build-terraform-oci.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Terraform: Build OCI artifacts"

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - .github/workflows/build-terraform-oci.yaml
      - infrastructure/terraform/**

jobs:
  changed-files:
    name: Generate matrix for building images
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@v42
        with:
          dir_names: true
          dir_names_max_depth: 3
          json: true
          files: |
            infrastructure/terraform/**

      - name: List all changed files
        run: |
          echo '${{ steps.changed-files.outputs.all_changed_files }}'

      - name: Install jo
        uses: awalsh128/cache-apt-pkgs-action@v1.3.1
        with:
          packages: jo

      - name: Store changed projects
        id: set-matrix
        run: |
          if [[ "${{ steps.changed-files.outputs.all_changed_files }}" == "[]" ]]; then
            echo "matrix={\"project\":$(find infrastructure/terraform -type d -mindepth 1 -maxdepth 1 | jo -a)}" >> "${GITHUB_OUTPUT}"
          else
            echo "matrix={\"project\":${{ steps.changed-files.outputs.all_changed_files }}}" >> "${GITHUB_OUTPUT}"
          fi

  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    needs:
      - changed-files
    if: ${{ needs.changed-files.outputs.matrix != '[]' }}
    strategy:
      matrix: ${{ fromJSON(needs.changed-files.outputs.matrix) }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Flux
        uses: fluxcd/flux2/action@main
        with:
          version: "latest"

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate tag
        id: generate-tag
        shell: bash
        run: echo "tag=ghcr.io/${{ github.repository_owner }}/terraform/$(basename ${{ matrix.project }}):$(git rev-parse --short HEAD)" >> "${GITHUB_OUTPUT}"

      - name: Publish OCI
        run: |
          flux push artifact "oci://${{ steps.generate-tag.outputs.tag }}" \
            --path="./${{ matrix.project }}" \
            --source="$(git config --get remote.origin.url)" \
            --revision="$(git branch --show-current)/$(git rev-parse HEAD)"

      - name: Tag OCI
        run: |
          flux tag artifact "oci://${{ steps.generate-tag.outputs.tag }}" --tag main