From 238804abbfaae722963f5bb41d224981ee2d9254 Mon Sep 17 00:00:00 2001
From: Swarup Sengupta <swarupsengupta2007@gmail.com>
Date: Sat, 29 Nov 2025 00:53:48 +0530
Subject: [PATCH] Refactor CI/CD workflow for Docker image handling

Removed TARGET_PLATFORMS variable and added GHCR login step. Updated Docker Hub push logic to check for existing tags and streamlined image tagging and pushing process.
---
 .github/workflows/cicd.yaml | 121 ++++++++++++++----------------------
 1 file changed, 48 insertions(+), 73 deletions(-)

diff --git a/.github/workflows/cicd.yaml b/.github/workflows/cicd.yaml
index 20a40a6..2fccaa2 100644
--- a/.github/workflows/cicd.yaml
+++ b/.github/workflows/cicd.yaml
@@ -22,7 +22,6 @@ permissions:
 
 env:
   DOCKERHUB_REPO: swarupsengupta2007/psiphon
-  TARGET_PLATFORMS: linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6
 
 jobs:
   build-and-push:
@@ -44,6 +43,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Determine dry-run mode
         id: dryrun
         run: |
@@ -92,81 +98,50 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "go_version=$GO_VERSION" >> "$GITHUB_OUTPUT"
 
-      - name: Check if this Psiphon version tag already exists on Docker Hub
-        id: check
-        env:
-          DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
-          VERSION: ${{ steps.psiphon.outputs.version }}
+      - name: Build multi-arch image
+        id: build_img
         run: |
-          echo "Checking if ${DOCKERHUB_REPO}:${VERSION} exists on Docker Hub..."
+          VERSION=${{ steps.psiphon.outputs.version }}
+          ./make.bash -t all -g "${VERSION}"
 
-          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
-            "https://hub.docker.com/v2/repositories/${DOCKERHUB_REPO}/tags/${VERSION}/")
-
-          echo "HTTP status from Docker Hub: $STATUS"
-
-          if [ "$STATUS" -eq 200 ]; then
-            echo "exists=true" >> "$GITHUB_OUTPUT"
-            echo "Image tag ${DOCKERHUB_REPO}:${VERSION} already exists on Docker Hub."
-          else
-            echo "exists=false" >> "$GITHUB_OUTPUT"
-            echo "Image tag ${DOCKERHUB_REPO}:${VERSION} does not exist yet."
-          fi
-
-      - name: Build and (maybe) push multi-arch image
-        # In dry-run: always build (even if tag exists), but do NOT push.
-        # In normal mode: only build if tag does not exist, and push.
-        if: steps.dryrun.outputs.dry_run == 'true' || steps.check.outputs.exists != 'true'
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: ${{ env.TARGET_PLATFORMS }}
-          push: ${{ steps.dryrun.outputs.dry_run != 'true' }}
-          tags: |
-            ${{ env.DOCKERHUB_REPO }}:${{ steps.psiphon.outputs.version }}
-            ${{ env.DOCKERHUB_REPO }}:latest
-          build-args: |
-            TARGETS= ${{ env.TARGET_PLATFORMS }}
-            GO_VERSION=${{ steps.psiphon.outputs.go_version }}
-            PSIPHON_VERSION=${{ steps.psiphon.outputs.version }}
-
-      - name: Summary of run (dry-run vs real)
-        if: always()
-        env:
-          DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
-          VERSION: ${{ steps.psiphon.outputs.version }}
-          LATEST_TAG: ${{ steps.psiphon.outputs.latest_tag }}
-          GO_VERSION: ${{ steps.psiphon.outputs.go_version }}
-          DRY_RUN: ${{ steps.dryrun.outputs.dry_run }}
-          EXISTS: ${{ steps.check.outputs.exists }}
-          TARGET_PLATFORMS: ${{ env.TARGET_PLATFORMS }}
+      - name: Push to Docker Hub if missing
+        id: dockerhub_push
+        if: steps.dryrun.outputs.dry_run != 'true'
         run: |
-          echo "================= CI SUMMARY ================="
-          echo "Upstream Psiphon tag:     ${LATEST_TAG}"
-          echo "Normalized version:       ${VERSION}"
-          echo "Go toolchain version:     ${GO_VERSION}"
-          echo "Target platforms:         ${TARGET_PLATFORMS}"
-          echo "Dry-run mode:             ${DRY_RUN}"
-          echo "Tag existed on DockerHub: ${EXISTS}"
-          echo "Image tags considered:    ${DOCKERHUB_REPO}:${VERSION}, ${DOCKERHUB_REPO}:latest"
+          VERSION=${{ steps.psiphon.outputs.version }}
+          DH_IMAGE=docker.io/swarupsengupta2007/psiphon
 
-          if [ "$DRY_RUN" = "true" ]; then
-            echo ""
-            echo "Result: DRY-RUN"
-            echo " - Image was BUILT locally on the runner."
-            echo " - Image was NOT pushed to Docker Hub."
+          if docker manifest inspect ${DH_IMAGE}:${VERSION} >/dev/null 2>&1; then
+            echo "Docker Hub: ${VERSION} already exists, skipping."
+            echo "pushed_dockerhub=false" >> "$GITHUB_OUTPUT"
           else
-            if [ "$EXISTS" = "true" ]; then
-              echo ""
-              echo "Result: SKIPPED PUSH"
-              echo " - Image tag already existed on Docker Hub."
-              echo " - No new image was built/pushed."
-            else
-              echo ""
-              echo "Result: REAL BUILD & PUSH"
-              echo " - Multi-arch image was built."
-              echo " - Pushed: ${DOCKERHUB_REPO}:${VERSION} and :latest"
-            fi
+            docker tag psiphon:${VERSION} ${DH_IMAGE}:${VERSION}
+            docker push ${DH_IMAGE}:${VERSION}
+
+            docker tag psiphon:${VERSION} ${DH_IMAGE}:latest
+            docker push ${DH_IMAGE}:latest
+
+            echo "pushed_dockerhub=true" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Push to GHCR if missing
+        id: ghcr_push
+        if: steps.dryrun.outputs.dry_run != 'true'
+        run: |
+          VERSION=${{ steps.psiphon.outputs.version }}
+          OWNER=${{ github.repository_owner }}
+          GH_IMAGE=ghcr.io/${OWNER}/psiphon
+
+          if docker manifest inspect ${GH_IMAGE}:${VERSION} >/dev/null 2>&1; then
+            echo "GHCR: ${VERSION} already exists, skipping."
+            echo "pushed_ghcr=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "GHCR: pushing ${VERSION} and latest"
+
+            docker tag psiphon:${VERSION} ${GH_IMAGE}:${VERSION}
+            docker push ${GH_IMAGE}:${VERSION}
+
+            docker tag psiphon:${VERSION} ${GH_IMAGE}:latest
+            docker push ${GH_IMAGE}:latest
+
+            echo "pushed_ghcr=true" >> "$GITHUB_OUTPUT"
           fi
-          echo "==============================================="