Triple-C/.gitea/workflows/build.yml

name: Build Container

on:
  push:
    branches: [main]
    paths:
      - "container/**"
      - ".gitea/workflows/build.yml"
  pull_request:
    branches: [main]
    paths:
      - "container/**"
      - ".gitea/workflows/build.yml"

env:
  REGISTRY: repo.anhonesthost.net
  IMAGE_NAME: cybercovellc/triple-c/triple-c-sandbox

jobs:
  build-container:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Gitea Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: shadowdao
          password: ${{ secrets.GH_PAT }}

      - name: Build and push container image
        uses: docker/build-push-action@v5
        with:
          context: ./container
          file: ./container/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: ${{ gitea.event_name == 'push' }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ gitea.sha }}
            ghcr.io/shadowdao/triple-c-sandbox:latest
            ghcr.io/shadowdao/triple-c-sandbox:${{ gitea.sha }}
          # `ignore-error` is what stops a cache failure failing a build that
          # already succeeded. act_runner emulates the GitHub Actions cache
          # service on the runner host's LAN address, and the `docker-container`
          # builder `setup-buildx-action` creates could not route to it —
          # every layer of both arches built, then the job died on
          # `GetCacheEntryDownloadURL: no route to host` while exporting.
          #
          # On a pull_request `push:` above is false, so this job pushes
          # nothing and the cache is its only output: failing it discarded a
          # complete, successful validation of the Dockerfile for both
          # architectures. A cache is an optimisation and must degrade to
          # "slow", never to "red".
          #
          # The import is already non-fatal — the build ran all 37 layers after
          # warning that it could not read the cache — so only the exporter
          # needs the flag.
          cache-from: type=gha
          cache-to: type=gha,mode=max,ignore-error=true