images-branch.yml

name: Branch images
env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
on:  # yamllint disable-line rule:truthy
  pull_request:
    branches:
      - main
    types:
      - synchronize
  pull_request_review:
    types:
      - submitted
  workflow_dispatch:
    inputs:
      pr:
        required: true
        type: string
        description: PR number

jobs:
  push-updater-images:
    name: Deploy
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        suite:
          - { name: bundler, ecosystem: bundler }
          - { name: cargo, ecosystem: cargo }
          - { name: composer, ecosystem: composer }
          - { name: docker, ecosystem: docker }
          - { name: elm, ecosystem: elm }
          - { name: git_submodules, ecosystem: gitsubmodule }
          - { name: github_actions, ecosystem: github-actions }
          - { name: go_modules, ecosystem: gomod }
          - { name: gradle, ecosystem: gradle }
          - { name: hex, ecosystem: mix }
          - { name: maven, ecosystem: maven }
          - { name: npm_and_yarn, ecosystem: npm }
          - { name: nuget, ecosystem: nuget }
          - { name: pub, ecosystem: pub }
          - { name: python, ecosystem: pip }
          - { name: swift, ecosystem: swift }
          - { name: terraform, ecosystem: terraform }
    permissions:
      contents: read
      packages: write
    env:
      TAG: ${{ github.sha }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set PR
        run: echo "PR=${{ github.event.pull_request.number }}" >> $GITHUB_ENV
        if: github.event_name != 'workflow_dispatch'

      - name: Set PR (forks)
        run: echo "PR=${{ inputs.pr }}" >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch'

        # sets DECISION to the PR's review decision, handling the push-after-approval case
      - name: Check if pull request is approved
        run: |
          DECISION=$(gh pr view ${{ env.PR }} --json reviewDecision,state -t '{{.reviewDecision}}:{{.state}}')
          echo "Review decision is: $DECISION"
          echo "DECISION=$DECISION" >> $GITHUB_ENV

      # overwrite the previous result on pull request events on forks since forks can't publish to GHCR
      - name: Skip forks
        if: github.event.pull_request.head.repo.fork
        run: echo "DECISION=FORK" >> $GITHUB_ENV

      - name: Prepare tag
        run: echo "TAG=${{ github.sha }}" >> $GITHUB_ENV
        if: github.event_name == 'pull_request'

      - name: Prepare tag (forks)
        run: |
          gh pr checkout ${{ inputs.pr }}
          git fetch origin main
          git merge origin/main --ff-only || exit 1
          echo "TAG=$(git rev-parse HEAD)" >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch'

      - name: Log in to GHCR
        if: env.DECISION == 'APPROVED:OPEN'
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Build ecosystem image
        if: env.DECISION == 'APPROVED:OPEN'
        run: script/build ${{ matrix.suite.name }}

      - name: Push branch image
        if: env.DECISION == 'APPROVED:OPEN'
        run: |
          docker tag "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}" "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}:$TAG"
          docker push "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}:$TAG"

      - name: Set summary
        if: env.DECISION == 'APPROVED:OPEN'
        run: |
          echo "updater uploaded with tag \`$TAG\`" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          echo "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}:$TAG" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY