ironclaw/.github/workflows/docker.yml

name: Docker Image

on:
  # Called by release.yml or other workflows
  workflow_call:
    inputs:
      tag:
        description: "Image tag override (leave empty for auto-detect)"
        required: false
        type: string
        default: ""
  # On-demand builds
  workflow_dispatch:
    inputs:
      tag:
        description: "Image tag override (leave empty for auto-detect)"
        required: false
        type: string
        default: ""
  # Daily staging build from the staging branch
  schedule:
    - cron: '0 6 * * *'

env:
  IMAGE_NAME: nearaidev/ironclaw
  WORKER_IMAGE_NAME: nearaidev/ironclaw-worker

jobs:
  build:
    name: Build & Push
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: read
      actions: write
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ github.event_name == 'schedule' && 'staging' || '' }}
          persist-credentials: false

      - name: Extract version from Cargo.toml
        id: version
        run: |
          VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "Detected version: ${VERSION}"

      - name: Determine tags
        id: tags
        env:
          VERSION: ${{ steps.version.outputs.version }}
          EVENT_NAME: ${{ github.event_name }}
          INPUT_TAG: ${{ inputs.tag }}
        run: |
          SHA="sha-${GITHUB_SHA::7}"
          echo "sha_tag=${SHA}" >> "$GITHUB_OUTPUT"

          if [[ "${EVENT_NAME}" == "workflow_call" ]]; then
            # Release: :version + :latest + :sha-xxx
            TAGS="${IMAGE_NAME}:${VERSION}"
            TAGS="${TAGS},${IMAGE_NAME}:latest"
            TAGS="${TAGS},${IMAGE_NAME}:${SHA}"
            WORKER_TAGS="${WORKER_IMAGE_NAME}:${VERSION}"
            WORKER_TAGS="${WORKER_TAGS},${WORKER_IMAGE_NAME}:latest"
            WORKER_TAGS="${WORKER_TAGS},${WORKER_IMAGE_NAME}:${SHA}"
          elif [[ "${EVENT_NAME}" == "schedule" ]]; then
            # Daily staging: :staging + :sha-xxx
            TAGS="${IMAGE_NAME}:staging"
            TAGS="${TAGS},${IMAGE_NAME}:${SHA}"
            WORKER_TAGS="${WORKER_IMAGE_NAME}:staging"
            WORKER_TAGS="${WORKER_TAGS},${WORKER_IMAGE_NAME}:${SHA}"
          else
            # Manual dispatch: :sha-xxx only
            TAGS="${IMAGE_NAME}:${SHA}"
            WORKER_TAGS="${WORKER_IMAGE_NAME}:${SHA}"
          fi

          # Manual override adds an extra tag (e.g. "staging")
          if [[ -n "${INPUT_TAG}" ]]; then
            TAGS="${TAGS},${IMAGE_NAME}:${INPUT_TAG}"
            WORKER_TAGS="${WORKER_TAGS},${WORKER_IMAGE_NAME}:${INPUT_TAG}"
          fi
          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
          echo "worker_tags=${WORKER_TAGS}" >> "$GITHUB_OUTPUT"

          # Staging builds get pre-bundled WASM extensions
          if [[ "${EVENT_NAME}" == "schedule" || "${INPUT_TAG}" == "staging" ]]; then
            echo "target=runtime-staging" >> "$GITHUB_OUTPUT"
          else
            echo "target=runtime" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Log in to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          username: ${{ vars.DOCKER_REGISTRY_USER }}
          password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}

      - name: Build and push (ironclaw)
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          push: true
          tags: ${{ steps.tags.outputs.tags }}
          target: ${{ steps.tags.outputs.target }}
          platforms: linux/amd64
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build and push (ironclaw-worker)
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          file: Dockerfile.worker
          push: true
          tags: ${{ steps.tags.outputs.worker_tags }}
          platforms: linux/amd64
          cache-from: type=gha,scope=worker
          cache-to: type=gha,mode=max,scope=worker

      - name: Create releases-manager app token
        id: app-token
        continue-on-error: true
        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
        with:
          app-id: ${{ secrets.GH_RELEASES_MANAGER_APP_ID }}
          private-key: ${{ secrets.GH_RELEASES_MANAGER_APP_PRIVATE_KEY }}
          owner: nearai
          repositories: ironclaw-dind

      - name: Trigger ironclaw-dind Build & Push
        if: steps.app-token.outcome == 'success'
        continue-on-error: true
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          EVENT_NAME: ${{ github.event_name }}
          INPUT_TAG: ${{ inputs.tag }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          if [[ "${EVENT_NAME}" == "workflow_call" && -n "${VERSION}" ]]; then
            gh api repos/nearai/ironclaw-dind/dispatches \
              --method POST \
              -f event_type="ironclaw_image_published" \
              -f client_payload[version]="${VERSION}"
          elif [[ "${EVENT_NAME}" == "schedule" ]] || [[ "${INPUT_TAG}" == "staging" ]]; then
            gh api repos/nearai/ironclaw-dind/dispatches \
              --method POST \
              -f event_type="ironclaw_image_published"
          fi

      - name: Summary
        run: |
          {
            echo "## Docker Images"
            echo ""
            echo "**ironclaw:**"
            echo '```'
            echo "${{ steps.tags.outputs.tags }}" | tr ',' '\n'
            echo '```'
            echo ""
            echo "**ironclaw-worker:**"
            echo '```'
            echo "${{ steps.tags.outputs.worker_tags }}" | tr ',' '\n'
            echo '```'
            echo ""
            echo "- version: \`${{ steps.version.outputs.version }}\`"
            echo "- sha: \`${GITHUB_SHA::7}\`"
          } >> "$GITHUB_STEP_SUMMARY"