Releaser

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
    branches:
      - "main"

concurrency: ci-container-release

permissions:
  contents: read

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      with:
        submodules: true
        fetch-depth: 0

    - name: Registry Login
      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Setup QEMU
      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3

    - name: Setup Docker Buildx
      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3

    - name: Build and Push Container Image
      run: |
        # Get the tag if this was a tag push event
        if [[ "${{ github.ref_type }}" == "tag" ]]; then
          TAG=${{ github.ref_name }}
          # Validate tag format (must be vX.Y.Z)
          if [[ $TAG =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            # Build and push with both version tag and latest
            docker buildx build --push --platform linux/amd64,linux/arm64 \
              -t $REGISTRY/$IMAGE_NAME:$TAG \
              -t $REGISTRY/$IMAGE_NAME:latest \
              .
          else
            echo "Invalid tag format. Must be in format vX.Y.Z (e.g. v1.2.3)"
            exit 1
          fi
        else
          # For non-tag pushes, just use latest tag
          docker buildx build --push --platform linux/amd64,linux/arm64 \
            -t $REGISTRY/$IMAGE_NAME:latest \
            .
        fi