obsidian-livesync/.github/workflows/cli-docker.yml

# Build and push the CLI Docker image to GitHub Container Registry (GHCR).
# Image tag format: <manifest-version>-cli
# Example: 1.0.36-cli
#
# Stable releases are also tagged with their major-minor version and 'latest'.
# Pre-releases receive immutable version and SHA-qualified tags only.
# Image name: ghcr.io/<owner>/livesync-cli
name: Build and Push CLI Docker Image

on:
    push:
        branches:
            - main
        tags:
            - "*.*.*-cli"
        paths:
            - ".github/workflows/cli-docker.yml"
            - ".github/workflows/cli-docker-validation.yml"
            - "src/apps/cli/**"
            - "!src/apps/cli/**/*.md"
            - "src/LiveSyncBaseCore.ts"
            - "src/common/**"
            - "src/serviceFeatures/**"
            - "src/serviceModules/**"
            - "src/integrations/**"
            - "src/modules/AbstractModule.ts"
            - "src/modules/main/**"
            - "src/modules/coreFeatures/**"
            - "manifest.json"
            - "tsconfig.json"
            - "package.json"
            - "package-lock.json"
            - ".dockerignore"
    workflow_dispatch:
        inputs:
            dry_run:
                description: Build only (do not push image to GHCR)
                required: false
                type: boolean
                default: true
            force:
                description: Continue to build/push even if CLI E2E fails (workflow_dispatch only)
                required: false
                type: boolean
                default: false

concurrency:
    group: cli-docker-publish-${{ github.ref }}
    cancel-in-progress: false

jobs:
    validate:
        uses: ./.github/workflows/cli-docker-validation.yml
        with:
            force: ${{ github.event_name == 'workflow_dispatch' && inputs.force || false }}
        permissions:
            contents: read

    build-and-push:
        needs: validate
        if: ${{ needs.validate.outputs.e2e_passed == 'true' || (github.event_name == 'workflow_dispatch' && inputs.force) }}
        runs-on: ubuntu-latest
        timeout-minutes: 90
        permissions:
            contents: read
            packages: write

        steps:
            - name: Checkout
              uses: actions/checkout@v5

            - name: Derive image tag
              id: meta
              run: |
                  VERSION=$(jq -r '.version' manifest.json)
                  MAJOR_MINOR=$(echo "${VERSION}" | cut -d. -f1,2)
                  SHORT_SHA=$(git rev-parse --short HEAD)
                  IMAGE="ghcr.io/${{ github.repository_owner }}/livesync-cli"

                  # Build tag list based on the event and git ref
                  TAGS=""
                  if [[ "${{ github.ref }}" == refs/tags/* ]]; then
                      if [[ "${VERSION}" == *-* ]]; then
                          # Pre-release builds must not advance stable moving tags.
                          TAGS="${IMAGE}:${VERSION}-cli,${IMAGE}:${VERSION}-sha-${SHORT_SHA}-cli"
                      else
                          # Stable release builds
                          TAGS="${IMAGE}:${VERSION}-cli,${IMAGE}:${MAJOR_MINOR}-cli,${IMAGE}:latest,${IMAGE}:${VERSION}-sha-${SHORT_SHA}-cli"
                      fi
                  elif [[ "${{ github.ref }}" == refs/heads/main ]]; then
                      # Bleeding-edge / nightly builds
                      TAGS="${IMAGE}:edge"
                  else
                      # Other branches / manual run fallback
                      TAGS="${IMAGE}:${VERSION}-dev-sha-${SHORT_SHA}-cli"
                  fi

                  # Determine if the image should be pushed
                  PUSH="true"
                  if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
                      if [[ "${{ inputs.dry_run }}" == "true" ]]; then
                          PUSH="false"
                      fi
                  fi

                  echo "tags=${TAGS}" >> $GITHUB_OUTPUT
                  echo "push=${PUSH}" >> $GITHUB_OUTPUT

            - name: Log in to GitHub Container Registry
              uses: docker/login-action@v4
              with:
                  registry: ghcr.io
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Set up QEMU
              uses: docker/setup-qemu-action@v4
              with:
                  platforms: arm64

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v4

            - name: Build and push
              uses: docker/build-push-action@v7
              with:
                  context: .
                  file: src/apps/cli/Dockerfile
                  push: ${{ steps.meta.outputs.push }}
                  tags: ${{ steps.meta.outputs.tags }}
                  platforms: linux/amd64,linux/arm64
                  cache-from: type=gha,scope=cli-image
                  cache-to: type=gha,scope=cli-image,mode=max