build.yaml

name: Build and Publish
env:
  CONTAINER_ARCHS: linux/amd64,linux/arm64
on:
  push:
    branches:
      - main
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
  release:
    types:
      - published
jobs:
  version:
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: "${{ github.event.release.tag_name}}"
    outputs:
      VERSION: "${{ steps.info.outputs.VERSION }}"
      SHA_TAG: "${{ steps.info.outputs.SHA }}"
      SERVER_TARGET: "${{ github.event_name == 'release' && 'server' || 'server-debug' }}"
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v3
      - name: Validate releases are on main (reviewed) branch
        if: github.event_name == 'release'
        run: |
          git fetch origin main:main
          git fetch --all --tags --force
          if ! git merge-base --is-ancestor "$RELEASE_TAG" main; then
            echo "# Invalid release tag [$RELEASE_TAG] - must be on main" >> $GITHUB_STEP_SUMMARY
            exit 1
          fi
      - run: |-
          echo "VERSION=$(cat VERSION)" >> $GITHUB_OUTPUT
          echo "SHA=sha-$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
        id: info

  ci:
    needs:
      - version
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Build and test
        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: "${{ env.CONTAINER_ARCHS }}"
          push: false
          target: tester

  build-and-push:
    needs:
      - ci
      - version
    if: github.event.release
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: "${{ env.CONTAINER_ARCHS }}"
          push: true
          tags: ghcr.io/opentdf/gokas:${{ needs.version.outputs.VERSION }}