docker-publish.yml

name: Publish container releases

on:
  push:
    branches:
      - master
    # Runtime releases are installed by the server updater. Publish images only
    # when the maintained container version changes (or via a manual run).
    paths:
      - VERSION
  workflow_dispatch:
    inputs:
      mirror_only:
        description: Copy existing releases for VERSION to Docker Hub without rebuilding
        type: boolean
        default: false

concurrency:
  group: publish-tmodloader-images
  cancel-in-progress: false

jobs:
  publish:
    name: Publish ${{ matrix.channel }}
    if: ${{ !inputs.mirror_only }}
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    permissions:
      contents: write
      packages: write
    strategy:
      fail-fast: false
      matrix:
        channel: [stable, preview]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Resolve release metadata
        id: metadata
        env:
          CHANNEL: ${{ matrix.channel }}
        run: |
          container_version="$(tr -d '\r\n' < VERSION)"
          bash release-metadata.sh "$container_version" "$CHANNEL"
          echo "image=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/tmodloader" >> "$GITHUB_OUTPUT"

      # The candidate tests load both architectures by the same index digest.
      # Docker's classic image store cannot retain both platform variants.
      - name: Enable multi-platform Docker image store
        uses: docker/setup-docker-action@v5
        with:
          daemon-config: |
            {
              "features": {
                "containerd-snapshotter": true
              }
            }

      - name: Set up build emulation
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Protect exact release tags
        id: publication
        env:
          DOCKER_TAG: ${{ steps.metadata.outputs.docker_tag }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          IMAGE: ${{ steps.metadata.outputs.image }}
          RELEASE_TAG: ${{ steps.metadata.outputs.release_tag }}
        run: |
          set -euo pipefail
          image_exists=false
          release_exists=false

          if docker buildx imagetools inspect "$IMAGE:$DOCKER_TAG" >/dev/null 2>&1; then
            image_exists=true
          fi
          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            release_exists=true
          fi

          if [[ "$image_exists" == true && "$release_exists" == true ]]; then
            echo "Exact release $RELEASE_TAG already exists. Bump VERSION for container changes." >&2
            exit 1
          fi
          if [[ "$image_exists" != "$release_exists" ]]; then
            echo "Incomplete prior publication for $RELEASE_TAG; reconcile its image and GitHub Release before retrying." >&2
            exit 1
          fi

          echo "publish=true" >> "$GITHUB_OUTPUT"

      - name: Validate repository
        if: steps.publication.outputs.publish == 'true'
        run: |
          bash -n ./*.sh tests/*.sh
          shellcheck --severity=warning autosave.sh container-init.sh entrypoint.sh healthcheck.sh inject.sh log-filter.sh manage-mods.sh prepare-config.sh release-metadata.sh release-notes.sh run-server.sh steamcmd-wrapper.sh tests/*.sh
          bash tests/release-metadata-test.sh
          cp .env.example .env
          docker compose config --quiet

      - name: Build and publish untagged candidate
        id: build
        if: steps.publication.outputs.publish == 'true'
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          build-args: |
            TMOD_CHANNEL=${{ matrix.channel }}
          outputs: type=image,name=${{ steps.metadata.outputs.image }},push-by-digest=true,name-canonical=true,push=true
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ steps.metadata.outputs.release_tag }}
            org.opencontainers.image.title=tModLoader dedicated server
            io.github.crosis47.container.version=${{ steps.metadata.outputs.container_version }}
            io.github.crosis47.release.channel=${{ matrix.channel }}
          cache-from: type=gha,scope=${{ matrix.channel }}
          cache-to: type=gha,mode=max,scope=${{ matrix.channel }}
          provenance: mode=max
          sbom: true

      - name: Test candidate scripts
        if: steps.publication.outputs.publish == 'true'
        env:
          IMAGE: ${{ steps.metadata.outputs.image }}
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          for platform in linux/amd64 linux/arm64; do
            export DOCKER_DEFAULT_PLATFORM="$platform"
            docker run --rm --user tml:tml --entrypoint bash \
              --mount type=bind,source="$PWD",target=/repo,readonly \
              "$IMAGE@$DIGEST" /repo/tests/architecture-test.sh
            docker run --rm --user tml:tml --entrypoint bash \
              --mount type=bind,source="$PWD",target=/repo,readonly \
              "$IMAGE@$DIGEST" /repo/tests/workshop-download-test.sh
            docker run --rm --user tml:tml --entrypoint bash \
              --mount type=bind,source="$PWD",target=/repo,readonly \
              "$IMAGE@$DIGEST" \
              /repo/tests/manage-mods-test.sh /terraria-server/manage-mods.sh
            docker run --rm --user tml:tml --entrypoint bash \
              --mount type=bind,source="$PWD",target=/repo,readonly \
              "$IMAGE@$DIGEST" \
              /repo/tests/locale-test.sh /usr/bin/steamcmd
            docker run --rm --user tml:tml --entrypoint bash \
              --mount type=bind,source="$PWD",target=/repo,readonly \
              "$IMAGE@$DIGEST" \
              /repo/tests/config-test.sh /terraria-server/prepare-config.sh
            docker run --rm --user tml:tml --entrypoint bash \
              --mount type=bind,source="$PWD",target=/repo,readonly \
              "$IMAGE@$DIGEST" \
              /repo/tests/log-filter-test.sh /terraria-server/log-filter.sh /terraria-server/run-server.sh
            docker run --rm --user tml:tml --entrypoint bash \
              --mount type=bind,source="$PWD",target=/repo,readonly \
              "$IMAGE@$DIGEST" \
              /repo/tests/runtime-control-test.sh /usr/local/bin/inject
          done

      - name: Smoke-test candidate server
        if: steps.publication.outputs.publish == 'true'
        env:
          TMOD_GITHUB_TOKEN: ${{ github.token }}
          IMAGE: ${{ steps.metadata.outputs.image }}
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          for platform in linux/amd64 linux/arm64; do
            export DOCKER_DEFAULT_PLATFORM="$platform"
            bash tests/server-smoke-test.sh "$IMAGE@$DIGEST"
          done

      - name: Publish verified image tags
        if: steps.publication.outputs.publish == 'true'
        env:
          CHANNEL: ${{ matrix.channel }}
          DIGEST: ${{ steps.build.outputs.digest }}
          DOCKER_TAG: ${{ steps.metadata.outputs.docker_tag }}
          IMAGE: ${{ steps.metadata.outputs.image }}
        run: |
          tag_args=(
            --tag "$IMAGE:$DOCKER_TAG"
          )
          if [[ "$CHANNEL" == stable ]]; then
            tag_args+=(--tag "$IMAGE:latest")
          else
            tag_args+=(--tag "$IMAGE:preview")
          fi
          docker buildx imagetools create "${tag_args[@]}" "$IMAGE@$DIGEST"

      - name: Render GitHub Release notes
        if: steps.publication.outputs.publish == 'true'
        env:
          CHANNEL: ${{ matrix.channel }}
          CONTAINER_VERSION: ${{ steps.metadata.outputs.container_version }}
          DIGEST: ${{ steps.build.outputs.digest }}
          DOCKER_TAG: ${{ steps.metadata.outputs.docker_tag }}
          IMAGE: ${{ steps.metadata.outputs.image }}
        run: |
          bash release-notes.sh \
            "$CONTAINER_VERSION" \
            "$CHANNEL" \
            "$IMAGE" \
            "$DIGEST" \
            "$DOCKER_TAG" \
            true \
            > "$RUNNER_TEMP/release-notes.md"

      - name: Create GitHub Release
        if: steps.publication.outputs.publish == 'true'
        env:
          CHANNEL: ${{ matrix.channel }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ steps.metadata.outputs.release_tag }}
          RELEASE_TITLE: ${{ steps.metadata.outputs.release_title }}
        run: |
          release_args=(
            "$RELEASE_TAG"
            --repo "$GITHUB_REPOSITORY"
            --target "$GITHUB_SHA"
            --title "$RELEASE_TITLE"
            --notes-file "$RUNNER_TEMP/release-notes.md"
          )
          if [[ "$CHANNEL" == preview ]]; then
            release_args+=(--prerelease --latest=false)
          else
            release_args+=(--latest)
          fi
          gh release create "${release_args[@]}"

  dockerhub:
    name: Mirror verified releases to Docker Hub
    needs: publish
    if: >-
      ${{ !cancelled() && vars.DOCKERHUB_IMAGE != '' &&
          (needs.publish.result == 'success' ||
           (inputs.mirror_only && needs.publish.result == 'skipped')) }}
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: write
      packages: read
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-buildx-action@v4
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Copy and verify published releases
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKERHUB_IMAGE: ${{ vars.DOCKERHUB_IMAGE }}
        run: python3 .github/scripts/mirror-dockerhub.py

  overview:
    name: Sync Docker Hub README and release changes
    needs: dockerhub
    if: ${{ !cancelled() && needs.dockerhub.result == 'success' }}
    permissions:
      contents: read
    uses: ./.github/workflows/dockerhub-overview.yml
    secrets:
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}