docker.yml

name: Docker

on:
  push:
    branches:
      - main
  workflow_dispatch: {}

env:
  REGISTRY_IMAGE: ghcr.io/${{ github.repository_owner }}/node-reth-dev

permissions:
  contents: read

jobs:
  build-and-push:
    strategy:
      matrix:
        settings:
          - arch: linux/amd64
            runs-on: ubuntu-24.04
          - arch: linux/arm64
            runs-on: ubuntu-24.04-arm

    runs-on: ${{ matrix.settings.runs-on }}

    permissions:
      contents: read
      packages: write

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
        with:
          egress-policy: audit

      - name: Prepare
        run: |
          platform=${{ matrix.settings.arch }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 1

      - name: Prepare image labels
        id: image-labels
        run: |
          echo "source=https://github.com/${{ github.repository }}" >> $GITHUB_OUTPUT
          echo "revision=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_OUTPUT

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Login to GHCR
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        run: |
          docker buildx bake -f etc/docker/docker-bake.hcl client \
            --set client.tags=${{ env.REGISTRY_IMAGE }} \
            --set client.platform=${{ matrix.settings.arch }} \
            --set client.output=type=image,push-by-digest=true,name-canonical=true,push=true \
            --set client.cache-to=type=registry,ref=${{ env.REGISTRY_IMAGE }}:cache-${{ env.PLATFORM_PAIR }},mode=max \
            --set client.labels.org.opencontainers.image.source=${{ steps.image-labels.outputs.source }} \
            --set client.labels.org.opencontainers.image.revision=${{ steps.image-labels.outputs.revision }} \
            --set client.labels.org.opencontainers.image.created=${{ steps.image-labels.outputs.created }} \
            --metadata-file ${{ runner.temp }}/client-metadata.json

      - name: Export digest
        run: |
          mkdir -p ${{ runner.temp }}/digests
          digest="$(jq -er '."client"."containerimage.digest"' ${{ runner.temp }}/client-metadata.json)"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  warm-devnet-cache:
    strategy:
      matrix:
        target: [builder, consensus, batcher]

    runs-on: ubuntu-24.04

    permissions:
      contents: read
      packages: write

    env:
      PROFILE: dev

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
        with:
          egress-policy: audit

      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Login to GHCR
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Warm devnet image cache
        run: |
          docker buildx bake -f etc/docker/docker-bake.hcl ${{ matrix.target }} \
            --set ${{ matrix.target }}.platform=linux/amd64 \
            --set ${{ matrix.target }}.output=type=cacheonly \
            --set ${{ matrix.target }}.cache-to=type=registry,ref=${{ env.REGISTRY_IMAGE }}:cache-${{ matrix.target }}-linux-amd64,mode=max

  merge:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    needs:
      - build-and-push
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 1

      - name: Download digests
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Log into the Container registry
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Extract metadata for the Docker image
        id: meta
        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
        with:
          images: ${{ env.REGISTRY_IMAGE }}
          tags: |
            type=ref,event=branch
            type=sha,format=long

      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}