ccache.yml

# test ccache
name: ccache

on:
  #push:
  #  branches: 
  #    - main
  #  paths:
  #    - ccache/*
  #    - .github/workflows/ccache.yml
  workflow_dispatch:
  #schedule:
  #  - cron: "0 8 * * 1"

env:
  BUILD_VERSION: "1.21.4"
  OPENSSL_VERSION: "3.0.0"
  PCRE_VERSION: "8.45"
  DOCKER_CLI_EXPERIMENTAL: enabled
  REPOSITORY: ${{ github.actor }}/${{ github.workflow }} 

permissions: read-all

jobs:
  deploy:
    runs-on: ubuntu-24.04
    permissions:
      packages: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - name: Source checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.4.2 
 
      - name: Setup QEMU
        id: qemu
        uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v1.2.0
      
      - name: Setup Buildx
        id: buildx
        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v1
      
      - name: Set Docker metadata
        id: docker_meta
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v3
        with:
          images: ${{ env.REPOSITORY }}
          labels: |
            org.opencontainers.image.version=${{ env.BUILD_VERSION }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.title=${{ env.REPOSITORY }}

      - name: ccache
        uses: hendrikmuhs/ccache-action@a1209f81afb8c005c13b4296c32e363431bffea5 # v1
        with:
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          max-size: 500M

      - name: Check path
        run: |
          ls -la
          pwd

      - name: GitHub login
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v1.12.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

#      - name: DockerHub login
#        if: ${{ github.event_name != 'pull_request' }}
#        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v1.12.0
#        with:
#          username: ${{ secrets.DOCKERHUB_USERNAME }}
#          password: ${{ secrets.DOCKERHUB_PASSWORD }}      

      - name: Build and push
        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991
        with:
          push: ${{ github.event_name != 'pull_request' }}
          #context: ${{ github.workflow }}
          context: nginx
          file: nginx/Dockerfile.works
          #platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v7
          #platforms: linux/amd64,linux/arm64,linux/ppc64le
          #platforms: linux/amd64,linux/arm64
          platforms: linux/amd64
          build-args: |
            BUILD_VERSION
          sbom: true
          provenance: true
          cache-from: type=gha, scope=${{ github.workflow }}
          cache-to: type=gha, scope=${{ github.workflow }}
          labels: ${{ steps.docker_meta.outputs.labels }}
          tags: |
            ghcr.io/${{ env.REPOSITORY }}:${{ env.BUILD_VERSION }}-sandbox