docker.yml

name: Build and push image

on:
  push:
    branches: [master]
    tags: ["*"]

env:
  IMAGE: macadmins/crypt-server
  TAG: ${{ github.ref_type == 'tag' && github.ref_name || 'latest' }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      # Load into the local daemon rather than pushing, so the migration check
      # below runs against the exact image that gets published.
      - uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64
          load: true
          push: false
          tags: ${{ env.IMAGE }}:${{ env.TAG }}
          cache-from: type=gha
          cache-to: type=gha

      # docker/run.sh applies migrations at container startup, so a migration
      # that imports cleanly but fails to apply would only break on deploy.
      # No DB_* env means settings fall back to sqlite, same as run.sh sees.
      - name: Check migrations apply
        run: |
          docker run --rm \
            -e FIELD_ENCRYPTION_KEY="$(python3 -c 'import base64, os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())')" \
            "$IMAGE:$TAG" \
            sh -c 'cd $APP_DIR && python3 manage.py migrate --noinput'

      - name: Push
        run: docker push "$IMAGE:$TAG"

      # crypt-server-saml builds FROM this image, so it has to run after the push.
      # Needs a PAT: GITHUB_TOKEN cannot dispatch to another repo.
      - name: Trigger crypt-server-saml build
        env:
          GH_TOKEN: ${{ secrets.SAML_DISPATCH_TOKEN }}
        run: |
          gh api repos/grahamgilbert/crypt-server-saml/dispatches \
            -f event_type=build \
            -f "client_payload[tag]=$TAG"