docker.yml

name: docker

on:
  push:
    branches:
      - main
    paths:
      - 'Dockerfile.jhub'
      - 'jhub-env.lock'
      - '.github/workflows/docker.yml'
  pull_request:

permissions:
  contents: read
  actions: write   # for type=gha cache writes

env:
  IMAGE_NAME: diffuseproject/mdx2-jhub
  IMAGE_TAG: 1.0.2-1
  # HEAD of feat/jupyterhub-singleuser (PR #56 source ref) on 2026-02-25 —
  # the commit diffuseproject/mdx2:test was originally built from
  # (mdx2/VERSION=1.0.2). Reachable only via refs/pull/56/head since the
  # branch was deleted post-merge; the Dockerfile fetches that ref
  # explicitly. Bump together with IMAGE_TAG when shipping an mdx2 source
  # upgrade (e.g. v1.0.4 -> 07f074a, IMAGE_TAG 1.0.2-1 -> 1.0.4-1).
  MDX2_COMMIT: 327bf6e1541e3e0b63a22c8aff100b92c4aa6e39

jobs:
  jhub:
    name: jhub image (singleuser)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Refuse to overwrite an already-published tag
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          if docker manifest inspect "${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" >/dev/null 2>&1; then
            echo "::error::Tag ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} already exists on Dockerhub."
            echo "::error::Image tags are immutable. Bump IMAGE_TAG in .github/workflows/docker.yml"
            echo "::error::(e.g. 1.0.2-1 -> 1.0.2-2 for stack/lockfile changes; 1.0.3-1 for mdx2 source bump) and merge again."
            exit 1
          fi
          echo "Tag ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} is free to publish."

      - name: Build (and push on main)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.jhub
          build-args: |
            MDX2_COMMIT=${{ env.MDX2_COMMIT }}
          push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
          tags: ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
          cache-from: type=gha,scope=jhub
          cache-to: type=gha,mode=max,scope=jhub