django-devcontainer/.github/workflows/docker.yml at main · alihaidar0/django-devcontainer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
# ============================================================
#  .github/workflows/docker.yml
#
#  Builds the Django dev container image and pushes to Docker Hub.
#  Cross-platform: linux/amd64 (Windows/Linux) + linux/arm64 (Apple Silicon)
#
#  Triggers:
#    - Push to main                   → builds + pushes :latest + :sha-xxx
#    - PR targeting main              → builds only (no push) — validates Dockerfile
#    - Manual dispatch                → optional push, optional force rebuild
#
#  Required GitHub Secrets:
#    DOCKERHUB_USERNAME   Docker Hub username
#    DOCKERHUB_TOKEN      Docker Hub access token (Read/Write)
#
#  Platforms:
#    linux/amd64  — Windows / Linux / GCP
#    linux/arm64  — Apple Silicon Macs
# ============================================================

name: Docker

on:
  push:
    branches:
      - main
    paths:
      - "docker/Dockerfile.dev"
      - "scripts/**"
      - ".github/workflows/docker.yml"

  pull_request:
    branches:
      - main
    paths:
      - "docker/Dockerfile.dev"
      - "scripts/**"
      - ".github/workflows/docker.yml"

  workflow_dispatch:
    inputs:
      push_image:
        description: "Push image to Docker Hub?"
        required: true
        default: "true"
        type: choice
        options:
          - "true"
          - "false"
      force_rebuild:
        description: "Bypass layer cache (full rebuild)"
        required: false
        type: boolean
        default: false

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: false

env:
  IMAGE_NAME: alihaidar199527/django-devcontainer

jobs:

  build-and-push:
    name: Build & Push Dev Image
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:

      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to Docker Hub
        # Skip login on PR builds — we are not pushing, no credentials needed
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
            type=sha,prefix=sha-,format=short

      - name: Build and push
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/Dockerfile.dev
          platforms: linux/amd64,linux/arm64
          # Push only on a real push to main or an approved manual dispatch
          # PR builds compile the image to validate it but never push
          push: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push_image == 'true') }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          no-cache: ${{ inputs.force_rebuild == true }}
          provenance: true
          sbom: true

      - name: Write job summary
        if: always()
        run: |
          echo "## 🐳 Docker Build Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| **Image** | \`${{ env.IMAGE_NAME }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Digest** | \`${{ steps.build.outputs.digest }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Tags** | \`${{ steps.meta.outputs.tags }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Platforms** | \`linux/amd64, linux/arm64\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Triggered by** | \`${{ github.event_name }}\` on \`${{ github.ref_name }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Commit** | \`${{ github.sha }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **Pushed to Docker Hub** | \`${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push_image == 'true') }}\` |" >> $GITHUB_STEP_SUMMARY