publish-image.yml

name: Publish Image

on:
  push:
    branches: [staging, master]
  workflow_call:
    inputs:
      sha:
        description: The commit SHA to run the workflow on
        required: false
        type: string
    secrets:
      sentry_auth_token:
        description: The Sentry integration's token
        required: true
  workflow_dispatch:

env:
  PROJECT_NAME: amber-api

jobs:
  metadata:
    name: Metadata
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.get_metadata.outputs.tag }}
      build_args: ${{ steps.get_metadata.outputs.build_args }}
    steps:
      - name: Get metadata
        id: get_metadata
        env:
          INPUT_SHA: ${{ inputs.sha }}
        run: |
          if [ "$GITHUB_REF_NAME" = 'master' ]; then
            echo 'tag=latest' >> "$GITHUB_OUTPUT"
          else
            echo 'tag='"$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
          fi

          if [ "$GITHUB_REF_NAME" = 'staging' ] || [ "$GITHUB_REF_NAME" = 'master' ]; then
            BUILD_ARGS='BUILD_HASH='${INPUT_SHA:-$GITHUB_SHA}
            echo 'build_args='"$BUILD_ARGS" >> "$GITHUB_OUTPUT"
          fi

  publish:
    name: Publish
    runs-on: ubuntu-latest
    needs: metadata
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.sha }}
          fetch-depth: 0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ vars.DOCKER_REGISTRY_URL }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
        with:
          push: true
          context: .
          build-args: ${{ needs.metadata.outputs.build_args }}
          cache-from: type=gha,scope=main
          cache-to: type=gha,scope=main
          tags: |
            ${{ vars.DOCKER_REGISTRY_URL }}/${{ github.repository_owner }}/${{ env.PROJECT_NAME }}:${{
            needs.metadata.outputs.tag }}

      - name: Create Sentry release
        if: ${{ !(github.event_name == 'workflow_dispatch' && github.workflow == 'Publish Image') }}
        uses: getsentry/action-release@e769183448303de84c5a06aaaddf9da7be26d6c7 # v1.7.0
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ vars.SENTRY_ORG_NAME }}
          SENTRY_PROJECT: ${{ env.PROJECT_NAME }}
        with:
          finalize: false
          version: ${{ inputs.sha }}

  update_check_run:
    name: Update Check Run
    runs-on: ubuntu-latest
    needs: [metadata, publish]
    if: github.event_name == 'workflow_dispatch' && github.workflow == 'Publish Image' && always()
    steps:
      - name: Get conclusion
        id: get_conclusion
        env:
          RESULTS: ${{ join(needs.*.result, ' ') }}
        run: |
          echo 'conclusion=success' >> "$GITHUB_OUTPUT"
          for RESULT in $RESULTS; do
            if [ "$RESULT" = 'cancelled' ] || [ "$RESULT" = 'failure' ]; then
              echo 'conclusion='"$RESULT" >> "$GITHUB_OUTPUT"
              break
            fi
          done

      - name: Update Publish Image check run
        uses: guidojw/actions/update-check-run@ec8c080252c6b8903a4431211b78c543609f5f89 # v1.4.6
        with:
          app_id: ${{ vars.GH_APP_ID }}
          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          name: Publish Image
          conclusion: ${{ steps.get_conclusion.outputs.conclusion }}
          details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}