headscale/.github/workflows/container-main.yml

---
name: Build (main)

on:
  push:
    branches:
      - main
    paths:
      - "*.nix"
      - "go.*"
      - "**/*.go"
      - ".github/workflows/container-main.yml"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.sha }}
  cancel-in-progress: true

defaults:
  run:
    shell: nix develop --fallback --command bash -e {0}

jobs:
  container:
    if: github.repository == 'juanfont/headscale'
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Login to DockerHub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: NixOS/nix-installer-action@62c1943b776c509394b550f3f983adc14e9212d6 # main
      - uses: Mic92/hestia@dfed9ced335d28978ba74e513939a10db1f71025 # v3.1.0

      - name: Set commit timestamp
        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> $GITHUB_ENV

      - name: Build and push to GHCR
        env:
          KO_DOCKER_REPO: ghcr.io/juanfont/headscale
          KO_DEFAULTBASEIMAGE: gcr.io/distroless/base-debian13
          CGO_ENABLED: "0"
        run: |
          ko build \
            --bare \
            --image-annotation=org.opencontainers.image.source=https://github.com/juanfont/headscale \
            --image-label=org.opencontainers.image.source=https://github.com/juanfont/headscale \
            --platform=linux/amd64,linux/arm64 \
            --tags=main-${GITHUB_SHA::7},development \
            ./cmd/headscale

      - name: Push to Docker Hub
        env:
          KO_DOCKER_REPO: headscale/headscale
          KO_DEFAULTBASEIMAGE: gcr.io/distroless/base-debian13
          CGO_ENABLED: "0"
        run: |
          ko build \
            --bare \
            --image-annotation=org.opencontainers.image.source=https://github.com/juanfont/headscale \
            --image-label=org.opencontainers.image.source=https://github.com/juanfont/headscale \
            --platform=linux/amd64,linux/arm64 \
            --tags=main-${GITHUB_SHA::7},development \
            ./cmd/headscale

  binaries:
    if: github.repository == 'juanfont/headscale'
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: darwin
            goarch: amd64
          - goos: darwin
            goarch: arm64
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: NixOS/nix-installer-action@62c1943b776c509394b550f3f983adc14e9212d6 # main
      - uses: Mic92/hestia@dfed9ced335d28978ba74e513939a10db1f71025 # v3.1.0

      - name: Build binary
        env:
          CGO_ENABLED: "0"
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
        run: go build -o headscale ./cmd/headscale

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: headscale-${{ matrix.goos }}-${{ matrix.goarch }}
          path: headscale