---
name: CI for docker images

# Only run when docker paths change

on:
  push:
    branches: [dev, beta, release]
    paths:
      - "docker/**"
      - ".github/workflows/ci-docker.yml"
      - "requirements*.txt"
      - "platformio.ini"
      - "script/platformio_install_deps.py"

  pull_request:
    paths:
      - "docker/**"
      - ".github/workflows/ci-docker.yml"
      - "requirements*.txt"
      - "platformio.ini"
      - "script/platformio_install_deps.py"

permissions:
  contents: read  # actions/checkout only

concurrency:
  # yamllint disable-line rule:line-length
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  check-docker:
    name: Build docker containers
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read   # actions/checkout to load Dockerfile and build context
      packages: write  # push branch-tagged images to ghcr.io for local testing
    strategy:
      fail-fast: false
      matrix:
        os: ["ubuntu-24.04", "ubuntu-24.04-arm"]
        build_type:
          - "ha-addon"
          - "docker"
          # - "lint"
    outputs:
      tag: ${{ steps.tag.outputs.tag }}
      push: ${{ steps.tag.outputs.push }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Determine tag and whether to push
        id: tag
        run: |
          # Sanitize the branch name into a valid docker tag: replace invalid
          # characters, ensure the first character is valid (tags must start
          # with [A-Za-z0-9_]), and cap the length at 128 characters.
          branch="${{ github.head_ref || github.ref_name }}"
          tag="${branch//[^a-zA-Z0-9_.-]/-}"
          case "$tag" in
            [a-zA-Z0-9_]*) ;;
            *) tag="pr-${tag}" ;;
          esac
          tag="${tag:0:128}"
          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
          # Only push branch images for same-repo pull requests. Push events
          # only fire for dev/beta/release, whose images are owned by the
          # release pipeline -- never overwrite those from here.
          if [ "${{ github.event_name }}" = "pull_request" ] \
            && [ "${{ github.repository }}" = "esphome/esphome" ] \
            && [ "${{ github.event.pull_request.head.repo.full_name }}" = "esphome/esphome" ]; then
            echo "push=true" >> "$GITHUB_OUTPUT"
          else
            echo "push=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Log in to the GitHub container registry
        if: steps.tag.outputs.push == 'true'
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run build
        run: |
          docker/build.py \
            --tag "${{ steps.tag.outputs.tag }}" \
            --arch "${{ matrix.os == 'ubuntu-24.04-arm' && 'aarch64' || 'amd64' }}" \
            --build-type "${{ matrix.build_type }}" \
            --registry ghcr \
            build ${{ steps.tag.outputs.push == 'true' && '--push --no-cache-to' || '' }}

  manifest:
    name: Push ${{ matrix.build_type }} manifest to ghcr.io
    needs: [check-docker]
    if: needs.check-docker.outputs.push == 'true'
    runs-on: ubuntu-24.04
    permissions:
      contents: read   # actions/checkout to run docker/build.py
      packages: write  # buildx imagetools writes the multi-arch tag to ghcr.io
    strategy:
      fail-fast: false
      matrix:
        build_type:
          - "ha-addon"
          - "docker"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log in to the GitHub container registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create and push manifest
        run: |
          docker/build.py \
            --tag "${{ needs.check-docker.outputs.tag }}" \
            --build-type "${{ matrix.build_type }}" \
            --registry ghcr \
            manifest