name: docker-builder

# Publishes the pinned builder toolchain image:
# ghcr.io/streamplace/streamplace:builder-<DOCKERFILE_HASH>, the tag that
# .gitlab-ci.yml jobs and hack/container.sh (local dev containers) run on,
# resolved from .ci/dockerfile-hash.yaml. The hash covers every file the
# image bakes in (build.Dockerfile plus its ADD inputs), so any change
# publishes a new tag rather than mutating the pinned one.
#
# docker.yaml only pushes images on `next` and `v*` tags, but the pinned tag
# must also exist for branch pipelines (GitLab runs per-branch builds, and a
# branch that changes a docker/ builder input needs its new hash published
# before its own jobs can start). This is docker.yaml's builder job split out
# on its own every-push trigger; the registry build cache makes unchanged
# Dockerfiles a fast cache hit, and re-pushing an existing tag is idempotent.

on:
  push:

concurrency:
  group: docker-builder-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write

env:
  REGISTRY_IMAGE: ghcr.io/streamplace/streamplace

jobs:
  builder:
    name: builder image
    runs-on: ubuntu-latest
    steps:
      - name: Maximize build space
        run:
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
          /opt/hostedtoolcache/CodeQL

      - name: Check out code
        uses: actions/checkout@v4.1.7
        with:
          fetch-depth: 0

      - uses: docker/setup-buildx-action@v3

      - name: Log in to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Compute tags
        id: tags
        run: |
          short=${GITHUB_SHA::7}
          hash=$(sed -n 's/^[[:space:]]*DOCKERFILE_HASH:[[:space:]]*//p' .ci/dockerfile-hash.yaml | head -1)
          echo "tags=${REGISTRY_IMAGE}:builder,${REGISTRY_IMAGE}:builder-${short},${REGISTRY_IMAGE}:builder-${hash}" >> "$GITHUB_OUTPUT"

      - name: Build and push builder
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/build.Dockerfile
          target: builder
          platforms: linux/amd64
          push: true
          tags: ${{ steps.tags.outputs.tags }}
          # The builder image is large; use a dedicated registry cache tag
          # (no 10GB cap, unlike the GitHub Actions cache).
          cache-from:
            type=registry,ref=${{ env.REGISTRY_IMAGE }}:builder-buildcache
          cache-to:
            type=registry,ref=${{ env.REGISTRY_IMAGE
            }}:builder-buildcache,mode=max