docker.yml

# Inspiration:
# - https://docs.github.com/en/actions/guides/publishing-docker-images#publishing-images-to-github-packages
# - https://github.com/docker/build-push-action/blob/master/docs/advanced/test-before-push.md
# - https://github.com/etalab/transport-tools/blob/master/.github/workflows/docker.yml
name: Test and publish the docker image
on:
  # See https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#webhook-payload-object-38
  release:
    types: [ released, prereleased ]
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
  # attempt to re-run a given "release" job
  workflow_dispatch:
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  TEST_TAG: ${{ github.repository }}:test
  TEST_EXPECTED_NODE_OUTPUT: "v20.17.0"
  TEST_EXPECTED_ELIXIR_OUTPUT: "Elixir 1.17.2 (compiled with Erlang/OTP 27)"
  TEST_EXPECTED_ERLANG_OUTPUT: "27.0.1"
jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      # See https://github.com/docker/build-push-action/blob/master/docs/advanced/test-before-push.md
      - name: Set up QEMU
        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@16c0bc4a6e6ada2cfd8afd41d22d95379cf7c32a # v2.8.0

      # https://github.com/docker/login-action
      - name: Log in to the Container registry
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and export to Docker
        uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1
        with:
          context: transport-site
          # "load: true" apparently exports the image on the client (no external push),
          # which is useful for testing it before any push.
          # see https://github.com/docker/build-push-action
          # --output=type=docker to enforce local work
          # https://github.com/docker/buildx/blob/master/docs/reference/buildx_build.md#load
          # https://github.com/docker/buildx/blob/master/docs/reference/buildx_build.md#docker
          load: true
          push: false # the default, but added for clarity
          tags: ${{ env.TEST_TAG }}

      # NOTE: the following tests rely on grep exit code (0 if match found)
      - name: Test that Node can start and has expected version
        run: docker run --rm ${{ env.TEST_TAG }} /bin/bash -c 'node --version' | grep '${{ env.TEST_EXPECTED_NODE_OUTPUT }}'

      - name: Test that Elixir can start and has expected version
        run: docker run --rm ${{ env.TEST_TAG }} /bin/bash -c 'elixir --version' | grep '${{ env.TEST_EXPECTED_ELIXIR_OUTPUT }}'

      - name: Test that Erlang can start and has expected version (major + minor + optional revision number)
        run: docker run --rm ${{ env.TEST_TAG }} /bin/bash -c "erl -eval '{ok, Version} = file:read_file(filename:join([code:root_dir(), \"releases\", erlang:system_info(otp_release), \"OTP_VERSION\"])), io:fwrite(Version), halt().' -noshell" | grep '${{ env.TEST_EXPECTED_ERLANG_OUTPUT }}'

      # If we reach this point, we consider the tested imaged is OK, so we can extract the metadat & publish
      # https://github.com/docker/metadata-action
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      # https://github.com/docker/build-push-action
      # TODO: verify if this will rebuild everything or not. Maybe we can re-tag
      # the tested image above?
      - name: Build and push Docker image
        uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825
        with:
          context: transport-site
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      # TODO: consider caching
      # - https://github.com/docker/build-push-action/blob/master/docs/advanced/cache.md