name: Docker

on:
  push:
    branches: [master]
    tags: ['v*']
  pull_request:
    paths:
      - 'Dockerfile'
      - 'docker/**'
      - '.dockerignore'
      - '.github/workflows/docker.yml'
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - variant: cpu
            target: cpu
          # Two CUDA variants: no single toolkit covers both Pascal and
          # the newest archs (see CMakeLists.txt).
          - variant: cuda12
            target: cuda
            cuda_build_image: nvidia/cuda:12.9.2-devel-ubuntu22.04
            cuda_runtime_image: nvidia/cuda:12.9.2-runtime-ubuntu22.04
          - variant: cuda13
            target: cuda
            cuda_build_image: nvidia/cuda:13.3.1-devel-ubuntu22.04
            cuda_runtime_image: nvidia/cuda:13.3.1-runtime-ubuntu22.04
          - variant: vulkan
            target: vulkan
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive

      - uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute tags
        id: tags
        shell: bash
        run: |
          image="ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
          variant="${{ matrix.variant }}"
          tags="${image}:${variant}-${{ github.sha }}"
          if [ "${{ github.ref }}" = "refs/heads/master" ]; then
            tags="${tags},${image}:${variant}"
          fi
          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
            version="${GITHUB_REF_NAME#v}"
            tags="${tags},${image}:${variant}-v${version}"
          fi
          echo "tags=${tags}" >> "$GITHUB_OUTPUT"

          # Only set these for the cuda variants, an empty value breaks cpu/vulkan.
          build_args=""
          if [ -n "${{ matrix.cuda_build_image }}" ]; then
            build_args=$'CUDA_BUILD_IMAGE=${{ matrix.cuda_build_image }}\nCUDA_RUNTIME_IMAGE=${{ matrix.cuda_runtime_image }}'
          fi
          {
            echo "build_args<<BUILD_ARGS_EOF"
            echo "$build_args"
            echo "BUILD_ARGS_EOF"
          } >> "$GITHUB_OUTPUT"

          # GHCR cache tag, read on every run; only pushed to when we're
          # logged in (not on PR builds).
          cache_ref="${image}:buildcache-${variant}"
          cache_from=$'type=gha,scope='"$variant"$'\ntype=registry,ref='"$cache_ref"
          cache_to="type=gha,mode=max,scope=${variant}"
          if [ "${{ github.event_name }}" != "pull_request" ]; then
            cache_to="${cache_to}"$'\n'"type=registry,ref=${cache_ref},mode=max"
          fi
          {
            echo "cache_from<<CACHE_FROM_EOF"
            echo "$cache_from"
            echo "CACHE_FROM_EOF"
            echo "cache_to<<CACHE_TO_EOF"
            echo "$cache_to"
            echo "CACHE_TO_EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          context: .
          target: ${{ matrix.target }}
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.tags.outputs.tags }}
          build-args: ${{ steps.tags.outputs.build_args }}
          cache-from: ${{ steps.tags.outputs.cache_from }}
          cache-to: ${{ steps.tags.outputs.cache_to }}