push_latest.yml

name: Build and push micromamba docker image

on:
  workflow_dispatch:
  push:
    branches:
      - 'main'
    tags:
      - 'v*'

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
  DEFAULT_BASE_IMAGE: 'debian:13-slim'
  LATEST_DEBIAN_BASE_IMAGE: 'debian:13'
  LATEST_DEBIAN_SLIM_BASE_IMAGE: 'debian:13-slim'
  LATEST_UBUNTU_BASE_IMAGE: 'ubuntu:25.10'
  LATEST_AMAZON_BASE_IMAGE: 'public.ecr.aws/amazonlinux/amazonlinux:2023'
  LATEST_ALPINE_BASE_IMAGE: 'frolvlad/alpine-glibc:alpine-3.22'
  LATEST_CUDA_BASE_IMAGE: 'nvidia/cuda:13.2.0-base-ubuntu24.04'

jobs:
  build_docker_image_and_push:
    if: github.repository == 'mamba-org/micromamba-docker'
    runs-on: ubuntu-24.04
    permissions:
      packages: write
    strategy:
      matrix:
        image:
         - debian:13-slim
         - debian:13
         - debian:12-slim
         - debian:12
         - ubuntu:25.10
         - ubuntu:24.04
         - ubuntu:22.04
         - frolvlad/alpine-glibc:alpine-3.22
         - frolvlad/alpine-glibc:alpine-3.21
         - public.ecr.aws/amazonlinux/amazonlinux:2023
         - nvidia/cuda:13.2.0-base-ubuntu24.04
         - nvidia/cuda:13.2.0-base-ubuntu22.04
         - nvidia/cuda:12.9.1-base-ubuntu24.04
         - nvidia/cuda:12.9.1-base-ubuntu22.04
         - nvidia/cuda:12.8.1-base-ubuntu24.04
         - nvidia/cuda:12.8.1-base-ubuntu22.04
         - nvidia/cuda:12.6.3-base-ubuntu24.04
         - nvidia/cuda:12.6.3-base-ubuntu22.04
         - nvidia/cuda:12.5.1-base-ubuntu24.04
         - nvidia/cuda:12.5.1-base-ubuntu22.04
         - nvidia/cuda:12.4.1-base-ubuntu22.04
         - nvidia/cuda:12.3.2-base-ubuntu22.04
         - nvidia/cuda:12.2.2-base-ubuntu22.04
         - nvidia/cuda:12.1.1-base-ubuntu22.04
         - nvidia/cuda:11.8.0-base-ubuntu22.04
         - nvidia/cuda:11.7.1-base-ubuntu22.04
    steps:
    - name: Install GNU parallel, shellcheck
      run: |
        sudo apt update
        sudo apt-get install --no-install-recommends -y parallel shellcheck software-properties-common
    - name: Setup nox
      uses: wntrblm/nox@0eee2e45758dbd06d48ebb23476439f0f00e5cbd
    - name: Checkout source
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      with:
        persist-credentials: false
        submodules: recursive
    - name: Get short git hash
      id: short_hash
      run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
    - name: Get micromamba version
      id: get_version
      run: echo "version=$(grep '^ARG VERSION=' debian.Dockerfile  | cut -d= -f2)" >> $GITHUB_OUTPUT
    - name: Set image variables
      id: set_image_variables
      env:
        BASE_IMAGE: ${{ matrix.image }}
      run: |
        base_tag="${BASE_IMAGE##*:}"
        base_name="${BASE_IMAGE%%:*}"
        if [ "${base_name}" = 'nvidia/cuda' ]; then
          ubuntu_version_number="${base_tag##*-ubuntu}"
          cuda_version="${base_tag%%-*}"
          echo 'distro_id=debian' >> $GITHUB_OUTPUT
          echo "tag=cuda${cuda_version}-ubuntu${ubuntu_version_number}" >> $GITHUB_OUTPUT
          echo 'platforms=linux/amd64,linux/arm64' >> $GITHUB_OUTPUT
        elif [ "${base_name}" = 'frolvlad/alpine-glibc' ]; then
          echo 'distro_id=alpine' >> $GITHUB_OUTPUT
          alpine_version_number="${base_tag##alpine-}"
          echo "tag=alpine${alpine_version_number}" >> $GITHUB_OUTPUT
          echo 'platforms=linux/amd64,linux/arm64' >> $GITHUB_OUTPUT
        elif [ "${base_name}" = 'public.ecr.aws/amazonlinux/amazonlinux' ]; then
          echo 'distro_id=fedora' >> $GITHUB_OUTPUT
          echo "tag=amazon${base_tag}" >> $GITHUB_OUTPUT
          echo 'platforms=linux/amd64,linux/arm64' >> $GITHUB_OUTPUT
        elif [ "${base_name}" = 'ubuntu' ]; then
          echo 'distro_id=debian' >> $GITHUB_OUTPUT
          echo "tag=ubuntu${base_tag}" >> $GITHUB_OUTPUT
          echo 'platforms=linux/amd64,linux/arm64,linux/ppc64le' >> $GITHUB_OUTPUT
        else
          echo 'distro_id=debian' >> $GITHUB_OUTPUT
          echo "tag=debian${base_tag}" >> $GITHUB_OUTPUT
          if [ "${base_tag}" = '11' ] || [ "${base_tag}" = '11-slim' ]; then
            echo 'platforms=linux/amd64,linux/arm64' >> $GITHUB_OUTPUT
          else
            echo 'platforms=linux/amd64,linux/arm64,linux/ppc64le' >> $GITHUB_OUTPUT
          fi
        fi
        echo "is_default=$([ "$BASE_IMAGE" = "$DEFAULT_BASE_IMAGE" ] \
                           && echo true || echo false)" >> $GITHUB_OUTPUT
        echo "is_latest_alpine=$([ "$BASE_IMAGE" = "$LATEST_ALPINE_BASE_IMAGE" ] \
                          && echo true || echo false)" >> $GITHUB_OUTPUT
        echo "is_latest_debian=$([ "$BASE_IMAGE" = "$LATEST_DEBIAN_BASE_IMAGE" ] \
                          && echo true || echo false)" >> $GITHUB_OUTPUT
        echo "is_latest_debian_slim=$([ "$BASE_IMAGE" = "$LATEST_DEBIAN_SLIM_BASE_IMAGE" ] \
                          && echo true || echo false)" >> $GITHUB_OUTPUT
        echo "is_latest_ubuntu=$([ "$BASE_IMAGE" = "$LATEST_UBUNTU_BASE_IMAGE" ] \
                          && echo true || echo false)" >> $GITHUB_OUTPUT
        echo "is_latest_amazon=$([ "$BASE_IMAGE" = "$LATEST_AMAZON_BASE_IMAGE" ] \
                          && echo true || echo false)" >> $GITHUB_OUTPUT
        echo "is_latest_cuda=$([ "$BASE_IMAGE" = "$LATEST_CUDA_BASE_IMAGE" ] \
                          && echo true || echo false)" >> $GITHUB_OUTPUT
    - name: Get stage1 docker metadata
      id: get_stage1_metadata
      uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051
      with:
        images: |
          ghcr.io/mamba-org/micromamba-cache/stage1
        flavor: latest=false
        tags: |
            type=raw,value=${{ steps.set_image_variables.outputs.tag }}
    - name: Get docker metadata
      id: get_metadata
      uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051
      with:
        images: |
          mambaorg/micromamba
          ghcr.io/mamba-org/micromamba
        flavor: latest=false
        # This comment provides a summary of the tags generated by this action:
        # latest
        # base_image
        # alpine
        # debian
        # debian-slim
        # ubuntu
        # amazon
        # cuda
        # major.minor.patch
        # major.minor
        # major
        # major.minor.patch-base_image
        # major.minor-base_image
        # major-base_imag git-commit-base_image
        # git-commit
        tags: |
            type=raw,value=latest,priority=1000,enable=${{ steps.set_image_variables.outputs.is_default }}
            type=raw,value=${{ steps.set_image_variables.outputs.tag }},priority=900
            type=raw,value=alpine,priority=850,enable=${{ steps.set_image_variables.outputs.is_latest_alpine }}
            type=raw,value=debian,priority=850,enable=${{ steps.set_image_variables.outputs.is_latest_debian }}
            type=raw,value=debian-slim,priority=850,enable=${{ steps.set_image_variables.outputs.is_latest_debian_slim }}
            type=raw,value=ubuntu,priority=850,enable=${{ steps.set_image_variables.outputs.is_latest_ubuntu }}
            type=raw,value=amazon,priority=850,enable=${{ steps.set_image_variables.outputs.is_latest_amazon }}
            type=raw,value=cuda,priority=850,enable=${{ steps.set_image_variables.outputs.is_latest_cuda }}
            type=semver,pattern={{version}},enable=${{ steps.set_image_variables.outputs.is_default }},value=${{ steps.get_version.outputs.version }},priority=800
            type=semver,pattern={{major}}.{{minor}},enable=${{ steps.set_image_variables.outputs.is_default }},value=${{ steps.get_version.outputs.version }},priority=700
            type=semver,pattern={{major}},enable=${{ steps.set_image_variables.outputs.is_default }},value=${{ steps.get_version.outputs.version }},priority=600
            type=semver,pattern={{version}}-${{ steps.set_image_variables.outputs.tag }},value=${{ steps.get_version.outputs.version }},priority=500
            type=semver,pattern={{major}}.{{minor}}-${{ steps.set_image_variables.outputs.tag}},value=${{ steps.get_version.outputs.version }},priority=400
            type=semver,pattern={{major}}-${{ steps.set_image_variables.outputs.tag}},value=${{ steps.get_version.outputs.version }},priority=300
            type=sha,prefix=git-,suffix=-${{ steps.set_image_variables.outputs.tag }},priority=200
            type=sha,prefix=git-,enable=${{ steps.set_image_variables.outputs.is_default }},priority=100
        labels: |
          distro_id=${{ steps.set_image_variables.outputs.distro_id }}
    - name: Setup docker buildx
      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
    - name: Login to DockerHub
      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
    - name: Login to GHCR
      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Build Docker images but do not push them yet
      id: docker_build
      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
      env:
        DOCKER_BUILD_RECORD_UPLOAD: false
      with:
        file: ${{ steps.set_image_variables.outputs.distro_id }}.Dockerfile
        platforms: ${{ steps.set_image_variables.outputs.platforms }}
        push: false
        build-args: |
          BASE_IMAGE=${{ matrix.image }}
        tags: ${{ steps.get_metadata.outputs.tags }}
        labels: ${{ steps.get_metadata.outputs.labels}}
        cache-from: type=registry,ref=ghcr.io/mamba-org/micromamba-cache/stage1:${{ steps.set_image_variables.outputs.tag }}
        cache-to: type=registry,ref=ghcr.io/mamba-org/micromamba-cache/stage1:${{ steps.set_image_variables.outputs.tag }},mode=max
    - name: Run tests
      env:
        IMAGE: ${{ matrix.image }}
      run: nox -s "image_tests(base_image='${IMAGE}')"
    - name: Push stage1 Docker images
      id: docker_stage1_push
      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
      with:
        file: ${{ steps.set_image_variables.outputs.distro_id }}.Dockerfile
        target: stage1
        platforms: ${{ steps.set_image_variables.outputs.platforms }}
        push: true
        build-args: |
          BASE_IMAGE=${{ matrix.image }}
        tags: ${{ steps.get_stage1_metadata.outputs.tags }}
        labels: ${{ steps.get_stage1_metadata.outputs.labels}}
        cache-from: |
          type=registry,ref=ghcr.io/mamba-org/micromaba-cache/stage1:${{ steps.set_image_variables.outputs.tag }}
        cache-to: type=inline
    - name: Push Docker images
      id: docker_push
      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
      env:
        DOCKER_BUILD_RECORD_UPLOAD: false
      with:
        file: ${{ steps.set_image_variables.outputs.distro_id }}.Dockerfile
        platforms: ${{ steps.set_image_variables.outputs.platforms }}
        push: true
        build-args: |
          BASE_IMAGE=${{ matrix.image }}
        tags: ${{ steps.get_metadata.outputs.tags }}
        labels: ${{ steps.get_metadata.outputs.labels}}
        cache-from: type=registry,ref=ghcr.io/mamba-org/micromamba-cache/cache:${{ steps.set_image_variables.outputs.tag }}
        cache-to: type=registry,ref=ghcr.io/mamba-org/micromamba-cache/cache:${{ steps.set_image_variables.outputs.tag }},mode=max
    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
      with:
        name: ${{ steps.set_image_variables.outputs.tag }}.metadata
        path: ${{ steps.get_metadata.outputs.bake-file }}
    - name: Image digest
      env:
        DIGEST: ${{ steps.docker_build.outputs.digest }}
      run: echo "${DIGEST}"
  update_dockerhub_discription:
    if: github.repository == 'mamba-org/micromamba-docker'
    needs: build_docker_image_and_push
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout source
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      with:
        persist-credentials: false
    - name: Get artifacts
      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
      with:
        path: artifacts
        pattern: '*.metadata'
    - name: Format tags
      id: format_tags
      run: |
        function process_tags {
          distro_id="$(jq  -r '.target."docker-metadata-action".labels["distro_id"]' "$1")"
          printf '* '
          jq  -r '.target."docker-metadata-action".tags[]' "$1" \
          | grep -v 'ghcr.io' \
          | sed 's%^mambaorg/micromamba:\(.*\)$%`\1`, %' \
          | tr -d '\n' \
          | sed 's%, $%%' \
          | sed "s%^\(.*\)%[\1](https://github.com/mamba-org/micromamba-docker/blob/main/${distro_id}.Dockerfile)%"
          printf '\n\n'
        }
        function get_tags_markdown {
          local latest
          # want 'latest' image to be listed first
          latest="$(grep -Rl ':latest"' */*/*.json)"
          process_tags "${latest}"
          find . -name docker-metadata-action-bake.json \
          | grep -v "${latest}" \
          | while read file; do process_tags "$file"; done
        }
        echo "TAGS_MARKDOWN<<EOF" >> $GITHUB_ENV
        echo "## Recent Tags" >> $GITHUB_ENV
        echo "" >> $GITHUB_ENV
        get_tags_markdown >> $GITHUB_ENV
        echo "EOF" >> $GITHUB_ENV
    - name: generate README_with_tags.md
      run: |
        awk -v r='${TAGS_MARKDOWN}' \
            '{gsub(/<!-- DOCKER_TAGS_INSERTION_POINT -->/,r)}1' \
            README.md > README_with_tags.md
    - name: Copy GitHub README.md to Dockerhub
      uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
        repository: mambaorg/micromamba
        readme-filepath: ./README_with_tags.md
  tag_and_release:
    if: github.repository == 'mamba-org/micromamba-docker'
    needs: build_docker_image_and_push
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
    - name: Checkout source
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      with:
        persist-credentials: false
    - name: Get micromamba version number
      id: get_version
      run: |
        echo "version=$(grep '^ARG VERSION=' debian.Dockerfile  | cut -d= -f2)" >> $GITHUB_OUTPUT
        echo "leading_v_version=v$(grep '^ARG VERSION=' debian.Dockerfile  | cut -d= -f2)" >> $GITHUB_OUTPUT
    - name: Get current date
      id: date
      run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
    - name: Get last tag
      id: last_tag
      uses: mathieudutour/github-tag-action@a22cf08638b34d5badda920f9daf6e72c477b07b
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        dry_run: true
    - name: Create git tag
      if: steps.last_tag.outputs.previous_tag != steps.get_version.outputs.leading_v_version
      id: create_tag
      uses: mathieudutour/github-tag-action@a22cf08638b34d5badda920f9daf6e72c477b07b
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        custom_tag: ${{ steps.get_version.outputs.version }}
        create_annotated_tag: true
    - name: Create a GitHub release
      if: steps.last_tag.outputs.previous_tag != steps.get_version.outputs.leading_v_version
      uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b
      with:
        tag: ${{ steps.create_tag.outputs.new_tag }}
        name: micromamba ${{ steps.create_tag.outputs.new_tag }}
        body: |
          micromamba ${{ steps.create_tag.outputs.new_tag }} - ${{ steps.date.outputs.date }}

          See [release notes for mamba/libmamba/micromamba](https://github.com/mamba-org/mamba/releases) for non-docker changes.

          Changes to docker image:
          - micromamba updated to ${{ steps.create_tag.outputs.new_tag }}
          - If this line exists, then these releases notes still need to be manually updated.