haproxy-manager-base/.gitea/workflows/build-push.yaml

name: HAProxy Manager Build and Push
run-name: ${{ gitea.actor }} pushed a change to main
on:
  push:
    branches:
      - main
  # Manual publish (e.g. after a [skip ci] merge, or to re-publish after a
  # failed arm64 leg).
  workflow_dispatch:

# Multi-arch (linux/amd64 + linux/arm64) in ONE job on the trusted x86 runner.
# Each platform is pushed BY DIGEST (untagged) to BOTH registries, then
# scripts/assemble-multiarch-index.sh creates :latest, :<version> and :<sha>
# from those digests (same template as build-push-coraza.yaml; see
# docs/arm64/IMAGE-PIPELINE-PLAN.md sections 4.1 / 4.4 in the WHP repo).
#   * amd64 is required and built exactly as before; the Dockerfile build gate
#     (unit suites + `haproxy -c`) runs in it. Failure = nothing published.
#   * arm64 is continue-on-error and runs the SAME Dockerfile gate under QEMU
#     (the gate is RUN steps, so it executes on the arm64 binary). If arm64
#     fails or times out the tags are published amd64-only, exactly as before
#     multi-arch, and a previous run's arm64 is never re-attached (the digest is
#     read only from THIS run's step output).
jobs:
  Build-and-Push:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # Internal package cache (CT130 pkg-cache; canonical docs: docs/pkg-cache.md
      # in cloud-apache-container). Used ONLY if it answers over TLS with our
      # pinned CA; otherwise (down, unreachable, bad/expired cert) this job builds
      # from the upstream repositories exactly as before. The base image comes
      # from the in-house registry (repo.anhonesthost.net, weekly digest-pinned
      # mirror of Docker Hub - mirror-base-image.yaml), not docker.io, so the
      # pkg-cache registry mirror is never used here: repos only.
      - name: Probe package cache
        id: pkgcache
        run: |
          url=""
          if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
          echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=<not used: no docker.io base (base from repo.anhonesthost.net)>"
          [ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
          echo "url=${url}" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

      - name: Set up Docker Buildx
        uses: https://github.com/docker/setup-buildx-action@v3
      
      - name: Login to Gitea
        uses: docker/login-action@v3
        with:
          registry: repo.anhonesthost.net
          username: ${{ secrets.CI_USER }}
          password: ${{ secrets.CI_TOKEN }}

      # Second push target so the image is also available from GitHub Container
      # Registry under the user's account. The PAT only needs write:packages
      # (and read:packages if the package is private). Stored in Gitea as
      # secrets.GHCR_TOKEN; username is the literal GitHub login.
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: shadowdao
          password: ${{ secrets.GHCR_TOKEN }}

      # Read the human-readable release version from the VERSION file so every
      # build is pinnable for rollback (alongside the immutable git SHA). Bump
      # VERSION (YYYY.MM.N) in the same commit as a release-worthy change.
      - name: Read version
        id: ver
        run: echo "version=$(cat VERSION)" >> "$GITHUB_OUTPUT"

      # amd64: required. Pushed untagged by digest to both registries (same
      # digest in each); tags are only created by the assemble step below.
      - name: Build amd64 (push by digest)
        id: amd64
        uses: docker/build-push-action@v6
        with:
          platforms: linux/amd64
          build-args: |
            VERSION=${{ steps.ver.outputs.version }}
            PKG_CACHE=${{ steps.pkgcache.outputs.url }}
          outputs: type=image,"name=repo.anhonesthost.net/cloud-hosting-platform/haproxy-manager-base,ghcr.io/shadowdao/haproxy-manager-base",push-by-digest=true,name-canonical=true,push=true

      # arm64: best effort (QEMU, apt-based image). Must never block or alter
      # the amd64 tags.
      - name: Build arm64 (push by digest)
        id: arm64
        continue-on-error: true
        timeout-minutes: 30
        uses: docker/build-push-action@v6
        with:
          platforms: linux/arm64
          build-args: |
            VERSION=${{ steps.ver.outputs.version }}
            PKG_CACHE=${{ steps.pkgcache.outputs.url }}
          outputs: type=image,"name=repo.anhonesthost.net/cloud-hosting-platform/haproxy-manager-base,ghcr.io/shadowdao/haproxy-manager-base",push-by-digest=true,name-canonical=true,push=true

      # Three tags per registry: :latest (moving), :<version> (human-readable
      # release), :<sha> (immutable, guaranteed-unique rollback target).
      - name: Assemble tag indexes
        env:
          AMD64_DIGEST: ${{ steps.amd64.outputs.digest }}
          ARM64_DIGEST: ${{ steps.arm64.outputs.digest }}
          ARM64_OUTCOME: ${{ steps.arm64.outcome }}
          VERSION: ${{ steps.ver.outputs.version }}
          SHA: ${{ gitea.sha }}
        run: |
          scripts/assemble-multiarch-index.sh \
            --amd64 "$AMD64_DIGEST" \
            --arm64 "$ARM64_DIGEST" --arm64-outcome "$ARM64_OUTCOME" \
            --repo repo.anhonesthost.net/cloud-hosting-platform/haproxy-manager-base \
            --repo ghcr.io/shadowdao/haproxy-manager-base \
            --tag latest --tag "$VERSION" --tag "$SHA"