name: Docker image build and push

on:
  push:
    branches:
      - 'master'
  schedule:
    - cron: '0 0 * * *'

permissions:
  contents: read

jobs:
  docker:
    permissions:
      deployments: write # Docker needs to be able to deploy and package.
      packages: write
    if: github.repository == 'brainboxdotcc/DPP'
    runs-on: ubuntu-latest
    concurrency: 
      group: docker-deployment
      cancel-in-progress: false
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          egress-policy: audit

      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
      -
        name: Login to DockerHub
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Login to GitHub Container Registry
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}          
      -
        name: Build and push
        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
        with:
          push: true
          tags: brainboxdotcc/dpp
      - # copy multiplatform image from dockerhub to ghcr
        name: Push Image to multiple registries
        uses: akhilerm/tag-push-action@85bf542f43f5f2060ef76262a67ee3607cb6db37 # v2.1.0
        with:
          src: docker.io/brainboxdotcc/dpp:latest
          dst: |
            ghcr.io/brainboxdotcc/dpp:latest