push-env.yml

name: Push Image for Environment

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
      repo:
        type: string
        required: true
      create_sentry_release:
        type: boolean
        required: false
        default: true
      push_rolling:
        type: boolean
        default: false
        description: "Whether to push the rolling image"
      push_release:
        type: boolean
        default: false
        description: "Whether to push the release image"

env:
  AR_REPO: ${{ inputs.repo }}

jobs:
  push-environment:
    name: Push ${{ inputs.environment }} Image
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    if: github.repository_owner == 'codecov' && !inputs.push_rolling && !inputs.push_release
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Get Release SHA
        env:
          SHA: ${{ github.sha }}
        id: sha
        run: echo short_sha="${SHA:0:7}" >> $GITHUB_OUTPUT
      - name: Cache App
        id: cache-app
        uses: actions/cache@v4
        env:
          cache-name: cache-app
        with:
          path: |
            app.tar
          key: ${{ runner.os }}-${{ env.cache-name }}-${{ github.run_id }}
      - name: Load built image
        run: |
          docker load --input app.tar
      - id: "auth"
        name: "Authenticate to Google Cloud"
        uses: "google-github-actions/auth@v2.1.2"
        with:
          token_format: "access_token"
          workload_identity_provider: ${{ secrets.CODECOV_GCP_WIDP }}
          service_account: ${{ secrets.CODECOV_GCP_WIDSA }}

      - name: Docker configuration
        run: |-
          echo ${{steps.auth.outputs.access_token}} | docker login -u oauth2accesstoken --password-stdin https://us-docker.pkg.dev

      - name: Push ${{ inputs.environment }}
        run: |
          make tag.${{ inputs.environment }}
          make push.${{ inputs.environment }}
      - name: Push latest
        if: inputs.environment == 'production'
        run: |
          make tag.latest
          make push.latest

      - name: Create Sentry release
        if: inputs.create_sentry_release
        uses: getsentry/action-release@v1
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.CODECOV_SENTRY_RELEASE_TOKEN }}
          SENTRY_ORG: ${{ secrets.CODECOV_SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.CODECOV_SENTRY_PROJECT }}
        with:
          environment: ${{ inputs.environment }}
          version: ${{ inputs.environment }}-release-${{ steps.sha.outputs.short_sha }}
          ignore_missing: true
  rolling:
    name: Push Rolling Image
    if: inputs.push_rolling == true && github.repository_owner == 'codecov' && !github.event.pull_request.head.repo.fork
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Cache App
        id: cache-app
        uses: actions/cache@v4
        env:
          cache-name: cache-app
        with:
          path: |
            app.tar
          key: ${{ runner.os }}-${{ env.cache-name }}-${{ github.run_id }}
      - name: Load built image
        run: |
          docker load --input app.tar
      - name: Log in to Docker Hub
        uses: docker/login-action@v3.1.0
        with:
          username: ${{ secrets.CODECOV_DEVOPS_DOCKER_USERNAME }}
          password: ${{ secrets.CODECOV_DEVOPS_DOCKER_PASSWORD }}
      - name: Push Rolling
        run: |
          make tag.rolling
          make push.rolling
  release:
    name: Push Release Image
    if: inputs.push_release == true && github.repository_owner == 'codecov' && !github.event.pull_request.head.repo.fork
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Cache App
        id: cache-app
        uses: actions/cache@v4
        env:
          cache-name: cache-app
        with:
          path: |
            app.tar
          key: ${{ runner.os }}-${{ env.cache-name }}-${{ github.run_id }}
      - name: Load built image
        run: |
          docker load --input app.tar
      - name: Log in to Docker Hub
        uses: docker/login-action@v3.1.0
        with:
          username: ${{ secrets.CODECOV_DEVOPS_DOCKER_USERNAME }}
          password: ${{ secrets.CODECOV_DEVOPS_DOCKER_PASSWORD }}
      - name: Push release
        run: |
          make tag.release
          make push.release