name: Sidecar image

# Builds and publishes the bundled `neoskop/migrateus` sidecar image (all DB
# clients + pgloader). Runs when a release is published (the Release workflow
# tags `v<version>`), or manually. Requires repo secrets DOCKERHUB_USERNAME and
# DOCKERHUB_TOKEN. See docs/sidecar-image.md.

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Image tag to publish (e.g. 2.7.0)"
        required: false
        type: string

permissions:
  contents: read

jobs:
  build-push:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Derive version
        id: meta
        env:
          INPUT_TAG: ${{ inputs.tag }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          if [ -n "$INPUT_TAG" ]; then
            version="$INPUT_TAG"
          else
            version="${REF_NAME#v}"
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4

      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            neoskop/migrateus:latest
            neoskop/migrateus:${{ steps.meta.outputs.version }}