Build PR Docker Image workflow (stevezau/media_preview_generator)

name: Build PR Docker Image
 
on:
  pull_request_target:
    types: [labeled, synchronize, reopened]
    branches: [main, dev]
    paths-ignore:
      - 'docs/**'
      - '*.md'
      - 'LICENSE'
      - '.github/instructions/**'
      - '.github/prompts/**'
      - 'unraid-templates/**'
      - 'docker-compose.example.yml'
 
env:
  REGISTRY: ghcr.io
 
concurrency:
  group: docker-pr-${{ github.event.pull_request.number }}
  cancel-in-progress: true
 
jobs:
  build:
    timeout-minutes: 30
    # Gate: only run when the `build-docker` label is present.
    # - For `labeled` events, check the label that was just added.
    # - For `synchronize`/`reopened` events, check the PR's current label set.
    # This is the standard mitigation for `pull_request_target` running fork code:
    # a maintainer must review the diff and apply the label before any build runs.
    if: >-
      (github.event.action == 'labeled' && github.event.label.name == 'build-docker') ||
      ((github.event.action == 'synchronize' || github.event.action == 'reopened') &&
       contains(github.event.pull_request.labels.*.name, 'build-docker'))
    runs-on: latchkey-small
    permissions:
      contents: read
      packages: write
      pull-requests: write
    steps:
      - name: Checkout PR head
        uses: actions/checkout@v4
        with:
          # CRITICAL: pull_request_target defaults to the base branch. We must
          # explicitly check out the PR head SHA to actually build the contributor's code.
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0  # Full history for setuptools-scm versioning
 
      - name: Compute lowercase image name
        id: img
        run: echo "name=${REPO,,}" >> "$GITHUB_OUTPUT"
        env:
          REPO: ${{ github.repository }}
 
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
 
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
 
      - name: Build and push PR image
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64
          push: true
          tags: ${{ env.REGISTRY }}/${{ steps.img.outputs.name }}:pr-${{ github.event.pull_request.number }}
          build-args: |
            GIT_BRANCH=pr-${{ github.event.pull_request.number }}
            GIT_SHA=${{ github.event.pull_request.head.sha }}
          cache-from: type=gha,scope=pr-${{ github.event.pull_request.number }}
          cache-to: type=gha,scope=pr-${{ github.event.pull_request.number }},mode=max
 
      - name: Post/update sticky PR comment
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          header: pr-docker-image
          message: |
            ## PR Docker image ready
 
            ```bash
            docker pull ${{ env.REGISTRY }}/${{ steps.img.outputs.name }}:pr-${{ github.event.pull_request.number }}
            ```
 
            - Tag: `pr-${{ github.event.pull_request.number }}` - **overwritten in place** on every commit to this PR, so always pulling this tag gets the latest head.
            - Built from commit: `${{ github.event.pull_request.head.sha }}`
            - Platform: `linux/amd64`
            - Image is automatically deleted when this PR is closed.