ad-aures_castoPod/docker/production/.gitlab-ci.yml

stages:
  - build

docker-build-rolling:
  stage: build
  image:
    name: docker.io/docker:29.2-dind
  services:
    - docker:29.2-dind
  variables:
    TAG: $CI_COMMIT_BRANCH
    DOCKER_BUILDKIT: 1
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"
  before_script:
    # ensure the Docker config directory exists
    - mkdir -p /root/.docker
    # copy credentials to authenticate against registry
    - cp ${DOCKER_HUB_CONFIG} /root/.docker/config.json

    - docker context create tls-environment

    # Create and use builder with optimized settings
    - docker buildx create
      --name fast-multiplatform
      --driver docker-container
      --driver-opt network=host
      --driver-opt image=moby/buildkit:v0.27.1
      --use
      tls-environment

    # initialize and boot fast-multiplatform builder
    # configure BuildKit features that aren't enabled by default
    - docker buildx inspect --bootstrap
  script:
    - docker buildx build
      --target production
      --secret id=maxmind-licence-key,env=MAXMIND_LICENCE_KEY
      --platform linux/amd64
      --file docker/production/Dockerfile
      --push
      --tag ${DOCKER_IMAGE_CASTOPOD}:${TAG}
      .
  rules:
    - if: $CI_COMMIT_BRANCH == 'develop'

docker-build-release:
  stage: build
  image:
    name: docker.io/docker:29.2-dind
  services:
    - docker:29.2-dind
  variables:
    DOCKER_BUILDKIT: 1
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"
  before_script:
    # ensure the Docker config directory exists
    - mkdir -p /root/.docker
    # copy credentials to authenticate against registry
    - cp ${DOCKER_HUB_CONFIG} /root/.docker/config.json

    ## Prepare Docker image tags from git tag
    ## --------------------------------------
    # extract full SemVer from git tag (remove leading "v")
    - export IMAGE_TAG_VERSION=$(echo "$CI_COMMIT_TAG" | sed 's/^v//')
    # extract channel (prerelease like "alpha", "beta", "next"; "latest" for stable)
    - export IMAGE_TAG_CHANNEL=$(echo "$IMAGE_TAG_VERSION" | sed 's/^[^-]*-\([^.]*\)\..*/\1/; t; s/.*/latest/')
    # extract major version number (first SemVer component)
    - export IMAGE_TAG_MAJOR=$(echo "$IMAGE_TAG_VERSION" | sed 's/\..*//')
    # construct major-channel tag ("X" for stable, "X-channel" for prerelease)
    - export IMAGE_TAG_MAJOR_CHANNEL=$([ "$IMAGE_TAG_CHANNEL" = "latest" ] && echo "$IMAGE_TAG_MAJOR" || echo "${IMAGE_TAG_MAJOR}-${IMAGE_TAG_CHANNEL}")

    - docker context create tls-environment

    # Create and use builder with optimized settings
    - docker buildx create
      --name fast-multiplatform
      --driver docker-container
      --driver-opt network=host
      --driver-opt image=moby/buildkit:v0.27.1
      --use
      tls-environment

    # initialize and boot fast-multiplatform builder
    # configure BuildKit features that aren't enabled by default
    - docker buildx inspect --bootstrap
  script:
    - docker buildx build
      --target production
      --secret id=maxmind-licence-key,env=MAXMIND_LICENCE_KEY
      --platform linux/amd64
      --file docker/production/Dockerfile
      --push
      --tag ${DOCKER_IMAGE_CASTOPOD}:${IMAGE_TAG_VERSION}
      --tag ${DOCKER_IMAGE_CASTOPOD}:${IMAGE_TAG_CHANNEL}
      --tag ${DOCKER_IMAGE_CASTOPOD}:${IMAGE_TAG_MAJOR_CHANNEL}
      .
    # when --platform=linux/amd64,linux/arm64: amd64 image takes too long to be pushed as it needs to wait for arm64 to be built
    # --> build and push amd64 image first, then overwrite manifest after building arm64
    - docker buildx build
      --target production
      --secret id=maxmind-licence-key,env=MAXMIND_LICENCE_KEY
      --platform linux/amd64,linux/arm64
      --file docker/production/Dockerfile
      --push
      --tag ${DOCKER_IMAGE_CASTOPOD}:${IMAGE_TAG_VERSION}
      --tag ${DOCKER_IMAGE_CASTOPOD}:${IMAGE_TAG_CHANNEL}
      --tag ${DOCKER_IMAGE_CASTOPOD}:${IMAGE_TAG_MAJOR_CHANNEL}
      .
  rules:
    - if: $CI_COMMIT_TAG