synapse/.github/workflows/docker.yml

# GitHub actions workflow which builds and publishes the docker images.

name: Build docker images

on:
  push:
    tags: ["v*"]
    branches: [master, main, develop]
  workflow_dispatch:

permissions:
  contents: read
  packages: write
  id-token: write # needed for signing the images with GitHub OIDC Token
jobs:
  build:
    name: Build and push image for ${{ matrix.platform }}
    runs-on: ${{ matrix.runs_on }}
    strategy:
      matrix:
        include:
          - platform: linux/amd64
            runs_on: ubuntu-24.04
            suffix: linux-amd64
          - platform: linux/arm64
            runs_on: ubuntu-24.04-arm
            suffix: linux-arm64
    steps:
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Extract version from pyproject.toml
        # Note: explicitly requesting bash will mean bash is invoked with `-eo pipefail`, see
        # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
        shell: bash
        run: |
          echo "SYNAPSE_VERSION=$(grep "^version" pyproject.toml | sed -E 's/version\s*=\s*["]([^"]*)["]/\1/')" >> $GITHUB_ENV

      - name: Log in to DockerHub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log in to GHCR
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Tailscale
        uses: tailscale/github-action@53acf823325fe9ca47f4cdaa951f90b4b0de5bb9 # v4.1.1
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          audience: ${{ secrets.TS_AUDIENCE }}
          tags: tag:github-actions

      - name: Compute vault jwt role name
        id: vault-jwt-role
        run: |
           echo "role_name=github_service_management_$( echo "${{ github.repository }}" | sed -r 's|[/-]|_|g')" | tee -a "$GITHUB_OUTPUT"

      - name: Get team registry token
        id: import-secrets
        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
        with:
          url: https://vault.infra.ci.i.element.dev
          role: ${{ steps.vault-jwt-role.outputs.role_name }}
          path: service-management/github-actions
          jwtGithubAudience: https://vault.infra.ci.i.element.dev
          method: jwt
          secrets: |
             services/backend-repositories/secret/data/oci.element.io username | OCI_USERNAME ;
             services/backend-repositories/secret/data/oci.element.io password | OCI_PASSWORD ;

      - name: Login to Element OCI Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: oci-push.vpn.infra.element.io
          username: ${{ steps.import-secrets.outputs.OCI_USERNAME }}
          password: ${{ steps.import-secrets.outputs.OCI_PASSWORD }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          push: true
          labels: |
            gitsha1=${{ github.sha }}
            org.opencontainers.image.version=${{ env.SYNAPSE_VERSION }}
          tags: |
            docker.io/matrixdotorg/synapse
            ghcr.io/element-hq/synapse
            oci-push.vpn.infra.element.io/synapse
          file: "docker/Dockerfile"
          platforms: ${{ matrix.platform }}
          outputs: type=image,push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        run: |
          mkdir -p ${{ runner.temp }}/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: digests-${{ matrix.suffix }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: Push merged images to ${{ matrix.repository }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        repository:
          - docker.io/matrixdotorg/synapse
          - ghcr.io/element-hq/synapse
          - oci-push.vpn.infra.element.io/synapse

    needs:
      - build
    steps:
      - name: Download digests
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Log in to DockerHub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        if: ${{ startsWith(matrix.repository, 'docker.io') }}
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log in to GHCR
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        if: ${{ startsWith(matrix.repository, 'ghcr.io') }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Tailscale
        uses: tailscale/github-action@53acf823325fe9ca47f4cdaa951f90b4b0de5bb9 # v4.1.1
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          audience: ${{ secrets.TS_AUDIENCE }}
          tags: tag:github-actions

      - name: Compute vault jwt role name
        id: vault-jwt-role
        run: |
           echo "role_name=github_service_management_$( echo "${{ github.repository }}" | sed -r 's|[/-]|_|g')" | tee -a "$GITHUB_OUTPUT"

      - name: Get team registry token
        id: import-secrets
        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
        with:
          url: https://vault.infra.ci.i.element.dev
          role: ${{ steps.vault-jwt-role.outputs.role_name }}
          path: service-management/github-actions
          jwtGithubAudience: https://vault.infra.ci.i.element.dev
          method: jwt
          secrets: |
             services/backend-repositories/secret/data/oci.element.io username | OCI_USERNAME ;
             services/backend-repositories/secret/data/oci.element.io password | OCI_PASSWORD ;

      - name: Login to Element OCI Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: oci-push.vpn.infra.element.io
          username: ${{ steps.import-secrets.outputs.OCI_USERNAME }}
          password: ${{ steps.import-secrets.outputs.OCI_PASSWORD }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Install Cosign
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Calculate docker image tag
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ${{ matrix.repository }}
          flavor: |
            latest=false
          tags: |
            type=raw,value=develop,enable=${{ github.ref == 'refs/heads/develop' }}
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
            type=pep440,pattern={{raw}}
            type=sha

      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        env:
          REPOSITORY: ${{ matrix.repository }}
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf "$REPOSITORY@sha256:%s " *)

      - name: Sign each manifest
        env:
          REPOSITORY: ${{ matrix.repository }}
        run: |
          DIGESTS=""
          for TAG in $(echo "$DOCKER_METADATA_OUTPUT_JSON" | jq -r '.tags[]'); do
            DIGEST="$(docker buildx imagetools inspect $TAG --format '{{json .Manifest}}' | jq -r '.digest')"
            DIGESTS="$DIGESTS $REPOSITORY@$DIGEST"
          done
          cosign sign --yes $DIGESTS