strix/.github/workflows/sandbox-image.yml

name: Sandbox Image

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Image tag to publish (e.g. 1.2.0)'
        required: true
      latest:
        description: 'Also tag as latest'
        type: boolean
        default: true

permissions:
  contents: read

env:
  IMAGE: ghcr.io/${{ github.repository_owner }}/strix-sandbox

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            platform: linux/amd64
          - os: ubuntu-22.04-arm
            platform: linux/arm64

    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0

      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
        with:
          context: .
          file: containers/Dockerfile
          platforms: ${{ matrix.platform }}
          provenance: mode=max
          sbom: true
          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          set -euo pipefail
          mkdir -p /tmp/digests
          touch "/tmp/digests/${DIGEST#sha256:}"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: digest-${{ runner.arch }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  publish:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: /tmp/digests
          pattern: digest-*
          merge-multiple: true

      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0

      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest list
        env:
          TAG: ${{ inputs.tag }}
          ALSO_LATEST: ${{ inputs.latest }}
        run: |
          set -euo pipefail
          tags=(-t "${IMAGE}:${TAG}")
          if [ "${ALSO_LATEST}" = "true" ]; then
            tags+=(-t "${IMAGE}:latest")
          fi
          digests=()
          for file in /tmp/digests/*; do
            digests+=("${IMAGE}@sha256:$(basename "$file")")
          done
          docker buildx imagetools create "${tags[@]}" "${digests[@]}"
          docker buildx imagetools inspect "${IMAGE}:${TAG}"