searxng/.github/workflows/container.yml

---
name: Container

# yamllint disable-line rule:truthy
on:
  workflow_dispatch:
  workflow_run:
    workflows:
      - Integration
    types:
      - completed
    branches:
      - master

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

permissions:
  contents: read
  packages: read

env:
  PYTHON_VERSION: "3.14"

jobs:
  build:
    if: |
      github.event_name == 'workflow_dispatch'
      || (github.repository_owner == 'searxng' && github.event.workflow_run.conclusion == 'success')
    name: Build (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-26.04
            arch: amd64
          - runner: ubuntu-26.04-arm
            arch: arm64
          - runner: ubuntu-26.04-arm
            arch: armv7

    outputs:
      docker_tag: ${{ steps.build.outputs.docker_tag }}

    steps:
      - name: Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "${{ env.PYTHON_VERSION }}"

      - name: Setup QEMU
        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a  # v4.3.0

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          ref: "${{ github.event.workflow_run.head_sha || github.sha }}"
          persist-credentials: "false"
          fetch-depth: "0"

      - name: Setup cache Python
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          key: "python-${{ env.PYTHON_VERSION }}-${{ runner.arch }}-${{ hashFiles('./requirements*.txt') }}"
          restore-keys: |
            python-${{ env.PYTHON_VERSION }}-${{ runner.arch }}-
          path: "./local/"

      - name: Setup cache container
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          key: "container-${{ matrix.arch }}-${{ hashFiles('./requirements*.txt') }}"
          restore-keys: |
            container-${{ matrix.arch }}-
          path: "/var/tmp/buildah-cache-*/*"

      - name: Build
        id: build
        env:
          OVERRIDE_ARCH: "${{ matrix.arch }}"
        run: make container.build

      - name: Upload container image
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
        with:
          name: container-image-${{ matrix.arch }}
          path: "/var/tmp/searxng-podman/*.tar"
          if-no-files-found: error
          retention-days: 1

  test:
    name: Test (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    needs: build
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-26.04
            arch: amd64
          - runner: ubuntu-26.04-arm
            arch: arm64
          - runner: ubuntu-26.04
            arch: armv7

    steps:
      - name: Setup QEMU
        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a  # v4.3.0

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          ref: "${{ github.event.workflow_run.head_sha || github.sha }}"
          persist-credentials: "false"

      - name: Download container image
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
        with:
          pattern: container-image-${{ matrix.arch }}
          path: "/var/tmp/searxng-podman"
          merge-multiple: true

      - name: Test
        env:
          OVERRIDE_ARCH: "${{ matrix.arch }}"
        run: make container.test

  release:
    if: github.repository_owner == 'searxng' && github.ref_name == 'master'
    name: Release
    runs-on: ubuntu-26.04-arm
    needs:
      - build
      - test

    permissions:
      packages: write

    steps:
      - name: Login to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
        with:
          registry: "docker.io"
          username: "${{ secrets.DOCKER_USER }}"
          password: "${{ secrets.DOCKER_TOKEN }}"

      - name: Login to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
        with:
          registry: "ghcr.io"
          username: "${{ github.repository_owner }}"
          password: "${{ secrets.GITHUB_TOKEN }}"

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          ref: "${{ github.event.workflow_run.head_sha || github.sha }}"
          persist-credentials: "false"

      - name: Download container images
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
        with:
          pattern: container-image-*
          path: "/var/tmp/searxng-podman"
          merge-multiple: true

      - name: Release
        env:
          DOCKER_TAG: "${{ needs.build.outputs.docker_tag }}"
        run: make container.push