Merge branch 'museofficial:master' into master

5 files changed, 261 insertions, 117 deletions

diff --git a/.github/workflows/pr-release.yml b/.github/workflows/pr-release.yml
new file mode 100644
index 0000000..e121edd
--- /dev/null
+++ b/.github/workflows/pr-release.yml
@@ -0,0 +1,108 @@
+name: Release snapshot of PR
+on:
+  workflow_run:
+    workflows: ["Build snapshot of PR"]
+    types:
+      - completed
+
+env:
+  REGISTRY_IMAGE: ghcr.io/museofficial/muse
+
+jobs:
+  release-and-comment:
+    name: Release snapshot and comment in PR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    steps:
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Download images
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/images
+          pattern: image-linux-*
+          merge-multiple: true
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GH_PAT }}
+
+      - name: Load image
+        shell: bash
+        run: |
+          docker load -i /tmp/images/image-linux-amd64.tar
+          docker load -i /tmp/images/image-linux-arm64.tar
+
+      - name: Download SHA
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/SHA
+          pattern: sha
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GH_PAT }}
+
+      - name: Read SHA
+        shell: bash
+        run: |
+          echo "SHA=$(cat /tmp/SHA/sha/sha.txt | tr -d '\n')" >> $GITHUB_ENV
+
+      - name: Push images
+        run: |
+          docker push ${{ env.REGISTRY_IMAGE }}:${{ env.SHA }}-linux-amd64
+          docker push ${{ env.REGISTRY_IMAGE }}:${{ env.SHA }}-linux-arm64
+
+      - name: Download Docker metadata
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/metadata
+          pattern: metadata
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GH_PAT }}
+
+      - name: Read the metadata.json file
+        id: metadata_reader
+        uses: juliangruber/[email protected]
+        with:
+          path: /tmp/metadata/metadata/metadata.json
+
+      - name: Download PR number
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/pull_request_number
+          pattern: pull_request_number
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GH_PAT }}
+
+      - name: Read PR number
+        shell: bash
+        run: |
+          echo "PR_NUMBER=$(cat /tmp/pull_request_number/pull_request_number/pull_request_number.txt | tr -d '\n')" >> $GITHUB_ENV
+
+      - name: Create manifest list and push
+        run: |
+          docker buildx imagetools create $(cat /tmp/metadata/metadata/metadata.json | jq -cr '.tags | map("-t " + .) | join(" ")') ${{ env.REGISTRY_IMAGE }}:${{ env.SHA }}-linux-amd64 ${{ env.REGISTRY_IMAGE }}:${{ env.SHA }}-linux-arm64
+
+      - name: Create comment
+        uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          header: "pr-release"
+          number: ${{ env.PR_NUMBER }}
+          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          message: |
+            #### :package: :robot: A new release has been made for this pull request.
+
+            To play around with this PR, pull `${{ env.REGISTRY_IMAGE }}:pr-${{ env.PR_NUMBER }}`.
+
+            Images are available for x86_64 and ARM64.
+
+            > Latest commit: ${{ env.SHA }}
diff --git a/.github/workflows/pr-snapshot.yml b/.github/workflows/pr-snapshot.yml
new file mode 100644
index 0000000..88182cb
--- /dev/null
+++ b/.github/workflows/pr-snapshot.yml
@@ -0,0 +1,101 @@
+name: Build snapshot of PR
+
+on: pull_request
+
+env:
+  REGISTRY_IMAGE: ghcr.io/museofficial/muse
+
+jobs:
+  build:
+    name: Build snapshot
+    strategy:
+      matrix:
+        runner-platform:
+          - ubuntu-latest
+          - namespace-profile-default-arm64
+        include:
+          - runner-platform: ubuntu-latest
+            build-arch: linux/amd64
+          - runner-platform: namespace-profile-default-arm64
+            build-arch: linux/arm64
+    runs-on: ${{ matrix.runner-platform }}
+    steps:
+      - name: Prepare
+        run: |
+          platform=${{ matrix.build-arch }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY_IMAGE }}
+          tags: type=ref,event=pr
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Get current time
+        uses: josStorer/get-current-time@v2
+        id: current-time
+
+      - name: Build
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          outputs: type=docker,dest=/tmp/image-${{ env.PLATFORM_PAIR }}.tar
+          platforms: ${{ matrix.build-arch }}
+          tags: |
+            ${{ env.REGISTRY_IMAGE }}:${{ github.sha }}-${{ env.PLATFORM_PAIR }}
+          build-args: |
+            COMMIT_HASH=${{ github.sha }}
+            BUILD_DATE=${{ steps.current-time.outputs.time }}
+
+      - name: Export Docker meta output
+        shell: bash
+        run: echo $DOCKER_METADATA_OUTPUT_JSON > /tmp/metadata.json
+
+      - name: Upload metadata
+        uses: actions/upload-artifact@v4
+        with:
+          name: metadata
+          path: /tmp/metadata.json
+          overwrite: true
+
+      - name: Export SHA
+        run: |
+          echo "${{ github.sha }}" > /tmp/sha.txt
+
+      - name: Upload SHA
+        uses: actions/upload-artifact@v4
+        with:
+          name: sha
+          path: /tmp/sha.txt
+          overwrite: true
+
+      - name: Upload image
+        uses: actions/upload-artifact@v4
+        with:
+          name: image-${{ env.PLATFORM_PAIR }}
+          path: /tmp/image-${{ env.PLATFORM_PAIR }}.tar
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Save PR number in artifact
+        shell: bash
+        env:
+          PR_NUMBER: ${{ github.event.number }}
+        run: echo $PR_NUMBER > /tmp/pull_request_number.txt
+      - name: Upload PR number
+        uses: actions/upload-artifact@v4
+        with:
+          name: pull_request_number
+          path: /tmp/pull_request_number.txt
+          overwrite: true
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
deleted file mode 100644
index 7c611ac..0000000
--- a/.github/workflows/pr.yml
+++ /dev/null
@@ -1,91 +0,0 @@
-name: PR Workflow
-
-on: pull_request_target
-
-jobs:
-  release-snapshot:
-    name: Release snapshot
-    strategy:
-      matrix:
-        runner-platform:
-          - ubuntu-latest
-          - buildjet-4vcpu-ubuntu-2204-arm
-        include:
-          - runner-platform: ubuntu-latest
-            build-arch: linux/amd64
-            tagged-platform: amd64
-          - runner-platform: buildjet-4vcpu-ubuntu-2204-arm
-            build-arch: linux/arm64
-            tagged-platform: arm64
-    runs-on: ${{ matrix.runner-platform }}
-    steps:
-      - name: Set up Buildx
-        uses: docker/setup-buildx-action@v1
-
-      - name: Cache Docker layers
-        # AWS data transfer is pricy
-        if: ${{ matrix.runner-platform != 'buildjet-4vcpu-ubuntu-2204-arm' }}
-        uses: actions/cache@v2
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-buildx-prs-${{ matrix.build-arch }}-${{ github.event.pull_request.head.sha  }}
-          restore-keys: |
-            ${{ runner.os }}-buildx-prs-${{ matrix.build-arch }}
-
-      - name: Login to DockerHub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - uses: actions/checkout@v2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - name: Get current time
-        uses: josStorer/get-current-time@v2
-        id: current-time
-
-      - name: Build and push
-        id: docker_build
-        uses: docker/build-push-action@v2
-        with:
-          context: .
-          push: true
-          tags: codetheweb/muse:${{ github.event.pull_request.head.sha }}-${{ matrix.tagged-platform }}
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache,mode=min
-          platforms: ${{ matrix.build-arch }}
-          build-args: |
-            COMMIT_HASH=${{ github.sha }}
-            BUILD_DATE=${{ steps.current-time.outputs.time }}
-
-  combine-and-comment:
-    name: Combine platform tags and leave comment
-    runs-on: ubuntu-latest
-    needs: release-snapshot
-    steps:
-      - name: Set up Buildx
-        uses: docker/setup-buildx-action@v1
-
-      - name: Login to DockerHub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Combine tags
-        run: docker buildx imagetools create -t 'codetheweb/muse:pr-${{ github.event.number }}' -t 'codetheweb/muse:${{ github.event.pull_request.head.sha }}' 'codetheweb/muse:${{ github.event.pull_request.head.sha }}-arm64' 'codetheweb/muse:${{ github.event.pull_request.head.sha }}-amd64'
-
-      - name: Create comment
-        uses: marocchino/sticky-pull-request-comment@v2
-        with:
-          header: "pr-release"
-          message: |
-            #### :package: A new release has been made for this pull request.
-
-            To play around with this PR, pull `codetheweb/muse:pr-${{ github.event.number }}` or `codetheweb/muse:${{ github.event.pull_request.head.sha }}`.
-
-            Images are available for x86_64 and ARM64.
-
-            > Latest commit: ${{ github.event.pull_request.head.sha }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 08acff9..a279abe 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,34 +5,32 @@ on:
     tags:
     - 'v*'
 
+env:
+  REGISTRY_IMAGE: ghcr.io/museofficial/muse
+
 jobs:
   publish:
     strategy:
       matrix:
         runner-platform:
           - ubuntu-latest
-          - buildjet-4vcpu-ubuntu-2204-arm
+          - namespace-profile-default-arm64
         include:
           - runner-platform: ubuntu-latest
             build-arch: linux/amd64
             tagged-platform: amd64
-          - runner-platform: buildjet-4vcpu-ubuntu-2204-arm
+          - runner-platform: namespace-profile-default-arm64
             build-arch: linux/arm64
             tagged-platform: arm64
     runs-on: ${{ matrix.runner-platform }}
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
     steps:
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@v1
-
-      - name: Cache Docker layers
-        # AWS data transfer is pricy
-        if: ${{ matrix.runner-platform != 'buildjet-4vcpu-ubuntu-2204-arm' }}
-        uses: actions/cache@v2
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-buildx-prs-${{ matrix.build-arch }}-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-buildx-prs-${{ matrix.build-arch }}
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
         uses: docker/login-action@v1
@@ -40,19 +38,26 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Get current time
         uses: josStorer/get-current-time@v2
         id: current-time
 
       - name: Build and push
         id: docker_build
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         with:
           push: true
-          tags: codetheweb/muse:${{ github.sha }}-${{ matrix.tagged-platform }}
+          tags: |
+            codetheweb/muse:${{ github.sha }}-${{ matrix.tagged-platform }}
+            ${{ env.REGISTRY_IMAGE }}:${{ github.sha }}-${{ matrix.tagged-platform }}
           platforms: ${{ matrix.build-arch }}
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache,mode=min
           build-args: |
             COMMIT_HASH=${{ github.sha }}
             BUILD_DATE=${{ steps.current-time.outputs.time }}
@@ -61,6 +66,11 @@ jobs:
     name: Combine platform tags
     runs-on: ubuntu-latest
     needs: publish
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
     steps:
       - uses: actions/checkout@v1
 
@@ -73,21 +83,37 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Get tags
-        id: get-tags
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Get tags (Docker Hub)
+        id: get-tags-dockerhub
         uses: Surgo/docker-smart-tag-action@v1
         with:
           docker_image: codetheweb/muse
 
-      - name: Combine tags
-        run: docker buildx imagetools create $(echo '${{ steps.get-tags.outputs.tag }}' | tr "," "\0" | xargs -0 printf -- '-t %s ') 'codetheweb/muse:${{ github.sha }}-arm64' 'codetheweb/muse:${{ github.sha }}-amd64'
+      - name: Get tags (ghcr.io)
+        id: get-tags-ghcr
+        uses: Surgo/docker-smart-tag-action@v1
+        with:
+          docker_image: ${{ env.REGISTRY_IMAGE }}
+
+      - name: Combine tags (Docker Hub)
+        run: docker buildx imagetools create $(echo '${{ steps.get-tags-dockerhub.outputs.tag }}' | tr "," "\0" | xargs -0 printf -- '-t %s ') 'codetheweb/muse:${{ github.sha }}-arm64' 'codetheweb/muse:${{ github.sha }}-amd64'
+
+      - name: Combine tags (GitHub Container Registry)
+        run: docker buildx imagetools create $(echo '${{ steps.get-tags-ghcr.outputs.tag }}' | tr "," "\0" | xargs -0 printf -- '-t %s ') '${{ env.REGISTRY_IMAGE }}:${{ github.sha }}-arm64' '${{ env.REGISTRY_IMAGE }}:${{ github.sha }}-amd64'
 
       - name: Update Docker Hub description
         uses: peter-evans/[email protected]
-        env:
-          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-          DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
-          DOCKERHUB_REPOSITORY: codetheweb/muse
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          repository: codetheweb/muse
 
   release:
     name: Create GitHub release
diff --git a/.github/workflows/release-comment.yml b/.github/workflows/release-comment.yml
index ab042ac..af122e7 100644
--- a/.github/workflows/release-comment.yml
+++ b/.github/workflows/release-comment.yml
@@ -8,6 +8,6 @@ jobs:
     steps:
       - uses: apexskier/github-release-commenter@v1
         with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           comment-template: |
             🚀 Released in {release_link}.