ci-cd.yml

name: CI/CD

on:
  push:
    branches: [master]
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * 0"

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  # Never interrupt a release between publishing base and derived images.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Verify generated images match templates
        run: |
          docker run --rm --user "$(id -u):$(id -g)" -v "$PWD:/app" fireworkweb/fwd:v1.0 fwd template
          git diff --exit-code

  build-test:
    needs: checks
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        version: ["8.2", "8.3", "8.4", "8.5"]
        distro: ["", "-debian"]
        type: ["", "-prod"]
        exclude:
          - {version: "8.2", distro: "-debian"}
          - {version: "8.3", distro: "-debian"}
    env:
      BASE: ${{ matrix.version }}${{ matrix.distro }}${{ matrix.type }}
      NGINX: ${{ matrix.version }}${{ matrix.distro }}-nginx${{ matrix.type }}
      NODE: ${{ matrix.version }}-node
    steps:
      - uses: actions/checkout@v7

      # The docker driver lets derived images use the base built in this job.
      # Tests are native amd64; QEMU is only needed for multi-arch publishing.
      - uses: docker/setup-buildx-action@v4
        with:
          driver: docker

      - name: Build base image
        uses: docker/build-push-action@v7
        with:
          context: ${{ env.BASE }}
          load: true
          tags: kooldev/php:${{ env.BASE }}

      - name: Test base image
        run: bash scripts/test-image.sh "$BASE"

      - name: Build nginx image
        uses: docker/build-push-action@v7
        with:
          context: ${{ env.NGINX }}
          load: true
          tags: kooldev/php:${{ env.NGINX }}

      - name: Test nginx image
        run: bash scripts/test-image.sh "$NGINX"

      - name: Build node image
        if: matrix.distro == '' && matrix.type == ''
        uses: docker/build-push-action@v7
        with:
          context: ${{ env.NODE }}
          load: true
          tags: kooldev/php:${{ env.NODE }}

      - name: Test node image
        if: matrix.distro == '' && matrix.type == ''
        run: bash scripts/test-image.sh "$NODE"

  # Multi-arch builds use the isolated docker-container driver. Publish all
  # base images first so nginx/node builds can pull them from Docker Hub.
  push-base:
    needs: build-test
    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master' && github.repository == 'kool-dev/docker-php'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        version: ["8.2", "8.3", "8.4", "8.5"]
        distro: ["", "-debian"]
        type: ["", "-prod"]
        exclude:
          - {version: "8.2", distro: "-debian"}
          - {version: "8.3", distro: "-debian"}
    env:
      TAG: ${{ matrix.version }}${{ matrix.distro }}${{ matrix.type }}
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-qemu-action@v4
        with:
          platforms: arm64
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Publish base image
        uses: docker/build-push-action@v7
        with:
          context: ${{ env.TAG }}
          push: true
          platforms: linux/amd64,linux/arm64
          tags: kooldev/php:${{ env.TAG }}

  push-nginx:
    needs: push-base
    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master' && github.repository == 'kool-dev/docker-php'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        version: ["8.2", "8.3", "8.4", "8.5"]
        distro: ["", "-debian"]
        type: ["", "-prod"]
        exclude:
          - {version: "8.2", distro: "-debian"}
          - {version: "8.3", distro: "-debian"}
    env:
      TAG: ${{ matrix.version }}${{ matrix.distro }}-nginx${{ matrix.type }}
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-qemu-action@v4
        with:
          platforms: arm64
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Publish nginx image
        uses: docker/build-push-action@v7
        with:
          context: ${{ env.TAG }}
          push: true
          platforms: linux/amd64,linux/arm64
          tags: kooldev/php:${{ env.TAG }}

  push-node:
    needs: push-base
    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master' && github.repository == 'kool-dev/docker-php'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        version: ["8.2", "8.3", "8.4", "8.5"]
    env:
      TAG: ${{ matrix.version }}-node
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-qemu-action@v4
        with:
          platforms: arm64
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Publish node image
        uses: docker/build-push-action@v7
        with:
          context: ${{ env.TAG }}
          push: true
          platforms: linux/amd64,linux/arm64
          tags: kooldev/php:${{ env.TAG }}

  trigger-downstream:
    needs: [push-nginx, push-node]
    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master' && github.repository == 'kool-dev/docker-php'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        repo:
          - kool-dev/docker-wordpress
          - kool-dev/docker-php-sqlsrv
          - kool-dev/docker-php-swoole
          - kool-dev/docker-phpqa
    steps:
      - name: Check downstream credentials
        id: credentials
        env:
          DISPATCH_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
        run: |
          if [ -n "$DISPATCH_TOKEN" ]; then
            echo "available=true" >> "$GITHUB_OUTPUT"
          else
            echo "::warning::Downstream builds skipped: configure DISPATCH_TOKEN with access to the downstream repositories."
          fi
      - name: Trigger ${{ matrix.repo }}
        if: steps.credentials.outputs.available == 'true'
        uses: peter-evans/repository-dispatch@v4
        with:
          token: ${{ secrets.DISPATCH_TOKEN }}
          repository: ${{ matrix.repo }}
          event-type: docker-php-updated