containers.yml

name: Build and Publish Containers
on:
  workflow_run:
    workflows: ["Format and Tests"]
    branches: ["master"]
    types:
      - completed
jobs:
  build-containers:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    permissions:
      id-token: write
      contents: read
      packages: write
    env:
      AWS_CI_ROLE: ${{ secrets.AWS_CI_ROLE }}
    steps:
      - name: Checkout
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
        with:
          fetch-depth: 0

      - name: Setup GIT version
        id: version
        run: |
          GIT_VERSION=$(git describe --tags --always --match 'v*')
          GIT_VERSION_MAJOR=$(echo "$GIT_VERSION" | cut -d. -f1)
          GIT_VERSION_MAJOR_MINOR=$(echo "$GIT_VERSION" | cut -d. -f1,2)
          { echo "version=${GIT_VERSION}"; echo "version_major=${GIT_VERSION_MAJOR}"; echo "version_major_minor=${GIT_VERSION_MAJOR_MINOR}"; } >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4
        with:
          images: ${{ github.repository }}
          labels: |
            org.opencontainers.image.version=${{ steps.version.outputs.version }}

      - name: Login to GitHub Container Registry
        if: ${{(github.ref == 'refs/heads/master') && !(startsWith(github.event.head_commit.message, 'release:'))}}
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure AWS Credentials
        if: ${{env.AWS_CI_ROLE != '' && (github.ref == 'refs/heads/master') && !(startsWith(github.event.head_commit.message, 'release:'))}}
        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2
        with:
          aws-region: ap-southeast-2
          mask-aws-account-id: true
          role-to-assume: ${{ env.AWS_CI_ROLE }}

      - name: Login to Amazon ECR
        if: ${{env.AWS_CI_ROLE != '' && (github.ref == 'refs/heads/master') && !(startsWith(github.event.head_commit.message, 'release:'))}}
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@2fc7aceee09e9e4a7105c0d060c656fad0b4f63d # v1

      - name: Setup docker tags
        id: tags
        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
        with:
          result-encoding: string
          script: |
            const tags = [];
            tags.push('ghcr.io/${{ github.repository }}:latest');
            tags.push('ghcr.io/${{ github.repository }}:${{ steps.version.outputs.version }}');
            if ("${{ steps.login-ecr.outputs.registry }}") {
            tags.push('${{ steps.login-ecr.outputs.registry }}/${{ github.event.repository.name }}:latest');
            tags.push('${{ steps.login-ecr.outputs.registry }}/${{ github.event.repository.name }}:${{ steps.version.outputs.version }}');
            }
            return tags.join(', ')

      - name: Build and push container
        uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4
        with:
          context: .
          tags: ${{ steps.tags.outputs.result }}
          push: ${{(github.ref == 'refs/heads/master') && !(startsWith(github.event.head_commit.message, 'release:'))}}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            GIT_HASH=${{ github.sha }}
            GIT_VERSION=${{ steps.version.outputs.version }} 
            GITHUB_RUN_ID=${{ github.run_id}}