anyllm-proxy/.github/workflows/docker.yml

name: Docker

on:
  push:
    tags:
      - "v*"
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  IMAGE_NAME: followthewhit3rabbit/anyllm-proxy
  # `latest` only tracks stable vX.Y.Z release tags, never prereleases (tags with a
  # hyphen, e.g. v1.2.3-rc1). Defined once and reused by both build jobs and the
  # manifest merge job so the tag policy can't desync across them.
  LATEST_TAG_ENABLE: ${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') }}

jobs:
  test:
    name: Test container
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-buildx-action@v4

      # Build locally (no push). Primes the GHA cache for the build matrix jobs.
      - name: Build test image
        uses: docker/build-push-action@v7
        with:
          context: .
          load: true
          tags: anyllm-proxy:test
          cache-from: type=gha,scope=test-linux/amd64
          cache-to: type=gha,scope=test-linux/amd64,mode=max

      - name: Smoke test (standalone container)
        run: |
          docker run -d --name proxy-test \
            -e PROXY_OPEN_RELAY=true \
            -p 3000:3000 \
            anyllm-proxy:test
          timeout 30 sh -c 'until curl -sf http://localhost:3000/health; do sleep 1; done'
          curl -sf http://localhost:3000/health | grep -q '"status":"ok"'
          docker stop proxy-test && docker rm proxy-test

      - name: Smoke test (docker compose)
        run: |
          docker compose -f docker-compose.test.yml up -d
          timeout 60 sh -c 'until curl -sf http://localhost:3000/health; do sleep 2; done'
          bash scripts/docker-smoke-test.sh
          docker compose -f docker-compose.test.yml down -v

  build:
    name: Build (${{ matrix.platform }})
    runs-on: ${{ matrix.runner }}
    needs: test
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm

    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-buildx-action@v4

      - name: Validate Docker Hub credentials
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          if [ -z "${DOCKERHUB_USERNAME}" ] || [ -z "${DOCKERHUB_TOKEN}" ]; then
            echo "DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets are required to publish Docker images."
            exit 1
          fi

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-,format=short
            type=raw,value=latest,enable=${{ env.LATEST_TAG_ENABLE }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: ${{ matrix.platform }}
          push: true
          outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=${{ matrix.platform }}
          cache-to: type=gha,scope=${{ matrix.platform }},mode=max
          labels: ${{ steps.meta.outputs.labels }}
          provenance: mode=max
          sbom: true

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest artifact
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: Merge multi-arch manifest
    runs-on: ubuntu-latest
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: read
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: digests-amd64
          path: /tmp/digests

      - uses: actions/download-artifact@v8
        with:
          name: digests-arm64
          path: /tmp/digests

      - uses: docker/setup-buildx-action@v4

      - name: Validate Docker Hub credentials
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          if [ -z "${DOCKERHUB_USERNAME}" ] || [ -z "${DOCKERHUB_TOKEN}" ]; then
            echo "DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets are required to publish Docker images."
            exit 1
          fi

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-,format=short
            type=raw,value=latest,enable=${{ env.LATEST_TAG_ENABLE }}

      - name: Create and push multi-arch manifest
        working-directory: /tmp/digests
        run: |
          tag_args=()
          while IFS= read -r tag; do
            tag_args+=("-t" "${tag}")
          done < <(jq -r '.tags[]' <<< '${{ steps.meta.outputs.json }}')

          digest_args=()
          for digest in *; do
            digest_args+=("${{ env.IMAGE_NAME }}@sha256:${digest}")
          done

          docker buildx imagetools create \
            "${tag_args[@]}" \
            "${digest_args[@]}"

      - name: Verify multi-arch manifest
        run: |
          # metadata-action only emits enabled tags, so any of them is pushable;
          # take the first and fail loudly if the list is somehow empty.
          image_tag=$(jq -r '.tags[0] // empty' <<< '${{ steps.meta.outputs.json }}')
          if [ -z "${image_tag}" ]; then
            echo "no tags produced by metadata-action; cannot verify manifest" >&2
            exit 1
          fi
          docker buildx imagetools inspect "${image_tag}" > manifest.txt
          grep -q 'linux/amd64' manifest.txt
          grep -q 'linux/arm64' manifest.txt