psiphon-docker/.github/workflows/cicd.yaml

name: CI/CD for Psiphon Docker

on:
  # Poll upstream Psiphon releases periodically (real builds)
  schedule:
    - cron: "0 */6 * * *"  # every 6 hours

  # Manual runs, with an option to do a dry run (no push)
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Dry run (build but DO NOT push to Docker Hub)"
        required: false
        default: "true"
        type: choice
        options:
          - "true"
          - "false"

permissions:
  contents: read

env:
  DOCKERHUB_REPO: swarupsengupta2007/psiphon

jobs:
  build-and-push:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up QEMU (for multi-arch)
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine dry-run mode
        id: dryrun
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.dry_run }}" = "true" ]; then
            echo "dry_run=true" >> "$GITHUB_OUTPUT"
            echo "Running in DRY-RUN mode (no push to Docker Hub)."
          else
            echo "dry_run=false" >> "$GITHUB_OUTPUT"
            echo "Running in NORMAL mode (will push to Docker Hub if needed)."
          fi

      - name: Get latest psiphon-tunnel-core release & Go version
        id: psiphon
        run: |
          API_URL="https://api.github.com/repos/Psiphon-Labs/psiphon-tunnel-core/releases/latest"

          echo "Fetching latest release from ${API_URL}"
          RESPONSE=$(curl -fsSL "$API_URL")

          LATEST_TAG=$(echo "$RESPONSE" | jq -r '.tag_name')
          if [ -z "$LATEST_TAG" ] || [ "$LATEST_TAG" = "null" ]; then
            echo "Failed to fetch latest tag from Psiphon-Labs/psiphon-tunnel-core"
            exit 1
          fi

          VERSION=${LATEST_TAG#v}

          echo "Latest upstream tag: $LATEST_TAG"
          echo "Normalized version (without v): $VERSION"

          GO_MOD_URL="https://raw.githubusercontent.com/Psiphon-Labs/psiphon-tunnel-core/${LATEST_TAG}/go.mod"
          echo "Fetching go.mod from: $GO_MOD_URL"

          curl -fsSL "$GO_MOD_URL" -o /tmp/go.mod

          GO_VERSION=$(awk '/^go [0-9]+\.[0-9]+/ {print $2; exit}' /tmp/go.mod)
          if [ -z "$GO_VERSION" ]; then
            echo "Could not determine Go version from go.mod; contents:"
            cat /tmp/go.mod
            exit 1
          fi

          echo "Detected Go version from go.mod: $GO_VERSION"

          echo "latest_tag=$LATEST_TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "go_version=$GO_VERSION" >> "$GITHUB_OUTPUT"

      - name: Build multi-arch image
        id: build_img
        run: |
          VERSION=${{ steps.psiphon.outputs.version }}
          ./make.bash -t all -g "${VERSION}"

      - name: Push to Docker Hub if missing
        id: dockerhub_push
        if: steps.dryrun.outputs.dry_run != 'true'
        run: |
          VERSION=${{ steps.psiphon.outputs.version }}
          DH_IMAGE=docker.io/swarupsengupta2007/psiphon

          if docker manifest inspect ${DH_IMAGE}:${VERSION} >/dev/null 2>&1; then
            echo "Docker Hub: ${VERSION} already exists, skipping."
            echo "pushed_dockerhub=false" >> "$GITHUB_OUTPUT"
          else
            docker tag psiphon:${VERSION} ${DH_IMAGE}:${VERSION}
            docker push ${DH_IMAGE}:${VERSION}

            docker tag psiphon:${VERSION} ${DH_IMAGE}:latest
            docker push ${DH_IMAGE}:latest

            echo "pushed_dockerhub=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Push to GHCR if missing
        id: ghcr_push
        if: steps.dryrun.outputs.dry_run != 'true'
        run: |
          VERSION=${{ steps.psiphon.outputs.version }}
          OWNER=${{ github.repository_owner }}
          GH_IMAGE=ghcr.io/${OWNER}/psiphon

          if docker manifest inspect ${GH_IMAGE}:${VERSION} >/dev/null 2>&1; then
            echo "GHCR: ${VERSION} already exists, skipping."
            echo "pushed_ghcr=false" >> "$GITHUB_OUTPUT"
          else
            echo "GHCR: pushing ${VERSION} and latest"

            docker tag psiphon:${VERSION} ${GH_IMAGE}:${VERSION}
            docker push ${GH_IMAGE}:${VERSION}

            docker tag psiphon:${VERSION} ${GH_IMAGE}:latest
            docker push ${GH_IMAGE}:latest

            echo "pushed_ghcr=true" >> "$GITHUB_OUTPUT"
          fi