build_push_demo.yml

name: Build and publish demo image

on:
  push:
    tags:
      - '*'

## GITHUB_TOKEN authentication
permissions:
  contents: write

jobs:
    buildandpush:
        runs-on: ubuntu-latest
        steps:
            # https://github.com/CycodeLabs/cimon-action
            - name: Cimon supply chain attack protection
              uses: cycodelabs/cimon-action@v0
              with:
                prevent: true
                allowed-hosts: >
                  codeload.github.com
                  dl-cdn.alpinelinux.org
                  docker.io
                  ghcr.io
                  index.docker.io
                  nginx.org
                  packagist.org
                  pkg-containers.githubusercontent.com
                  production.cloudflare.docker.com
                  raw.githubusercontent.com
                  registry.yarnpkg.com
                  repo.yarnpkg.com
                  registry.npmjs.org
                  hooks.deltablot.dev

            - name: Checkout elabimg repo
              uses: actions/checkout@v4

            # https://github.com/marketplace/actions/docker-setup-buildx
            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v3

            # https://github.com/docker/login-action#docker-hub
            - name: Login to Docker Hub
              uses: docker/login-action@v3
              with:
                username: ${{ secrets.DOCKER_HUB_USERNAME }}
                password: ${{ secrets.DOCKER_HUB_TOKEN }}

            # https://github.com/docker/build-push-action#multi-platform-image
            # https://docs.docker.com/build/ci/github-actions/cache/
            - name: Build latest release for x86 and push to Docker Hub
              uses: docker/build-push-action@v6
              with:
                context: .
                platforms: linux/amd64
                push: true
                cache-from: type=gha
                cache-to: type=gha,mode=max
                build-args: |
                    ELABFTW_VERSION=demo
                tags: |
                    elabftw/elabimg:demo

            - name: Send request to webhook to trigger update of demo
              run: |
                curl -v -H 'X-Hook-Secret: ${{ secrets.HOOK_SECRET }}' ${{ secrets.HOOK_URL }}