docker-image.yml

# Build & publish the toolchain image (JDK17 + SDK + NDK + OpenSSL 3.x statics for
# all ABIs) to GHCR, so android.yml/codeql.yml pull a ready image instead of
# recompiling OpenSSL (~10-20 min) every run. First publish is private even for a
# public repo — set the package visibility to public once in repo Packages settings.
name: Toolchain image

on:
  push:
    branches: [master]
    paths: ['docker/**', '.github/workflows/docker-image.yml']
  # Build (without publishing) when a PR touches the recipe, so a broken OpenSSL
  # build fails the PR instead of the next master push.
  pull_request:
    paths: ['docker/**', '.github/workflows/docker-image.yml']
  schedule:
    - cron: "23 5 * * 1"          # weekly: pick up OpenSSL patch releases
  workflow_dispatch:

permissions:
  contents: read
  packages: write

concurrency:
  group: image-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-push:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: docker/login-action@v4
        if: github.event_name != 'pull_request'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v7
        with:
          context: docker
          push: ${{ github.event_name != 'pull_request' }}
          tags: |
            ghcr.io/xroche/httrack-android-build:latest
            ghcr.io/xroche/httrack-android-build:${{ github.sha }}
      - name: Extract OpenSSL statics (for the container-less emulator job)
        if: github.event_name != 'pull_request'
        run: |
          id=$(docker create ghcr.io/xroche/httrack-android-build:latest)
          docker cp "$id":/opt/openssl-android ./openssl-android
          docker rm "$id"
      - uses: actions/upload-artifact@v7
        if: github.event_name != 'pull_request'
        with:
          name: openssl-android-statics
          path: openssl-android