build.yaml

name: Build

on:
  pull_request_target:
    branches:
      - master
  push:
    branches:
      - master

jobs:
  configure:
    name: Configure
    runs-on: ubuntu-22.04
    timeout-minutes: 4
    outputs:
      commit-sha: ${{ env.COMMIT_SHA }}
    steps:
      - name: Evaluate commit
        run: |
          if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
              echo "PR is #${{ github.event.number }}..."
              echo "PR Head SHA is ${{ github.event.pull_request.head.sha }}..."
              echo "COMMIT_SHA=${{ github.event.pull_request.head.sha }}" >> $GITHUB_ENV
          else
              echo "Head SHA is ${{ github.sha }}..."
              echo "COMMIT_SHA=${{ github.sha }}" >> $GITHUB_ENV
          fi
  check:
    name: Check
    runs-on: ubuntu-22.04
    needs:
      - configure
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.configure.outputs.commit-sha }}
      - name: Setup Node.js
        uses: abinnovision/actions@setup-node-v1
      - name: Install dependencies
        run: yarn install --immutable
      - name: Check
        run: yarn run check
      - name: Check Dependencies
        run: |
          yarn dedupe
          git diff --exit-code --quiet yarn.lock || (echo "yarn.lock is not up to date, run 'yarn dedupe'" && exit 1)
  build_test:
    name: Build & Test
    runs-on: ubuntu-22.04
    needs:
      - configure
      - check
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.configure.outputs.commit-sha }}
      - name: Setup Node.js
        uses: abinnovision/actions@setup-node-v1
      - name: Install dependencies
        run: yarn install --immutable
      - name: Build
        run: yarn build
      - name: Test
        run: yarn run test
  release:
    name: Release
    uses: abinnovision/workflows/.github/workflows/release-please.yaml@master
    secrets: inherit
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    with:
      default-branch: master
    needs:
      - configure
  build-image:
    name: Build Image
    runs-on: ubuntu-22.04
    needs:
      - configure
      - build_test
      - release
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    env:
      DOCKER_REGISTRY: ghcr.io
    permissions:
      contents: "read"
      packages: "write"
      id-token: "write"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.configure.outputs.commit-sha }}
      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Build image name
        run: |
          REPOSITORY_NAME_SANITIZED=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]');
          echo "DOCKER_IMAGE_NAME=ghcr.io/$REPOSITORY_NAME_SANITIZED" >> $GITHUB_ENV
      - name: Extract version
        run: |
          echo PKG_VERSION=$(cat package.json | jq -r ".version") >> $GITHUB_ENV
      - name: Extract Metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.DOCKER_IMAGE_NAME }}
          tags: |
            type=sha,enable=true
            # Version tag is only needed for released versions.
            type=semver,pattern={{version}},value=v${{ env.PKG_VERSION }},enable=${{ contains(fromJSON(needs.release.outputs.paths_released), '.') }}

      # Extract metadata for Docker Hub.
      # This is only needed for releases.
      - name: Extract Metadata for Docker Hub
        id: meta-dockerhub
        uses: docker/metadata-action@v5
        with:
          images: abinnovision/github-workflow-dispatch-proxy
          tags: |
            type=semver,pattern={{version}},value=v${{ env.PKG_VERSION }},enable=${{ contains(fromJSON(needs.release.outputs.paths_released), '.') }}

      - name: Container Registry Auth
        uses: docker/login-action@v3
        with:
          registry: ${{ env.DOCKER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Login to Docker Hub only if a release is published.
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        if: contains(fromJSON(needs.release.outputs.paths_released), '.')
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build image
        uses: docker/build-push-action@v4
        with:
          context: "."
          push: true
          file: Dockerfile
          labels: ${{ steps.meta.outputs.labels }}
          tags: |
            ${{ steps.meta.outputs.tags }}
            ${{ steps.meta-dockerhub.outputs.tags }}
          secrets: |
            NPM_ABINNOVISION_AUTH_TOKEN=${{ github.token }}
  cleanup-registry:
    name: Cleanup Registry
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    permissions:
      contents: "read"
      packages: "write"
    needs:
      - build-image
    steps:
      - name: Prepare
        run: |
          echo "PACKAGE_NAME=$(echo "${GITHUB_REPOSITORY#*/}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
      - name: Cleanup non-release images
        uses: snok/container-retention-policy@v3.0.0
        with:
          account: abinnovision
          token: ${{ secrets.GITHUB_TOKEN }}
          image-names: ${{ env.PACKAGE_NAME }}
          cut-off: 1w
          keep-n-most-recent: 2
          image-tags: "sha-*"
      - name: Cleanup untagged images
        uses: snok/container-retention-policy@v3.0.0
        with:
          account: abinnovision
          token: ${{ secrets.GITHUB_TOKEN }}
          image-names: ${{ env.PACKAGE_NAME }}
          keep-n-most-recent: 0
          tag-selection: "untagged"
          cut-off: "1d"