fdroidserver-ipfs/.gitea/workflows/build.yaml

# ci-images/fdroidserver-ipfs/.gitea/workflows/build.yaml
#
# Daily check, build ONLY when the upstream base or the Dockerfile changed.
# See the flutter-node variant for the full explanation - identical logic,
# one upstream base instead of two.

name: build

on:
  schedule:
    - cron: "0 4 * * *"
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      force:
        description: "Build even if no upstream change was detected"
        type: boolean
        default: false

env:
  IMAGE: ${{ vars.REGISTRY_HOST }}/ci-images/fdroidserver-ipfs
  FDROIDSERVER_IMAGE: registry.gitlab.com/fdroid/docker-executable-fdroidserver:master

jobs:
  check:
    runs-on: ubuntu-docker
    outputs:
      changed: ${{ steps.cmp.outputs.changed }}
      hash:    ${{ steps.hash.outputs.hash }}
      base:    ${{ steps.up.outputs.base }}
      date:    ${{ steps.date.outputs.date }}
    steps:
      - name: Validate registry token
        run: test -n "${{ secrets.REGISTRY_TOKEN }}" || { echo "REGISTRY_TOKEN missing"; exit 1; }

      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Gitea registry
        uses: docker/login-action@v3
        with:
          registry: ${{ vars.REGISTRY_HOST }}
          username: ${{ github.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Resolve upstream digest
        id: up
        run: |
          set -euo pipefail
          b=$(docker buildx imagetools inspect "$FDROIDSERVER_IMAGE" --format '{{.Manifest.Digest}}')
          echo "base=$b" >> "$GITHUB_OUTPUT"
          echo "base: $b"

      - name: Compute input hash
        id: hash
        run: |
          set -euo pipefail
          h=$(printf '%s\n' \
                "${{ steps.up.outputs.base }}" \
                "$(sha256sum Dockerfile | cut -d' ' -f1)" \
              | sha256sum | cut -c1-12)
          echo "hash=$h" >> "$GITHUB_OUTPUT"
          echo "input hash: $h"

      - name: Compare against what is already published
        id: cmp
        run: |
          set -euo pipefail
          if [ "${{ github.event_name }}" = "push" ] || [ "${{ github.event.inputs.force }}" = "true" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "non-scheduled or forced run - building"
            echo "non-scheduled or forced run - building (hash ${{ steps.hash.outputs.hash }})" >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          if docker buildx imagetools inspect "$IMAGE:src-${{ steps.hash.outputs.hash }}" >/dev/null 2>&1; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "no change since last build - skipping"
            echo "no change since last build - skipping (hash ${{ steps.hash.outputs.hash }})" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "upstream or Dockerfile changed - building"
            echo "upstream or Dockerfile changed - building (hash ${{ steps.hash.outputs.hash }})" >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Compute date tag
        id: date
        run: echo "date=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT"

  build:
    needs: check
    if: needs.check.outputs.changed == 'true'
    runs-on: ubuntu-docker
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Gitea registry
        uses: docker/login-action@v3
        with:
          registry: ${{ vars.REGISTRY_HOST }}
          username: ${{ github.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          pull: true
          provenance: false
          cache-from: type=registry,ref=${{ env.IMAGE }}:stable
          cache-to: type=inline
          build-args: |
            IMAGE_SOURCE=https://${{ vars.REGISTRY_HOST }}/ci-images/fdroidserver-ipfs
            FDROIDSERVER_IMAGE=${{ env.FDROIDSERVER_IMAGE }}@${{ needs.check.outputs.base }}
          labels: |
            org.opencontainers.image.base.name=${{ env.FDROIDSERVER_IMAGE }}
            org.opencontainers.image.base.digest=${{ needs.check.outputs.base }}
            org.opencontainers.image.revision=${{ github.sha }}
          tags: |
            ${{ env.IMAGE }}:stable
            ${{ env.IMAGE }}:${{ needs.check.outputs.date }}
            ${{ env.IMAGE }}:src-${{ needs.check.outputs.hash }}