publish-image.yml

name: Publish Image

on:
  push:
    branches: [staging, master]
  workflow_call:
    inputs:
      sha:
        description: The commit SHA to run the workflow on
        required: false
        type: string
    secrets:
      rails_master_key:
        description: The Rails master key
        required: true
      sentry_auth_token:
        description: The Sentry integration's token
        required: true
  workflow_dispatch:

env:
  PROJECT_NAME: sofia

jobs:
  metadata:
    name: Metadata
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.get_metadata.outputs.tag }}
      build_args: ${{ steps.get_metadata.outputs.build_args }}
    steps:
      - name: Get metadata
        id: get_metadata
        env:
          INPUT_SHA: ${{ inputs.sha }}
        run: |
          if [ "$GITHUB_REF_NAME" = 'master' ]; then
            echo 'tag=latest' >> "$GITHUB_OUTPUT"
          else
            echo 'tag='"$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
          fi

          if [ "$GITHUB_REF_NAME" = 'staging' ] || [ "$GITHUB_REF_NAME" = 'master' ]; then
            BUILD_ARGS='BUILD_HASH='${INPUT_SHA:-$GITHUB_SHA}
            echo 'build_args='"$BUILD_ARGS" >> "$GITHUB_OUTPUT"
          fi

  publish:
    name: Publish
    runs-on: ubuntu-latest
    needs: metadata
    steps:
      - name: Checkout code
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          ref: ${{ inputs.sha }}
          fetch-depth: 0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # tag=v2.1.0
        with:
          registry: ${{ vars.DOCKER_REGISTRY_URL }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image
        id: build_push_image
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
        with:
          push: true
          context: .
          build-args: ${{ needs.metadata.outputs.build_args }}
          secrets: |
            rails_master_key=${{ secrets.RAILS_MASTER_KEY }}
          cache-from: type=gha,scope=main
          cache-to: type=gha,scope=main
          tags: |
            ${{ vars.DOCKER_REGISTRY_URL }}/${{ github.repository_owner }}/${{ env.PROJECT_NAME }}:${{
            needs.metadata.outputs.tag }}

      - name: Get sourcemaps from image
        if: ${{ !(github.event_name == 'workflow_dispatch' && github.workflow == 'Publish Image') }}
        env:
          IMAGE_NAME: ${{ fromJSON(steps.build_push_image.outputs.metadata)['image.name'] }}
        run: |
          docker cp "$(docker create "$IMAGE_NAME")":/app/public/packs/js/. sourcemaps

      - name: Create Sentry release
        if: ${{ !(github.event_name == 'workflow_dispatch' && github.workflow == 'Publish Image') }}
        uses: getsentry/action-release@4744f6a65149f441c5f396d5b0877307c0db52c7 # v1.4.1
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ vars.SENTRY_ORG_NAME }}
          SENTRY_PROJECT: ${{ env.PROJECT_NAME }}
        with:
          finalize: false
          sourcemaps: sourcemaps
          version: ${{ inputs.sha }}
          url_prefix: ~/packs/js/

  update_check_run:
    name: Update Check Run
    runs-on: ubuntu-latest
    needs: [metadata, publish]
    if: github.event_name == 'workflow_dispatch' && github.workflow == 'Publish Image' && always()
    steps:
      - name: Get conclusion
        id: get_conclusion
        env:
          RESULTS: ${{ join(needs.*.result, ' ') }}
        run: |
          echo 'conclusion=success' >> "$GITHUB_OUTPUT"
          for RESULT in $RESULTS; do
            if [ "$RESULT" = 'cancelled' ] || [ "$RESULT" = 'failure' ]; then
              echo 'conclusion='"$RESULT" >> "$GITHUB_OUTPUT"
              break
            fi
          done

      - name: Update Publish Image check run
        uses: guidojw/actions/update-check-run@abb0ee8d1336edf73383f2e5a09abd3a22f25b13 # v1.3.3
        with:
          app_id: ${{ vars.GH_APP_ID }}
          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          name: Publish Image
          conclusion: ${{ steps.get_conclusion.outputs.conclusion }}
          details_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}