.goreleaser-docker.yml

# yaml-language-server: $schema=https://raw.githubusercontent.com/goreleaser/goreleaser/v2.13.3/www/docs/static/schema-pro.json
version: 2

# Docker-only GoReleaser config.
#
# This is run by the `docker-publish` job in main.yml, which is a sibling of
# `publish` (gated by the same lint/test jobs and the linux binary builds).
# The split from .goreleaser.yml is deliberate: it keeps Docker's failure
# domain (ghcr + Docker Hub push, sigstore/fulcio) and elevated permissions
# (`packages: write`, `id-token: write`) out of the main `publish` GoReleaser
# run, and lets the two ship in parallel. The image is built from the linux
# release binaries, so it always matches this exact release.
project_name: sq

builds:
  - id: sq
    builder: prebuilt
    goos:
      - linux
    goarch:
      - amd64
      - arm64
    goamd64:
      - v1
    prebuilt:
      # The CI job downloads both linux release artifacts into dist-linux/.
      # amd64 -> dist-linux/sq_linux_amd64_v1/sq ; arm64 -> dist-linux/sq_linux_arm64_v8.0/sq
      # (the goarm64 default v8.0 suffix is always appended). Mirrors the
      # prebuilt path template in .goreleaser.yml.
      path: dist-linux/sq_linux_{{ .Arch }}{{ with .Amd64 }}_{{ . }}{{ end }}{{ with .Arm64 }}_{{ . }}{{ end }}/sq
    binary: sq

# This run only builds/pushes images; it must not create or modify a GitHub
# release (the `publish` job already did that).
release:
  disable: true

dockers:
  - id: sq-amd64
    goos: linux
    goarch: amd64
    goamd64: v1
    dockerfile: packages/docker/alpine.Dockerfile
    use: buildx
    image_templates:
      - "ghcr.io/neilotoole/sq:{{ .Tag }}-amd64"
      - "docker.io/neilotoole/sq:{{ .Tag }}-amd64"
    build_flag_templates:
      - "--platform=linux/amd64"
      # OCI metadata for traceability (version / commit / build time / title).
      - "--label=org.opencontainers.image.version={{ .Version }}"
      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
      - "--label=org.opencontainers.image.created={{ .Date }}"
      - "--label=org.opencontainers.image.title=sq"
      # GHA buildx cache, scoped per arch so amd64 and arm64 don't thrash.
      - "--cache-from=type=gha,scope=docker-amd64"
      - "--cache-to=type=gha,mode=max,scope=docker-amd64"
    extra_files:
      - packages/docker/alpine-mssql-tools-install.sh
      - packages/docker/configure-oh-my-zsh.sh
      - packages/docker/sq.zsh-theme
      - packages/docker/entrypoint.sh

  - id: sq-arm64
    goos: linux
    goarch: arm64
    dockerfile: packages/docker/alpine.Dockerfile
    use: buildx
    image_templates:
      - "ghcr.io/neilotoole/sq:{{ .Tag }}-arm64"
      - "docker.io/neilotoole/sq:{{ .Tag }}-arm64"
    build_flag_templates:
      - "--platform=linux/arm64"
      # OCI metadata for traceability (version / commit / build time / title).
      - "--label=org.opencontainers.image.version={{ .Version }}"
      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
      - "--label=org.opencontainers.image.created={{ .Date }}"
      - "--label=org.opencontainers.image.title=sq"
      # GHA buildx cache, scoped per arch so amd64 and arm64 don't thrash.
      - "--cache-from=type=gha,scope=docker-arm64"
      - "--cache-to=type=gha,mode=max,scope=docker-arm64"
    extra_files:
      - packages/docker/alpine-mssql-tools-install.sh
      - packages/docker/configure-oh-my-zsh.sh
      - packages/docker/sq.zsh-theme
      - packages/docker/entrypoint.sh

# Stitch the per-arch images into multi-arch manifest tags, on both registries.
# The per-arch `:{{ .Tag }}-{amd64,arm64}` images must be pushed first (done
# above) so the manifests can reference them. The manifest content is identical
# across registries, so both resolve to the same digest. That single digest is
# what the attestation steps in the `docker-publish` job attest, once per
# registry subject name.
docker_manifests:
  - name_template: "ghcr.io/neilotoole/sq:{{ .Tag }}"
    image_templates:
      - "ghcr.io/neilotoole/sq:{{ .Tag }}-amd64"
      - "ghcr.io/neilotoole/sq:{{ .Tag }}-arm64"
  - name_template: "ghcr.io/neilotoole/sq:latest"
    image_templates:
      - "ghcr.io/neilotoole/sq:{{ .Tag }}-amd64"
      - "ghcr.io/neilotoole/sq:{{ .Tag }}-arm64"
  - name_template: "docker.io/neilotoole/sq:{{ .Tag }}"
    image_templates:
      - "docker.io/neilotoole/sq:{{ .Tag }}-amd64"
      - "docker.io/neilotoole/sq:{{ .Tag }}-arm64"
  - name_template: "docker.io/neilotoole/sq:latest"
    image_templates:
      - "docker.io/neilotoole/sq:{{ .Tag }}-amd64"
      - "docker.io/neilotoole/sq:{{ .Tag }}-arm64"

# Keyless cosign signing of the published manifests, matching the prior
# docker-publish workflow. `artifacts: manifests` covers every manifest
# built above, so the Docker Hub tags are signed along with the GHCR ones.
docker_signs:
  - cmd: cosign
    artifacts: manifests
    args:
      - "sign"
      - "--yes"
      - "${artifact}@${digest}"