.github/workflows/build-docker.yml

@@ -0,0 +1,122 @@
+name: Build docker image
+
+on:
+  release:
+    types:
+      - published
+
+permissions:
+  contents: read
+
+jobs:
+  pre_job:
+    permissions:
+      actions: write
+    runs-on: ubuntu-latest
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - id: skip_check
+        uses: fkirc/skip-duplicate-actions@v5.3.1
+        with:
+          concurrent_skipping: always
+          cancel_others: true
+          do_not_skip: '["release"]'
+          # list files that may affect or are included into the built phar
+          paths: '["bin/**", "assets/**", "build/**", "dictionaries/**", "src/**", "stubs/**", "psalm", "psalm-language-server", "psalm-plugin", "psalm-refactor", "psalm-review", "psalter", "box.json.dist", "composer.json", "config.xsd", "keys.asc.gpg", "scoper.inc.php"]'
+
+  build-docker:
+    permissions:
+      packages: write
+    needs: pre_job
+    if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
+    runs-on: ${{ matrix.image }}
+    strategy:
+      matrix:
+        image:
+          - ubuntu-latest
+          - ubuntu-24.04-arm
+    steps:
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          tools: composer:v2
+          coverage: none
+        env:
+          fail-fast: true
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # required for composer to automatically detect root package version
+
+      - name: Get Composer Cache Directories
+        id: composer-cache
+        run: |
+          echo "files_cache=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+          echo "vcs_cache=$(composer config cache-vcs-dir)" >> $GITHUB_OUTPUT
+
+      - name: Generate composer.lock
+        run: |
+          composer update --no-install
+
+      - name: Cache composer cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ${{ steps.composer-cache.outputs.files_cache }}
+            ${{ steps.composer-cache.outputs.vcs_cache }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-composer-
+
+      - name: Run composer install
+        run: composer install -o
+          # DO NOT set this, we need composer to figure out the version itself
+          # env:
+          #   COMPOSER_ROOT_VERSION: dev-master
+
+      # https://github.com/docker/setup-buildx-action
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Upload docker image
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REF: ${{ github.ref }}
+          ACTOR: ${{ github.repository_owner }}
+          PLATFORM: ${{ matrix.image }}
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin
+          php bin/ci/build-docker.php
+
+  merge-docker:
+    permissions:
+      packages: write
+    needs: build-docker
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          tools: composer:v2
+          coverage: none
+        env:
+          fail-fast: true
+
+      - uses: actions/checkout@v4
+
+      - name: Upload final docker image
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REF: ${{ github.ref }}
+          ACTOR: ${{ github.repository_owner }}
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin
+          php bin/ci/push-docker.php

bin/ci/build-docker.php

@@ -0,0 +1,54 @@
+<?php // phpcs:disable PSR1.Files.SideEffects.FoundWithSymbols, Generic.Files.LineLength.TooLong
+
+
+declare(strict_types=1);
+
+$platform = match (getenv('PLATFORM')) {
+    'ubuntu-24.04-arm' => 'arm64',
+    'ubuntu-latest' => 'amd64',
+};
+
+$commit = getenv('GITHUB_SHA');
+$user = getenv('ACTOR');
+$ref = substr(getenv('REF'), strlen('refs/heads/'));
+$is_tag = getenv('EVENT_NAME') === 'release';
+
+echo "Waiting for commit $commit on $ref...".PHP_EOL;
+
+function r(string $cmd): void
+{
+    echo "> $cmd\n";
+    passthru($cmd, $exit);
+    if ($exit) {
+        exit($exit);
+    }
+}
+
+$composer_branch = $is_tag ? $ref : "$ref-dev";
+if ($composer_branch === 'master-dev') {
+    $composer_branch = 'dev-master';
+}
+$dev = $is_tag ? '' : '~dev';
+
+if ($is_tag) {
+    $cur = 0;
+    while (true) {
+        $json = json_decode(file_get_contents("https://repo.packagist.org/p2/vimeo/psalm$dev.json?v=$cur"), true)["packages"]["vimeo/psalm"];
+        foreach ($json as $v) {
+            if ($v['version'] === $composer_branch) {
+                if ($v['source']['reference'] === $commit) {
+                    break 2;
+                }
+                break;
+            }
+        }
+        sleep(1);
+        $cur++;
+    }
+}
+
+$ref = escapeshellarg($ref);
+$composer_branch = escapeshellarg($composer_branch);
+$platform = escapeshellarg($platform);
+
+r("docker buildx build --push . -t ghcr.io/$user/psalm:$ref-$platform --build-arg PSALM_REV=$composer_branch -f bin/docker/Dockerfile");

bin/ci/push-docker.php

@@ -0,0 +1,30 @@
+<?php // phpcs:disable PSR1.Files.SideEffects.FoundWithSymbols, Generic.Files.LineLength.TooLong
+
+
+declare(strict_types=1);
+
+function r(string $cmd): void
+{
+    echo "> $cmd\n";
+    passthru($cmd, $exit);
+    if ($exit) {
+        exit($exit);
+    }
+}
+
+$user = getenv('ACTOR');
+$ref = substr(getenv('REF'), strlen('refs/heads/'));
+$is_tag = getenv('EVENT_NAME') === 'release';
+
+$ref = escapeshellarg($ref);
+
+r("docker pull ghcr.io/$user/psalm:$ref-arm64 --platform arm64");
+r("docker pull ghcr.io/$user/psalm:$ref-amd64 --platform amd64");
+
+r("docker buildx imagetools create -t ghcr.io/$user/psalm:$ref ghcr.io/$user/psalm:$ref-arm64 ghcr.io/$user/psalm:$ref-amd64");
+r("docker pull ghcr.io/$user/psalm:$ref");
+
+if ($is_tag) {
+    r("docker tag ghcr.io/$user/psalm:$ref ghcr.io/$user/psalm:latest");
+    r("docker push ghcr.io/$user/psalm:latest");
+}