docker.yml

name: Docker

on:
  pull_request:
  push:
    branches:
    - main
    - release/**

jobs:
  docker:
    name: Docker
    runs-on: ubuntu-latest
    permissions:
      id-token: "write"
      contents: "read"
    steps:
    - name: Checkout
      uses: actions/checkout@v4
    - name: Get commit hash
      id: get_commit
      run: echo "COMMIT=$(git rev-parse --short=7 HEAD)" >> $GITHUB_OUTPUT
    - name: Get DAP draft
      id: get_dap_draft
      run: |
        echo -n "DAP_DRAFT=" >> $GITHUB_OUTPUT
        if [[ ${{ github.ref_name }} == "main" ]]; then
          echo dap-draft-04 >> $GITHUB_OUTPUT
        else
          echo "${GITHUB_REF##*/}" >> $GITHUB_OUTPUT
        fi
    - name: Check if artifacts should be published
      id: check_should_publish
      if: ${{ github.event_name == 'push' && ( github.ref_name == 'main' || startsWith(github.ref_name, 'release/')) }}
      run: echo "SHOULD_PUBLISH=true" >> $GITHUB_OUTPUT
    - name: Build
      run: |-
        docker build \
          -t divviup_ts_interop_client \
          -t us-west2-docker.pkg.dev/janus-artifacts/divviup-ts/divviup_ts_interop_client:${{ steps.get_commit.outputs.COMMIT }} \
          -t us-west2-docker.pkg.dev/janus-artifacts/divviup-ts/divviup_ts_interop_client:${{ steps.get_dap_draft.outputs.DAP_DRAFT }} \
          -t us-west2-docker.pkg.dev/divviup-artifacts-public/divviup-ts/divviup_ts_interop_client:${{ steps.get_commit.outputs.COMMIT }} \
          -t us-west2-docker.pkg.dev/divviup-artifacts-public/divviup-ts/divviup_ts_interop_client:${{ steps.get_dap_draft.outputs.DAP_DRAFT }} \
          -f Dockerfile.interop_client \
          .
    - name: Test
      run: |
        docker run -d --name test-container divviup_ts_interop_client
        sleep 60
        STATUS="$(docker container inspect test-container --format="{{.State.Health.Status}}")"
        echo "$STATUS"
        docker rm -f test-container
        if [ "$STATUS" != "healthy" ]; then exit 1; fi
    - id: "gcp-auth-private"
      name: Authenticate to GCP (private repository)
      if: ${{ steps.check_should_publish.outputs.SHOULD_PUBLISH == 'true' }}
      uses: "google-github-actions/auth@v2"
      with:
        workload_identity_provider: ${{ vars.GCP_ARTIFACTS_WORKLOAD_IDENTITY_PROVIDER }}
        service_account: ${{ vars.GCP_ARTIFACTS_PUBLISHER_SERVICE_ACCOUNT }}
        token_format: "access_token"
        access_token_lifetime: "3600s"
        access_token_scopes: "https://www.googleapis.com/auth/cloud-platform"
        export_environment_variables: false
    - id: "gcp-auth-public"
      name: Authenticate to GCP (public repository)
      if: ${{ steps.check_should_publish.outputs.SHOULD_PUBLISH == 'true' }}
      uses: "google-github-actions/auth@v2"
      with:
        workload_identity_provider: ${{ vars.GCP_GAR_PUBLIC_WORKLOAD_IDENTITY_PROVIDER }}
        service_account: ${{ vars.GCP_GAR_PUBLIC_PUBLISHER_SERVICE_ACCOUNT }}
        token_format: "access_token"
        access_token_lifetime: "3600s"
        access_token_scopes: "https://www.googleapis.com/auth/cloud-platform"
        export_environment_variables: false
    - name: Docker Login (private)
      if: ${{ steps.check_should_publish.outputs.SHOULD_PUBLISH == 'true' }}
      uses: "docker/login-action@v3"
      with:
        registry: "us-west2-docker.pkg.dev"
        username: "oauth2accesstoken"
        password: ${{ steps.gcp-auth-private.outputs.access_token }}
    - name: Push (private)
      if: ${{ steps.check_should_publish.outputs.SHOULD_PUBLISH == 'true' }}
      run: |-
        docker push us-west2-docker.pkg.dev/janus-artifacts/divviup-ts/divviup_ts_interop_client:${{ steps.get_commit.outputs.COMMIT }} && \
          docker push us-west2-docker.pkg.dev/janus-artifacts/divviup-ts/divviup_ts_interop_client:${{ steps.get_dap_draft.outputs.DAP_DRAFT }}
    - name: Docker Login (public)
      if: ${{ steps.check_should_publish.outputs.SHOULD_PUBLISH == 'true' }}
      uses: "docker/login-action@v3"
      with:
        registry: "us-west2-docker.pkg.dev"
        username: "oauth2accesstoken"
        password: ${{ steps.gcp-auth-public.outputs.access_token }}
    - name: Push (public)
      if: ${{ steps.check_should_publish.outputs.SHOULD_PUBLISH == 'true' }}
      run: |-
        docker push us-west2-docker.pkg.dev/divviup-artifacts-public/divviup-ts/divviup_ts_interop_client:${{ steps.get_commit.outputs.COMMIT }} && \
          docker push us-west2-docker.pkg.dev/divviup-artifacts-public/divviup-ts/divviup_ts_interop_client:${{ steps.get_dap_draft.outputs.DAP_DRAFT }}