ci.yml

name: ci

on:
  push:
    paths:
      - '**/Dockerfile'
      - '**/toolsets/*.json'
  pull_request:
    paths:
      - '**/Dockerfile'
      - '**/toolsets/*.json'
      - '**/.github/workflows/ci.yml'

permissions:
  contents: read
  packages: write
  pull-requests: write

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - from-version: '22.04'
            from-version-major: '22'
            from-version-minor: '04'
            distro: 'ubuntu'
            codename: 'jammy'
            from-flavor: 'act'
          - from-version: '20.04'
            from-version-major: '20'
            from-version-minor: '04'
            distro: 'ubuntu'
            codename: 'focal'
            from-flavor: 'act'
    env:
      REGISTRY: docker.io
      IMAGE_NAME: ${{ format('{0}-{1}', matrix.distro, matrix.from-flavor) }}
      IMAGE_REPOSITORY: ${{ format('{0}/{1}', github.repository_owner, format('{0}-{1}', matrix.distro, matrix.from-flavor)) }}
      SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
      DOCKERHUB_USERNAME: ${{ github.repository_owner }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4

      - name: Free up disk space
        uses: ./.github/actions/free-space
        with:
          deleteDotnet: 'true'
          deleteAndroid: 'true'

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2.10.0
        # with:
        #   driver-opts: |
        #     image=moby/buildkit:v0.12.2
        #     network=host

      # - name: Login to GitHub Container Registry
      #   uses: docker/login-action@v2.1.0
      #   with:
      #     registry: ghcr.io
      #     username: ${{ github.repository_owner }}
      #     password: ${{ secrets.GITHUB_TOKEN }}

      # Login against a Docker registry
      # https://github.com/docker/login-action
      - name: Login to Docker Hub
        uses: docker/login-action@v2.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.DOCKERHUB_USERNAME }}
          password: ${{ env.DOCKERHUB_TOKEN }}
          logout: true

      # Extract metadata (tags, labels) for Docker
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v4.4.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          images: ${{ format('{0}/{1}', env.REGISTRY, env.IMAGE_REPOSITORY) }}
          tags: |
            type=raw,value=${{ matrix.from-version }},enable={{is_default_branch}},priority=900
            type=raw,value=${{ matrix.from-version }}-${{ github.head_ref || github.ref_name }},priority=600
            type=sha,prefix=${{ matrix.from-version }}-,format=short,enable={{is_default_branch}},priority=100
          flavor: |
            latest=${{ github.ref == format('refs/heads/{0}', 'main') && matrix.from-version == '22.04' }}
          labels: |
            org.opencontainers.image.authors=['${{ env.REPOSITORY_LINK }}','${{ github.actor }}']
            org.opencontainers.image.description=${{ github.event.repository.description }}
            org.opencontainers.image.documentation=${{ env.REPOSITORY_LINK }}
            org.opencontainers.image.revision=${{ env.SHA }}
            org.opencontainers.image.source=${{ github.repositoryUrl }}
            org.opencontainers.image.title=${{ env.IMAGE_REPOSITORY }}:${{ github.head_ref || github.ref_name }}
            org.opencontainers.image.url=${{ env.REPOSITORY_LINK }}/blob/${{ env.SHA }}/linux/${{ matrix.distro }}/Dockerfile
            org.opencontainers.image.vendor=${{ github.repository_owner }}
        env:
          REPOSITORY_LINK: https://github.com/${{ github.repository }}

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push
        id: build
        uses: docker/build-push-action@v4
        with:
          context: .
          # github-token for the repository context
          github-token: ${{ secrets.GITHUB_TOKEN }}
          file: ./linux/${{ matrix.distro }}/Dockerfile
          platforms: linux/amd64,linux/arm64
          labels: ${{ steps.meta.outputs.labels }}
          tags: ${{ steps.meta.outputs.tags }}
          build-args: |
            FROM_IMAGE=buildpack-deps
            FROM_VERSION_MAJOR=${{ matrix.from-version-major }}
            FROM_VERSION_MINOR=${{ matrix.from-version-minor }}
            FROM_FLAVOR=${{ matrix.from-flavor }}
            DISTRO=${{ matrix.distro }}
            CODENAME=${{ matrix.codename }}
          # caching to speed up the build
          cache-from: |
            type=registry,ref=${{ env.REGISTRY_IMAGE }}:${{ matrix.from-version }}-${{ github.head_ref || github.ref_name }}
            type=registry,ref=${{ env.REGISTRY_IMAGE }}:cache-${{ matrix.codename }}
          # cache exporter doesn't work with docker driver
          cache-to: |
            type=registry,ref=${{ env.REGISTRY_IMAGE }}:cache-${{ matrix.codename }},mode=max
          # this will give us some useful information about the build
          provenance: mode=max
          push: true
          # outputs: type=image,name=${{ env.REGISTRY_IMAGE }}:${{ matrix.from-version }}-${{ github.head_ref || github.ref_name }},push=true
        env:
          REGISTRY_IMAGE: ${{ format('{0}/{1}', env.REGISTRY, env.IMAGE_REPOSITORY) }}

      # vulnerability scanning to verify PRs
      - name: Docker Scout
        id: docker-scout
        continue-on-error: true
        uses: docker/scout-action@v0.23.4
        with:
          command: sbom,compare
          image: ${{ steps.meta.outputs.tags }}
          to: ${{ format('{0}/{1}:{2}', env.REGISTRY, env.IMAGE_REPOSITORY, matrix.from-version) }}
          organization: ${{ github.repository_owner }}
          ignore-unchanged: true
          only-severities: critical
          write-comment: ${{ github.actor != 'nektos/act' }}
          keep-previous-comments: true
          summary: ${{ github.actor != 'nektos/act' }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

  # ToDo: Move into a separate workflow and depend on ci and mega-linter
  approve-pr:
    name: Approve PR
    runs-on: ubuntu-latest
    needs: [build]
    if: contains(fromJson('["mauwii","dependabot[bot]"]'), github.triggering_actor) && github.event_name == 'pull_request' &&  needs.build.result == 'success'
    permissions:
      contents: read
      pull-requests: write
      actions: write
    steps:
      - name: Approve PR
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

      # # Disabling this since I enabled the auto-merge option for the repo
      # - name: Merge PR
      #   run: gh pr merge --auto --merge "$PR_URL"
      #   env:
      #     PR_URL: ${{github.event.pull_request.html_url}}
      #     GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

      # # Disabling this since github-actions-cache is currently not used
      # - name: Clean cache
      #   run: |
      #     gh extension install actions/gh-actions-cache

      #     REPO=${{ github.repository }}
      #     BRANCH=refs/heads/${{ github.head_ref }}

      #     echo "Fetching list of cache key"
      #     cacheKeysForPR=$(gh actions-cache list -R "${REPO}" -B "${BRANCH}" | cut -f 1)

      #     if [ -n "$cacheKeysForPR" ]; then
      #         ## Setting this to not fail the workflow while deleting cache keys.
      #         set +e
      #         echo "Deleting caches..."
      #         for cacheKey in $cacheKeysForPR; do
      #             gh actions-cache delete "${cacheKey}" -R "${REPO}" -B "${BRANCH}" --confirm
      #         done
      #         echo "Done"
      #         ## Restore the fail on error.
      #         set -e
      #     else
      #         echo "No cache keys found for this PR"
      #     fi
      #   env:
      #     GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}