client-agent-image.yml

name: client-agent-image

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

concurrency:
  group: client-agent-image-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - uses: docker/setup-buildx-action@v3

      - name: Set immutable image tags
        id: tags
        shell: bash
        run: |
          tags="yyyyyt123/netopsbench-client:sha-${GITHUB_SHA}"
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            tags="${tags}"$'\n'"yyyyyt123/netopsbench-client:${GITHUB_REF_NAME}"$'\n'"yyyyyt123/netopsbench-client:latest"
          fi
          {
            echo "value<<EOF"
            echo "${tags}"
            echo "EOF"
          } >> "${GITHUB_OUTPUT}"

      - name: Build and publish linux/amd64 image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: containers/client/Dockerfile
          platforms: linux/amd64
          push: true
          provenance: false
          tags: ${{ steps.tags.outputs.value }}
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}

      - name: Publish manifest digest
        run: echo "digest=${{ steps.build.outputs.digest }}" >> "${GITHUB_STEP_SUMMARY}"

      - name: Verify anonymous digest pull
        env:
          IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          docker logout
          for attempt in $(seq 1 12); do
            if docker manifest inspect "yyyyyt123/netopsbench-client@${IMAGE_DIGEST}" >/dev/null; then
              exit 0
            fi
            sleep 5
          done
          exit 1