fish-shell/.github/workflows/build_docker_images.yml

name: Build Docker test images

on:
  push:
    branches:
      - master
    paths:
      - 'docker/**'
  workflow_dispatch:

concurrency:
  group: docker-builds

env:
  REGISTRY: ghcr.io
  NAMESPACE: fish-ci

jobs:
  docker-build:
    if: github.repository_owner == 'fish-shell'
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: alpine
          - os: ubuntu-latest
            target: ubuntu-oldest-supported
    runs-on: ${{ matrix.os }}

    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2, build_tools/update-dependencies.sh
      -
        name: Login to Container registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0, build_tools/update-dependencies.sh
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0, build_tools/update-dependencies.sh
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.NAMESPACE }}/${{ matrix.target }}
          flavor: |
            latest=true
      -
        name: Build and push
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0, build_tools/update-dependencies.sh
        with:
          context: docker/context
          push: true
          file: docker/${{ matrix.target }}.Dockerfile
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}