computer-playbook/.github/workflows/images-mirror-missing.yml

name: "🪞 Mirror: Docker Hub → GHCR (only missing)"

on:
  workflow_call:
    inputs:
      ghcr_namespace:
        description: "GHCR namespace/org (default: repository owner)"
        required: false
        type: string
      ghcr_prefix:
        description: "GHCR repo prefix (default: mirror)"
        required: false
        type: string
        default: "mirror"
      repo_root:
        description: "Repository root path (default: .)"
        required: false
        type: string
        default: "."
      source_repository:
        description: "Optional source repository for image config scan (e.g. fork owner/repo)"
        required: false
        type: string
        default: ""
      source_ref:
        description: "Optional source ref/SHA for image config scan"
        required: false
        type: string
        default: ""
      source_path:
        description: "Optional checkout path for source_repository/source_ref"
        required: false
        type: string
        default: "_pr_source"
      images_per_hour:
        description: "Optional throttle: max images mirrored per hour"
        required: false
        type: string
        default: ""
      concurrency_channel:
        description: "Optional channel to separate concurrency groups between callers"
        required: false
        type: string
        default: "default"
      concurrency_key:
        description: "Optional key (e.g. pr-123) to scope concurrency within a channel"
        required: false
        type: string
        default: ""
      image_wait_attempts:
        description: "Polling attempts for waiting on mirrored images"
        required: false
        type: string
        default: "1440"
      image_wait_sleep_seconds:
        description: "Polling interval in seconds for waiting on mirrored images"
        required: false
        type: string
        default: "10"
    secrets:
      DOCKERHUB_USERNAME:
        required: false
      DOCKERHUB_TOKEN:
        required: false

permissions:
  contents: read
  packages: write

concurrency:
  group: mirror-images-${{ github.repository }}-${{ inputs.concurrency_channel }}-${{ inputs.concurrency_key || github.ref_name }}
  # Cancel scheduled Mirror sync, because may it works with outdatet mirror lists
  cancel-in-progress: true

jobs:
  sync:
    name: 🪞 Mirror images
    runs-on: ubuntu-latest

    # Copy secrets/inputs into env so we can reference them in "if:" (env.* is allowed there)
    env:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
      IMAGES_PER_HOUR: ${{ inputs.images_per_hour || '' }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Resolve GHCR namespace and repository
        id: vars
        shell: bash
        run: |
          set -euo pipefail
          ghcr_namespace="${{ inputs.ghcr_namespace || '' }}"
          if [[ -n "${ghcr_namespace}" ]]; then
            ghcr_namespace="${ghcr_namespace,,}"
          else
            ghcr_namespace="$(scripts/meta/resolve/repository/owner.sh)"
          fi
          ghcr_repository="$(scripts/meta/resolve/repository/name.sh)"
          echo "ghcr_namespace=${ghcr_namespace}" >> "$GITHUB_OUTPUT"
          echo "ghcr_repository=${ghcr_repository}" >> "$GITHUB_OUTPUT"

      - name: Checkout source repo for scan (optional)
        if: ${{ inputs.source_repository != '' && inputs.source_ref != '' }}
        uses: actions/checkout@v6
        with:
          repository: ${{ inputs.source_repository }}
          ref: ${{ inputs.source_ref }}
          path: ${{ inputs.source_path }}
          fetch-depth: 1
          persist-credentials: false

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install Python deps
        run: |
          python -m pip install --upgrade pip
          python -m pip install PyYAML

      - name: Install skopeo
        run: ./scripts/install/apt.sh skopeo

      # Optional: Docker Hub login to avoid rate limits while mirroring
      - name: Login to Docker Hub (optional)
        if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' && !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ env.DOCKERHUB_USERNAME }}
          password: ${{ env.DOCKERHUB_TOKEN }}

      - name: Login to GHCR
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Wait for mirrored images (fork PR)
        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
        env:
          GHCR_NAMESPACE: ${{ steps.vars.outputs.ghcr_namespace }}
          GHCR_REPOSITORY: ${{ steps.vars.outputs.ghcr_repository }}
          GHCR_PREFIX: ${{ inputs.ghcr_prefix || 'mirror' }}
          REPO_ROOT: ${{ inputs.repo_root || '.' }}
          IMAGE_WAIT_ATTEMPTS: ${{ inputs.image_wait_attempts }}
          IMAGE_WAIT_SLEEP_SECONDS: ${{ inputs.image_wait_sleep_seconds }}
        run: ./scripts/meta/wait/mirrors.sh

      - name: Mirror images to GHCR (only missing, best-effort)
        if: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
        shell: bash
        run: |
          set -euo pipefail

          GHCR_NAMESPACE="${{ steps.vars.outputs.ghcr_namespace }}"
          GHCR_REPOSITORY="${{ steps.vars.outputs.ghcr_repository }}"
          GHCR_PREFIX="${{ inputs.ghcr_prefix || 'mirror' }}"
          REPO_ROOT="${{ inputs.repo_root || '.' }}"

          echo ">>> Mirror namespace:  ${GHCR_NAMESPACE}"
          echo ">>> Mirror repository: ${GHCR_REPOSITORY}"
          echo ">>> Mirror prefix:     ${GHCR_PREFIX}"
          echo ">>> Repo root:         ${REPO_ROOT}"
          echo ">>> Mode:              only-missing"
          echo ">>> Throttle:          ${IMAGES_PER_HOUR:-<disabled>} images/hour"

          EXTRA_ARGS=()
          if [ -n "${IMAGES_PER_HOUR:-}" ]; then
            EXTRA_ARGS+=( --images-per-hour "${IMAGES_PER_HOUR}" )
          fi

          python -m cli.mirror.sync \
            --repo-root "${REPO_ROOT}" \
            --ghcr-namespace "${GHCR_NAMESPACE}" \
            --ghcr-repository "${GHCR_REPOSITORY}" \
            --ghcr-prefix "${GHCR_PREFIX}" \
            --only-missing \
            "${EXTRA_ARGS[@]}"

          echo ">>> Mirror sync finished."