EvoFirewall/deploy/docker/docker-bake.hcl

# Единая сборка образа EvoFirewall (buildx bake: -f deploy/docker/docker-bake.hcl).
# context = "../.." — корень репо. Bake резолвит context от cwd (не от HCL),
# поэтому вызов из deploy/docker/ либо BUILDX_BAKE_FILE_RELATIVE_PATHS=1.

variable "REGISTRY" {
  default = "git.shx.one/denozord"
}

variable "IMAGE_TAG" {
  default = "latest"
}

variable "SHORT_SHA" {
  default = "dev"
}

variable "SHA_FULL" {
  default = ""
}

variable "VERSION" {
  default = "dev"
}

variable "BUILD_TIME" {
  default = ""
}

variable "CACHE_REF_NODE" {
  default = ""
}

variable "BASE_NODE" {
  default = "docker.io/library/node:22-alpine"
}

function "node-cache-from" {
  params = []
  result = notequal("", CACHE_REF_NODE) ? ["type=registry,ref=${CACHE_REF_NODE}"] : []
}

# Экспорт кэша — один writer на ref (параллельный cache-to в один ref ломает manifest).
function "node-cache-to-export" {
  params = []
  result = notequal("", CACHE_REF_NODE) ? ["type=registry,ref=${CACHE_REF_NODE},mode=max"] : []
}

function "image-tags" {
  params = [name]
  result = concat(
    notequal("", SHA_FULL) ? [
      "${REGISTRY}/${name}:${IMAGE_TAG}",
      "${REGISTRY}/${name}:${SHORT_SHA}",
      "${REGISTRY}/${name}:sha-${SHA_FULL}",
    ] : [
      "${REGISTRY}/${name}:${IMAGE_TAG}",
      "${REGISTRY}/${name}:${SHORT_SHA}",
    ],
    notequal(VERSION, "dev") && notequal(VERSION, "") ? [
      "${REGISTRY}/${name}:v${VERSION}",
      "${REGISTRY}/${name}:${VERSION}",
    ] : []
  )
}

group "default" {
  targets = ["evofw"]
}

target "_common" {
  platforms = ["linux/amd64"]
  pull      = false
}

target "evofw" {
  inherits   = ["_common"]
  context    = "../.."
  dockerfile = "deploy/docker/evofw/Dockerfile"
  target     = "runtime"
  args = {
    BASE_NODE  = BASE_NODE
    VERSION    = VERSION
    GIT_SHA    = notequal("", SHA_FULL) ? SHA_FULL : SHORT_SHA
    BUILD_TIME = BUILD_TIME
  }
  cache-from = node-cache-from()
  cache-to   = node-cache-to-export()
  tags       = concat(image-tags("evofw"), image-tags("evofirewall"))
}