---
name: Publish CI Images to GHCR
# Based on
# <https://docs.github.com/en/actions/tutorials/publish-packages/publish-docker-images#publishing-images-to-github-packages>

on:
  push:
    branches: [master]
    paths:
      - ci/Dockerfile.ci-*
      - .github/workflows/publish-ghcr.yml

jobs:
  build-and-push:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        include:
          - variant: focal
            dockerfile: ci/Dockerfile.ci-focal
          - variant: trusty
            dockerfile: ci/Dockerfile.ci-trusty

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Log in to GHCR
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata (tags, labels)
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051
        with:
          images: ghcr.io/${{ github.repository_owner }}/ci-${{ matrix.variant }}
          tags: |
            type=raw,value=latest
            type=sha

      - name: Build and push
        id: push
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
        with:
          context: .
          file: ./${{ matrix.dockerfile }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
