activity-core/.forgejo/workflows/image.yaml

name: Build and Publish Container Image

on:
  push:
    branches:
      - main
    paths:
      - ".forgejo/workflows/image.yaml"
      - "Dockerfile"
      - "src/**"
      - "migrations/**"
      - "scripts/**"
      - "activity-definitions/**"
      - "event-types/**"
      - "tasks/**"
      - "pyproject.toml"
      - "uv.lock"
      - "alembic.ini"
      - "tests/**"
      - "schemas/**"
      - "k8s/**"
      - ".dockerignore"
  workflow_dispatch:

env:
  REGISTRY: forgejo.coulomb.social
  IMAGE_NAME: coulomb/activity-core
  DOCKER_HOST: tcp://127.0.0.1:2375

jobs:
  build-and-push:
    runs-on: container-build
    steps:
      - name: Build and push image
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -eu
          REF="${GITHUB_SHA:?commit required}"
          test "${#REF}" -eq 40
          mkdir -p buildctx "${HOME}/bin"
          wget -qO /tmp/repo.tar.gz \
            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
          tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
            | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
          export PATH="${HOME}/bin:${PATH}"
          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
          IMAGE="${REGISTRY}/${IMAGE_NAME}"
          # Check the exact source archive before publishing. Never update latest.
          docker build --target test buildctx
          docker build --label "org.opencontainers.image.revision=${REF}" -t "${IMAGE}:git-${REF}" buildctx
          docker push "${IMAGE}:git-${REF}"
          docker inspect --format '{{index .RepoDigests 0}}' "${IMAGE}:git-${REF}" > image-digest.txt
          grep -Eq '^forgejo.coulomb.social/coulomb/activity-core@sha256:[a-f0-9]{64}$' image-digest.txt
          cat image-digest.txt
          # Deployment promotion is separate and consumes the digest, never the tag.