MeshChatX/.gitea/workflows/docker.yml

name: Build and Publish Docker Image

on:
    workflow_dispatch:
    push:
        branches:
            - master
            - dev
        tags:
            - "*"

env:
    REGISTRY: git.quad4.io
    IMAGE_NAME: rns-things/meshchatx

jobs:
    build:
        runs-on: ubuntu-latest
        permissions:
            contents: read
            packages: write

        steps:
            - name: Checkout repository
              run: |
                  set -eu
                  SERVER="${GITEA_SERVER_URL:-${GITHUB_SERVER_URL:-}}"
                  REPO="${GITEA_REPOSITORY:-${GITHUB_REPOSITORY:-}}"
                  if [ -z "$SERVER" ] || [ -z "$REPO" ]; then
                    echo "Checkout: set GITEA_SERVER_URL/GITEA_REPOSITORY or GITHUB_SERVER_URL/GITHUB_REPOSITORY" >&2
                    exit 1
                  fi
                  if [ -n "${GITEA_TOKEN:-}" ] || [ -n "${GITHUB_TOKEN:-}" ]; then
                    TOKEN="${GITEA_TOKEN:-$GITHUB_TOKEN}"
                    git config --global credential.helper "!f() { echo username=x-access-token; echo password=${TOKEN}; }; f"
                  fi
                  git clone "${SERVER}/${REPO}.git" .
                  git checkout "${GITHUB_SHA}"

            - name: Set up Docker (QEMU + Buildx + Login)
              run: sh scripts/ci/setup-docker.sh "${{ env.REGISTRY }}" "${{ secrets.REGISTRY_USERNAME }}" "${{ secrets.REGISTRY_PASSWORD }}"

            - name: Download Trivy
              run: |
                  curl -L -o /tmp/trivy.deb https://git.quad4.io/Quad4-Software/Trivy-Assets/raw/commit/fdfe96b77d2f7b7f5a90cea00af5024c9f728f17/trivy_0.69.3_Linux-64bit.deb
                  sh scripts/ci/exec-priv.sh dpkg -i /tmp/trivy.deb || sh scripts/ci/exec-priv.sh apt-get install -f -y

            - name: Trivy FS scan
              run: trivy fs --exit-code 1 .

            - name: Generate Docker tags
              id: tags
              run: |
                  sh scripts/ci/docker-tags.sh "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}" /tmp/docker-tags.txt
                  TAGS="$(tr '\n' ' ' < /tmp/docker-tags.txt)"
                  echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
                  FIRST_TAG="$(head -1 /tmp/docker-tags.txt | sed 's/^-t //')"
                  echo "first_tag=${FIRST_TAG}" >> "$GITHUB_OUTPUT"

            - name: Build and push Docker image
              run: |
                  docker buildx build \
                    --platform linux/amd64,linux/arm64 \
                    --push \
                    --no-cache \
                    ${{ steps.tags.outputs.tags }} \
                    -f ./Dockerfile .

            - name: Scan Docker image
              run: trivy image --exit-code 0 "${{ steps.tags.outputs.first_tag }}"