name: Studio Docker Build
on:
  push:
    branches: [master]
  pull_request:

# Cancel old builds on new commit for same workflow + branch/PR
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: write
  pull-requests: write

jobs:
  build:
    name: 'Studio Docker Build'
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          # On push events paths-filter diffs against github.event.before with
          # local git; without enough history it falls back to a git fetch that
          # fails unauthenticated (persist-credentials is false).
          fetch-depth: 50
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          filters: |
            studio:
              - 'packages/pg-meta/**'
              - 'apps/studio/**'
              - 'apps/ui-library/**'
              - 'apps/design-system/**'
              - 'e2e/studio/**'
              - 'pnpm-lock.yaml'
              - '.github/workflows/studio-e2e-test.yml'
      - name: Build
        if: steps.filter.outputs.studio == 'true'
        run: docker build . -f apps/studio/Dockerfile --target production -t supabase-studio:local --build-arg NEXT_PUBLIC_STUDIO_AUTH_MODE=supabase --no-cache
      # Reuses the shared stages (deps/dev) from the first build's layer
      # cache; only the tanstack build/runtime stages run fresh.
      - name: Build (tanstack)
        if: steps.filter.outputs.studio == 'true'
        run: docker build . -f apps/studio/Dockerfile --target production -t supabase-studio:local-tanstack --build-arg NEXT_PUBLIC_STUDIO_AUTH_MODE=supabase --build-arg STUDIO_FRAMEWORK=tanstack