name: Build Docker images (Docker Hub)

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

env:
  REGISTRY: docker.io
  IMAGE_NAME: 3proxy/3proxy

jobs:
  build:
    name: Build and push Docker images
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Determine tags
        id: tags
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          if [[ "$RELEASE_TAG" != "" ]]; then
            RELEASE="${RELEASE_TAG#v}"
            echo "minimal=${REGISTRY}/${IMAGE_NAME}:${RELEASE}.minimal,${REGISTRY}/${IMAGE_NAME}:minimal" >> "$GITHUB_OUTPUT"
            echo "busybox=${REGISTRY}/${IMAGE_NAME}:${RELEASE}.busybox,${REGISTRY}/${IMAGE_NAME}:busybox" >> "$GITHUB_OUTPUT"
            echo "full=${REGISTRY}/${IMAGE_NAME}:${RELEASE},${REGISTRY}/${IMAGE_NAME}:latest" >> "$GITHUB_OUTPUT"
          else
            DATETIME=$(date +%d%m%y%H%M%S)
            BRANCH=$(echo "${GITHUB_REF#refs/heads/}" | tr "/" "-")
            echo "minimal=${REGISTRY}/${IMAGE_NAME}:${DATETIME}-${BRANCH}.minimal,${REGISTRY}/${IMAGE_NAME}:${BRANCH}.minimal" >> "$GITHUB_OUTPUT"
            echo "busybox=${REGISTRY}/${IMAGE_NAME}:${DATETIME}-${BRANCH}.busybox,${REGISTRY}/${IMAGE_NAME}:${BRANCH}.busybox" >> "$GITHUB_OUTPUT"
            echo "full=${REGISTRY}/${IMAGE_NAME}:${DATETIME}-${BRANCH},${REGISTRY}/${IMAGE_NAME}:${BRANCH}" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Login to Docker Hub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push minimal
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.minimal
          platforms: linux/amd64,linux/arm64,linux/arm/v7,ppc64le
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.tags.outputs.minimal }}

      - name: Build and push busybox
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.busybox
          platforms: linux/amd64,linux/arm64,linux/arm/v7,ppc64le
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.tags.outputs.busybox }}

      - name: Build and push full
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.full
          platforms: linux/amd64,linux/arm64,linux/arm/v7,ppc64le
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.tags.outputs.full }}

      - name: Sign images
        if: github.event_name != 'pull_request'
        env:
          TAGS_MINIMAL: ${{ steps.tags.outputs.minimal }}
          TAGS_BUSYBOX: ${{ steps.tags.outputs.busybox }}
          TAGS_FULL: ${{ steps.tags.outputs.full }}
        run: |
          IFS=',' read -ra TAGS <<< "$TAGS_MINIMAL,$TAGS_BUSYBOX,$TAGS_FULL"
          for tag in "${TAGS[@]}"; do
            cosign sign --yes "$tag"
          done
