Build and publish a Docker image

.dockerignore

@@ -0,0 +1,7 @@
+.git
+.github
+target/
+tmp/
+tinql/docs/book/
+Dockerfile
+.dockerignore

.github/workflows/docker.yml

@@ -0,0 +1,154 @@
+name: CI
+
+on:
+  push:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  IMAGE: planetscale/lead
+  DOCKERHUB_OIDC_CONNECTIONID: 00074362-4196-4eb3-91cd-8b07dfdd71c7
+
+jobs:
+  build-and-test:
+    name: ${{ matrix.arch.name }} / PostgreSQL ${{ matrix.postgres }}
+    runs-on: ${{ matrix.arch.runner }}
+    permissions:
+      contents: read
+      id-token: write
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - name: x86-64
+            runner: ubuntu-24.04
+            docker: amd64
+          - name: arm64
+            runner: ubuntu-24.04-arm
+            docker: arm64
+        postgres: [17, 18]
+
+    env:
+      CARGO_TERM_COLOR: always
+      RUST_BACKTRACE: 1
+      PG_MAJOR: ${{ matrix.postgres }}
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+
+      - name: Build builder image
+        run: docker build --target builder --build-arg "PG_MAJOR=${PG_MAJOR}" --tag lead-builder .
+
+      - name: Build
+        run: |
+          docker/in-builder lead-builder "$RUNNER_TEMP/work" \
+            cargo build --locked --package tin --no-default-features --features "pg${PG_MAJOR}"
+
+      - name: Clippy
+        run: |
+          docker/in-builder lead-builder "$RUNNER_TEMP/work" \
+            cargo clippy --locked --workspace --all-targets --no-default-features \
+              --features "pg${PG_MAJOR} pg_test" -- -D warnings
+
+      - name: Test local suite
+        run: |
+          docker/in-builder lead-builder "$RUNNER_TEMP/work" \
+            cargo pgrx test "pg${PG_MAJOR}" --package tin --no-default-features --features "pg${PG_MAJOR}"
+
+      - name: Package extension
+        run: |
+          docker/in-builder lead-builder "$RUNNER_TEMP/work" \
+            cargo pgrx package --debug --package tin --no-default-features --features "pg${PG_MAJOR}" \
+              --pg-config "/usr/lib/postgresql/${PG_MAJOR}/bin/pg_config" --out-dir /out
+
+      - name: Build image
+        run: |
+          docker build --build-arg "PG_MAJOR=${PG_MAJOR}" \
+            --build-context "artifacts=$RUNNER_TEMP/work/out" --tag "lead:pg${PG_MAJOR}" .
+
+      - name: Smoke test image
+        run: |
+          docker run --detach --name lead --env POSTGRES_PASSWORD=postgres "lead:pg${PG_MAJOR}"
+          for _ in $(seq 60); do
+            if docker exec lead pg_isready --username postgres --host 127.0.0.1; then
+              break
+            fi
+            sleep 1
+          done
+          docker exec lead pg_isready --username postgres --host 127.0.0.1
+          test "$(docker exec lead psql --username postgres --no-psqlrc --tuples-only --no-align \
+            --command "SELECT extname FROM pg_extension WHERE extname = 'tin'")" = tin
+          test "$(docker exec lead psql --username postgres --no-psqlrc --tuples-only --no-align \
+            --command "SELECT 'hello world' ==> 'hello'")" = t
+
+      - name: Show container logs
+        if: failure()
+        run: docker logs lead || true
+
+      - name: Log in to Docker Hub
+        if: github.ref == 'refs/heads/main'
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: planetscale
+
+      - name: Push image
+        if: github.ref == 'refs/heads/main'
+        env:
+          ARCH: ${{ matrix.arch.docker }}
+        run: |
+          docker tag "lead:pg${PG_MAJOR}" "${IMAGE}:${GITHUB_SHA::12}-pg${PG_MAJOR}-${ARCH}"
+          docker push "${IMAGE}:${GITHUB_SHA::12}-pg${PG_MAJOR}-${ARCH}"
+
+  manifest:
+    name: Manifest / PostgreSQL ${{ matrix.postgres }}
+    if: github.ref == 'refs/heads/main'
+    needs: build-and-test
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        postgres: [17, 18]
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+
+      - name: Determine version
+        id: version
+        run: |
+          version="$(sed -n '/^\[workspace.package\]/,/^\[/s/^version = "\(.*\)"/\1/p' Cargo.toml)"
+          test -n "$version"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: planetscale
+
+      - name: Create multi-arch manifest
+        env:
+          PG_MAJOR: ${{ matrix.postgres }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          tags=(
+            --tag "${IMAGE}:${GITHUB_SHA::12}-pg${PG_MAJOR}"
+            --tag "${IMAGE}:${VERSION}-pg${PG_MAJOR}"
+            --tag "${IMAGE}:pg${PG_MAJOR}"
+          )
+          if [[ "$PG_MAJOR" == 18 ]]; then
+            tags+=(--tag "${IMAGE}:latest")
+          fi
+          docker buildx imagetools create "${tags[@]}" \
+            "${IMAGE}:${GITHUB_SHA::12}-pg${PG_MAJOR}-amd64" \
+            "${IMAGE}:${GITHUB_SHA::12}-pg${PG_MAJOR}-arm64"