pr-ci.yml

name: CI build and push (PR)

concurrency:
  group: ci-${{ github.run_id }}
  cancel-in-progress: true

on:
  issue_comment:
    types:
      - created

jobs:
  check-before-build:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'cryostatio' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/build_test')
    permissions:
      pull-requests: write
    steps:
    - name: Fail if needs-triage label applied 
      if: ${{ contains(github.event.issue.labels.*.name, 'needs-triage') }}
      run: exit 1
    - name: Show warning if permission is denied
      if: |
        !(github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'OWNER')
        && (!contains(github.event.issue.labels.*.name, 'safe-to-test') || github.event.issue.user.name != github.event.comment.user.name)
      uses: thollander/actions-comment-pull-request@v2
      with:
        message: |-
          You do not have permission to run the /build_test command. Please ask @cryostatio/reviewers
          to resolve the issue.
    - name: Fail if command permission is denied
      if: |
        !(github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'OWNER')
        && (!contains(github.event.issue.labels.*.name, 'safe-to-test') || github.event.issue.user.name != github.event.comment.user.name)
      run: exit 1
    - name: React to comment
      uses: actions/github-script@v4
      with:
        script: |
            const {owner, repo} = context.issue
            github.reactions.createForIssueComment({
              owner,
              repo,
              comment_id: context.payload.comment.id,
              content: "+1",
            });  

  checkout-branch: 
    runs-on: ubuntu-latest
    needs: [check-before-build]
    outputs: 
      PR_head_ref: ${{ fromJSON(steps.comment-branch.outputs.result).ref }}
      PR_head_sha: ${{ fromJSON(steps.comment-branch.outputs.result).sha }}
      PR_num: ${{ fromJSON(steps.comment-branch.outputs.result).num }}
      PR_repo: ${{ fromJSON(steps.comment-branch.outputs.result).repo }}
    permissions:
      pull-requests: read
    steps:
    - uses: actions/github-script@v4
      id: comment-branch
      with:
        script: |
          const result = await github.pulls.get ({
            owner: context.repo.owner,
            repo: context.repo.repo,
            pull_number: context.issue.number
          })
          return { repo: result.data.head.repo.full_name, num: result.data.number, sha: result.data.head.sha, ref: result.data.head.ref }

  code-analysis:
    needs: [checkout-branch]
    uses: ./.github/workflows/ci-code-analysis.yml
    with:
      checkout-repo: ${{ needs.checkout-branch.outputs.PR_repo }}
      checkout-ref: ${{ needs.checkout-branch.outputs.PR_head_ref }}
      
  build-and-test:
    needs: [code-analysis, checkout-branch]
    strategy:
      matrix:
        arch: [amd64, arm64]
    uses: ./.github/workflows/ci-build-image.yml
    with:
      build-arch: ${{ matrix.arch }}
      checkout-repo: ${{ needs.checkout-branch.outputs.PR_repo }}
      checkout-ref: ${{ needs.checkout-branch.outputs.PR_head_ref  }}
      skip-itests: ${{ matrix.arch != 'amd64' }}

  push-to-ghcr:
    runs-on: ubuntu-latest
    needs: [build-and-test, checkout-branch]
    strategy:
      matrix:
        arch: [amd64, arm64]
    outputs: 
      amd64_image: ${{ steps.amd64_image.outputs.image }}
      arm64_image: ${{ steps.arm64_image.outputs.image }}
    env:
      head_sha: ${{ needs.checkout-branch.outputs.PR_head_sha }}
      PR_num: ${{ needs.checkout-branch.outputs.PR_num }}
    permissions:
      packages: write
    steps:
    - uses: actions/download-artifact@v3
      with:
        name: cryostat-${{ matrix.arch }}
    - name: Load cryostat image
      run: podman load -i cryostat-${{ matrix.arch }}.tar
    - name: Tag cryostat image
      run: podman tag cryostat ghcr.io/${{ github.repository_owner }}/cryostat:pr-${{ env.PR_num }}-${{ env.head_sha }}-linux-${{ matrix.arch }}
    - name: Push PR test image to ghcr.io
      id: push-to-ghcr
      uses: redhat-actions/push-to-registry@v2
      with:
        image: cryostat
        tags: pr-${{ env.PR_num }}-${{ env.head_sha }}-linux-${{ matrix.arch }}
        registry: ghcr.io/${{ github.repository_owner }}
        username: ${{ github.event.comment.user.login }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Store images as output amd64
      if: ${{ matrix.arch == 'amd64' }}
      id: amd64_image
      run: echo "image=${{ steps.push-to-ghcr.outputs.registry-path }}" >> "$GITHUB_OUTPUT"
    - name: Store images as output
      if: ${{ matrix.arch == 'arm64' }}
      id: arm64_image
      run: echo "image=${{ steps.push-to-ghcr.outputs.registry-path }}" >> "$GITHUB_OUTPUT"

  comment-image:
    runs-on: ubuntu-latest
    needs: [push-to-ghcr]
    env:
      amd64_image: ${{ needs.push-to-ghcr.outputs.amd64_image }}
      arm64_image: ${{ needs.push-to-ghcr.outputs.arm64_image }}
    permissions:
      pull-requests: write
    steps:
    - name: Create markdown table
      id: md-table
      uses: petems/csv-to-md-table-action@v3.0.0
      with: 
        csvinput: |
          ARCH, IMAGE
          amd64, ${{ env.amd64_image }}
          arm64, ${{ env.arm64_image }}
    - uses: thollander/actions-comment-pull-request@v2
      with:
        message: |-
          ${{ steps.md-table.outputs.markdown-table }}

          To run smoketest:
          ```
          # amd64          
          CRYOSTAT_IMAGE=${{ env.amd64_image }} sh smoketest.sh

          # or arm64
          CRYOSTAT_IMAGE=${{ env.arm64_image }} sh smoketest.sh
          ```