DocsGPT/.github/workflows/ci.yml

name: Build and push DocsGPT Docker image

# Runs for a release created by hand (the release event), or called by the
# backend-release workflow with the version it just tagged: GitHub never starts
# workflows from events GITHUB_TOKEN produces, so a bot-created release does not
# fire the release trigger on its own.

on:
  release:
    types: [published]
  workflow_call:
    inputs:
      version:
        description: Release tag to build and push (the images are tagged with it)
        type: string
        required: true
    secrets:
      DOCKER_USERNAME:
        required: true
      DOCKER_PASSWORD:
        required: true

permissions:
  contents: read

env:
  # The tag being published: passed in by the caller, or the release's own.
  RELEASE_TAG: ${{ inputs.version || github.event.release.tag_name }}

jobs:
  build:
    if: github.repository == 'arc53/DocsGPT'
    # Publishing jobs run in a GitHub Actions environment so the registry
    # credentials can be scoped to it and protection rules (required reviewers,
    # branch restrictions) applied in the repository settings.
    environment: docker-hub
    env:
      # Public namespace the compose files pull from; the login secret only
      # authenticates the push.
      DOCKERHUB_NAMESPACE: arc53
    strategy:
      matrix:
        platform: [linux/amd64, linux/arm64]
        # "" is the slim default image; "-docling" bakes the docling parser
        # engine, its models and tesseract in (OCR-ready).
        variant: ["", "-docling"]
    runs-on: ${{ matrix.platform == 'linux/arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          driver: docker-container
          install: true

      - name: Login to DockerHub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Login to ghcr.io
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Image metadata (OCI labels)
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: |
            ${{ env.DOCKERHUB_NAMESPACE }}/docsgpt
            ghcr.io/${{ github.repository_owner }}/docsgpt
          labels: |
            org.opencontainers.image.title=DocsGPT${{ matrix.variant }}
            org.opencontainers.image.version=${{ env.RELEASE_TAG }}

      - name: Build and push platform-specific images
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          file: './docsgpt/Dockerfile'
          platforms: ${{ matrix.platform }}
          context: .
          push: true
          build-args: |
            EXTRAS=${{ matrix.variant == '-docling' && 'docling' || '' }}
            INSTALL_TESSERACT=${{ matrix.variant == '-docling' && 'true' || 'false' }}
          tags: |
            ${{ env.DOCKERHUB_NAMESPACE }}/docsgpt:${{ env.RELEASE_TAG }}${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
            ghcr.io/${{ github.repository_owner }}/docsgpt:${{ env.RELEASE_TAG }}${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: false
          sbom: false
          cache-from: type=registry,ref=${{ env.DOCKERHUB_NAMESPACE }}/docsgpt:latest${{ matrix.variant }}
          cache-to: type=inline

  manifest:
    if: github.repository == 'arc53/DocsGPT'
    # Publishing jobs run in a GitHub Actions environment so the registry
    # credentials can be scoped to it and protection rules (required reviewers,
    # branch restrictions) applied in the repository settings.
    environment: docker-hub
    env:
      # Public namespace the compose files pull from; the login secret only
      # authenticates the push.
      DOCKERHUB_NAMESPACE: arc53
    needs: build
    strategy:
      matrix:
        variant: ["", "-docling"]
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          driver: docker-container
          install: true

      - name: Login to DockerHub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Login to ghcr.io
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create and push multi-arch manifests
        env:
          TAG: ${{ env.RELEASE_TAG }}${{ matrix.variant }}
          LATEST: latest${{ matrix.variant }}
        run: |
          set -e
          for repo in "$DOCKERHUB_NAMESPACE/docsgpt" "ghcr.io/${{ github.repository_owner }}/docsgpt"; do
            for name in "$TAG" "$LATEST"; do
              docker manifest create "$repo:$name" \
                --amend "$repo:$TAG-amd64" \
                --amend "$repo:$TAG-arm64"
              docker manifest push "$repo:$name"
            done
          done

  release-assets:
    if: github.repository == 'arc53/DocsGPT'
    needs: manifest
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false

      - name: Attach the standalone compose file to the release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ env.RELEASE_TAG }}
        run: |
          gh release upload "$TAG" deployment/docker-compose-standalone.yaml --clobber