_container.yml

name: Build and publish container
on:
  workflow_call:
    inputs:
      publish:
        type: boolean
        description: If true, pushes image to container registry

jobs:
  build_container:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          # Need this to get version number from last tag
          fetch-depth: 0
      - name: Validate SemVer2 version compliance
        if: startsWith(github.ref, 'refs/tags/')
        env:
          SEMVER_REGEX: ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$

        run: |
          ref="${{ github.ref_name }}"
          my_regex="${{env.SEMVER_REGEX}}"
          if [[ "$ref" =~ $my_regex ]]; then
            echo "SemVer compliant version: $ref"
          else
            echo "Invalid SemVer version: $ref"
            exit 1
          fi
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3

      - name: Log in to GitHub Docker Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and export to Docker local cache
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
        env:
          DOCKER_BUILD_RECORD_UPLOAD: false
        with:
          context: .
          # Need load and tags so we can test it below
          load: true
          tags: tag_for_testing

      - name: Test cli works in cached runtime image
        run: docker run --rm tag_for_testing --version

      - name: Create tags for publishing image
        id: meta
        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=tag
            type=raw,value=latest

      - name: Push cached image to container registry
        if: github.ref_type == 'tag'
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
        env:
          DOCKER_BUILD_RECORD_UPLOAD: false
        # This does not build the image again, it will find the image in the
        # Docker cache and publish it
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  helm_publish:
    name: publish gcr
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    environment: prod
    needs: build_container
    steps:
      - name: checkout repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: install helm
        uses: Azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
        id: install

      - name: login to gcr using helm
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io --username ${{ github.repository_owner }} --password-stdin
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@418e4b98bf2841bd337d0b24fe63cb36dc8afa55
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=tag

      - name: package chart and push it
        env:
          REPO: ${{ github.repository_owner }}
        run: |
          helm dependencies update helm/blueapi
          helm package helm/blueapi --version ${GITHUB_REF##*/} --app-version ${GITHUB_REF##*/} -d /tmp/
          helm push /tmp/blueapi-${GITHUB_REF##*/}.tgz oci://ghcr.io/${REPO@L}/charts