docker.yml

name: Docker

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - "Dockerfile*"
      - ".dockerignore"
      - "Makefile"
      - "src/**"
      - "Cargo.*"
      - ".github/workflows/docker.yml"

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: true

env:
  IMAGE_NAME: loadnetwork/load-reth

jobs:
  # PR smoke build (non-draft PRs). Build only; do not push.
  smoke:
    name: PR Smoke Build
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == false }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build (no push)
        run: make docker-build-local

  pr-release:
    name: PR Release Path
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == false }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc || true
          sudo apt-get clean || true
          docker system prune -af || true

      - name: Set up QEMU (multi-arch)
        uses: docker/setup-qemu-action@v3

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Install cross
        uses: taiki-e/install-action@v2
        with:
          tool: cross

      - name: Cache cargo/target
        uses: Swatinem/rust-cache@v2
        with:
          cache-targets: false

      - name: Exercise multi-arch release build (no push)
        run: make DOCKER_BUILDX_PUSH=false docker-build-push-latest

      - name: Upload multi-arch tarball
        uses: actions/upload-artifact@v4
        with:
          name: docker-multiarch-tar
          path: dist/load-reth-multiarch.tar

  # Pushes to main and tags — build & push multi-arch images
  push:
    name: Build & Push
    runs-on: ubuntu-latest
    if: ${{ github.event_name != 'pull_request' }}
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc || true
          sudo apt-get clean || true
          docker system prune -af || true

      - name: Set up QEMU (multi-arch)
        uses: docker/setup-qemu-action@v3

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      # Only filter on main. Tags should always build.
      - name: Detect docker-relevant changes
        id: changes
        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
        uses: dorny/paths-filter@v3
        with:
          filters: |
            docker:
              - "Dockerfile*"
              - ".dockerignore"
              - "Makefile"
              - "src/**"
              - "Cargo.*"
              - ".github/workflows/docker.yml"

      - name: Log in to Docker Hub
        if: ${{ startsWith(github.ref, 'refs/tags/') || steps.changes.outputs.docker == 'true' }}
        uses: docker/login-action@v3
        with:
          registry: docker.io
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Install cross
        if: ${{ startsWith(github.ref, 'refs/tags/') || steps.changes.outputs.docker == 'true' }}
        uses: taiki-e/install-action@v2
        with:
          tool: cross

      - name: Cache cargo/target
        if: ${{ startsWith(github.ref, 'refs/tags/') || steps.changes.outputs.docker == 'true' }}
        uses: Swatinem/rust-cache@v2
        with:
          cache-targets: false

      - name: Compute tags
        id: meta
        if: ${{ startsWith(github.ref, 'refs/tags/') || steps.changes.outputs.docker == 'true' }}
        shell: bash
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            tag="${GITHUB_REF#refs/tags/}"
            echo "git_tag=${tag}" >> "$GITHUB_OUTPUT"
            echo "print_tag=${tag},latest" >> "$GITHUB_OUTPUT"
          else
            short_sha="$(echo "${GITHUB_SHA}" | cut -c1-12)"
            echo "git_tag=sha-${short_sha}" >> "$GITHUB_OUTPUT"
            echo "print_tag=sha-${short_sha},latest" >> "$GITHUB_OUTPUT"
          fi

      - name: Build & push (multi-arch)
        if: ${{ startsWith(github.ref, 'refs/tags/') || steps.changes.outputs.docker == 'true' }}
        run: make docker-build-push-latest
        env:
          DOCKER_IMAGE_NAME: ${{ env.IMAGE_NAME }}
          GIT_TAG: ${{ github.ref_name }}

      - name: Skip (no docker changes on main)
        if: ${{ !startsWith(github.ref, 'refs/tags/') && steps.changes.outputs.docker != 'true' }}
        run: echo "No docker-relevant changes on main; skipping build."

      - name: Trivy scan
        if: ${{ (startsWith(github.ref, 'refs/tags/') || steps.changes.outputs.docker == 'true') && github.event.repository.private == false }}
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.IMAGE_NAME }}:latest
          format: sarif
          output: trivy-results.sarif

      - name: Upload scan
        if: ${{ (startsWith(github.ref, 'refs/tags/') || steps.changes.outputs.docker == 'true') && github.event.repository.private == false }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif