deploy_image.yml

# https://docs.github.com/zh/actions/use-cases-and-examples/publishing-packages/publishing-docker-images
name: deploy image

on:
  push:
    branches: [ "" ]
    tags:
      - v*
  pull_request:
  workflow_dispatch:
    inputs:
      debug_enabled:
        description: "用于手动触发测试"
        required: true
        default: true

jobs:
  push:
    name: Push Docker image to multiple registries
    if: ${{ github.repository == 'chaunsin/netease-cloud-music' }}
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
      attestations: write
      id-token: write
    steps:
      - name: Set Environment Variable
        run: |
          echo "BUILD_TIME=$(date --rfc-3339=seconds --utc)" >> $GITHUB_ENV
          echo "VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')" >> $GITHUB_ENV
          echo "COMMIT_HASH=$(echo "${{ github.sha }}" | cut -c 1-7)" >> $GITHUB_ENV
          echo "IMAGE_NAME=${{ github.repository_owner }}/ncmctl" >> $GITHUB_ENV

      - name: Check out the repo
        uses: actions/checkout@v4

      # https://github.com/docker/login-action
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # https://github.com/docker/metadata-action
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.IMAGE_NAME}}
            ghcr.io/${{ env.IMAGE_NAME}}
          tags: |
            type=semver,pattern={{version}}
            #type=ref,event=tag,value=latest
            # set latest tag for default branch
            type=raw,value=latest,enable={{is_default_branch}}
            #type=ref,event=branch

      # https://github.com/docker/build-push-action
      - name: Build and push Docker images
        id: bp
        #if: startsWith(github.ref, 'refs/tags/v')
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            BUILD_TIME=${{ env.BUILD_TIME }}
            VERSION=${{ env.VERSION }}
            COMMIT_HASH=${{ env.COMMIT_HASH}}
            GOPROXY=https://proxy.golang.org

      #      - name: Debug Build and push Docker images
      #        id: bp
      #        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled == 'true' }}
      #        uses: docker/build-push-action@v6
      #        with:
      #          context: .
      #          push: true
      #          tags: ${{ steps.meta.outputs.tags }}
      #          labels: ${{ steps.meta.outputs.labels }}
      #          build-args: |
      #            BUILD_TIME=${{ env.BUILD_TIME }}
      #            VERSION=${{ env.VERSION }}
      #            COMMIT_HASH=${{ env.COMMIT_HASH}}
      #            GOPROXY=https://proxy.golang.org

      # https://github.com/actions/attest-build-provenance
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v1
        with:
          subject-name: ghcr.io/${{ env.IMAGE_NAME}}
          subject-digest: ${{ steps.bp.outputs.digest }}
          push-to-registry: true