build-images.yml

name: Docker Build and Push

on:
  push:
    tags:
      - 'v*.*.*'       # 例如 v1.0.0, v2.1.3
      - 'v*.*.*-*'     # 例如 v1.0.0-beta.1
    branches:
      - main
  workflow_dispatch:

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - project: kong
            context: .
            dockerfile: ./compose/production/kong/Dockerfile
            architectures: linux/amd64  # 仅构建 amd64
            path: ./compose/production/kong/
          - project: postgres
            context: .
            dockerfile: ./compose/production/postgres/Dockerfile
            architectures: linux/amd64,linux/arm64
            path: ./compose/production/postgres/
          - project: ubuntu
            context: .
            dockerfile: ./compose/production/ubuntu/Dockerfile
            architectures: linux/amd64,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x
            path: ./compose/production/ubuntu/
          - project: traefik
            context: .
            dockerfile: ./compose/production/traefik/Dockerfile
            architectures: linux/amd64,linux/arm64
            path: ./compose/production/traefik/
          - project: nginx
            context: .
            dockerfile: ./compose/production/nginx/Dockerfile
            architectures: linux/amd64,linux/arm64
            path: ./compose/production/nginx/
          - project: awscli
            context: .
            dockerfile: ./compose/production/aws/Dockerfile
            architectures: linux/amd64,linux/arm64
            path: ./compose/production/aws/
          - project: redis
            context: .
            dockerfile: ./compose/production/redis/Dockerfile
            architectures: linux/amd64,linux/arm64
            path: ./compose/production/redis/
          - project: redis8
            context: .
            dockerfile: ./compose/production/redis8/Dockerfile
            architectures: linux/amd64,linux/arm64
            path: ./compose/production/redis8/
          - project: python
            context: .
            dockerfile: ./compose/production/python/Dockerfile
            architectures: linux/amd64,linux/arm64
            path: ./compose/production/python/
          - project: python-3-12-slim-bookworm
            context: .
            dockerfile: ./compose/production/python-3-12-slim-bookworm/Dockerfile
            architectures: linux/amd64,linux/arm64
            path: ./compose/production/python-3-12-slim-bookworm/

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # 确保获取所有标签

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Check if relevant files changed or if it is a tag push
        id: changes
        run: |
          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
            echo "changed=true" >> $GITHUB_OUTPUT
          elif git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q "^${{ matrix.path }}"; then
            echo "changed=true" >> $GITHUB_OUTPUT
          else
            echo "changed=false" >> $GITHUB_OUTPUT
          fi

      - name: Skip if no changes
        if: steps.changes.outputs.changed == 'false'
        run: echo "No changes in ${{ matrix.path }}. Skipping build."

      - name: Log in to Docker Hub
        if: steps.changes.outputs.changed == 'true'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Log in to AliYun Docker Registry
        if: steps.changes.outputs.changed == 'true'
        uses: docker/login-action@v3
        with:
          registry: registry.cn-hangzhou.aliyuncs.com
          username: ${{ secrets.ALIREGISTRY_USERNAME }}
          password: ${{ secrets.ALIREGISTRY_TOKEN }}

      - name: Log in to GitHub Container Registry
        if: steps.changes.outputs.changed == 'true'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get Docker metadata
        if: steps.changes.outputs.changed == 'true'
        id: metadata
        uses: docker/metadata-action@v5.5.1
        with:
          images: |
            docker.io/telepace/ai_feedback_production_${{ matrix.project }}
            registry.cn-hangzhou.aliyuncs.com/telepace/ai_feedback_production_${{ matrix.project }}
            ghcr.io/telepace/ai_feedback_production_${{ matrix.project }}
          tags: |
            type=ref,event=tag
            type=semver,pattern={{version}}
            type=semver,pattern=v{{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha

      - name: Build and push Docker image
        if: steps.changes.outputs.changed == 'true'
        uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.dockerfile }}
          push: true
          tags: ${{ steps.metadata.outputs.tags }}
          platforms: ${{ matrix.architectures }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan Docker image for vulnerabilities
        if: steps.changes.outputs.changed == 'true'
        uses: aquasecurity/trivy-action@0.28.0
        with:
          image-ref: |
            docker.io/${{ secrets.DOCKER_USERNAME }}/ai_feedback_production_${{ matrix.project }}:${{ steps.metadata.outputs.version }}
            registry.cn-hangzhou.aliyuncs.com/${{ secrets.ALIREGISTRY_USERNAME }}/ai_feedback_production_${{ matrix.project }}:${{ steps.metadata.outputs.version }}
            ghcr.io/${{ github.repository_owner }}/ai_feedback_production_${{ matrix.project }}:${{ steps.metadata.outputs.version }}
          format: 'table'
          exit-code: '0'
        continue-on-error: true

      - name: Clean up Docker
        if: steps.changes.outputs.changed == 'true'
        run: docker system prune -f