build.yml

name: build

on:
  push:

env:
  OWNER: ${{ github.repository_owner }}
  FILE: builder
  IMAGE: ghcr.io/${{ github.repository_owner }}/builder
  DRY_RUN: ${{ github.ref_name != github.event.repository.default_branch }}
  BUILDKIT_PROGRESS: plain

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: ${{ github.ref_name != github.event.repository.default_branch }}

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest

    timeout-minutes: 30

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: ⚙️ Setup pnpm
        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
        with:
          standalone: true

      - name: ⚙️ Set up Node.js
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version-file: .node-version
          cache: pnpm

      - name: Installing dependencies
        run: pnpm install

      - name: Lint
        run: pnpm lint

  windows:
    runs-on: ${{ format('windows-{0}', matrix.os) }}
    needs: [lint]

    timeout-minutes: 60

    permissions:
      contents: read
      packages: write

    strategy:
      matrix:
        os: [2019, 2022]

    env:
      BASE: ${{ matrix.os }}
      TAG: windows-${{ matrix.os }}

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      # ignore not yet existing images
      - name: Fetch the Docker image
        run: |
          docker pull ${{ env.IMAGE }}
          docker pull ${{ env.IMAGE }}:${{ env.TAG }}
        continue-on-error: true

      - name: Build the Docker image
        run: docker build -t ${{ env.IMAGE }}:${{ env.TAG }} --cache-from ${{ env.IMAGE }} --cache-from ${{ env.IMAGE }}:${{ env.TAG }} -f Dockerfile .
        working-directory: ./windows

      - name: Test run
        run: docker compose --file docker-compose.test.yml run sut
        working-directory: ./windows
        env:
          IMAGE: ${{ env.IMAGE }}:${{ env.TAG }}

      - name: Log into registry
        if: github.ref_name == github.event.repository.default_branch
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

      - name: Publish the Docker image
        if: github.ref_name == github.event.repository.default_branch
        run: docker push ${{ env.IMAGE }}
        env:
          IMAGE: ${{ env.IMAGE }}:${{ env.TAG }}

        shell: bash
        working-directory: ./windows

  linux:
    runs-on: ubuntu-latest
    needs: [lint]

    timeout-minutes: 30

    permissions:
      contents: read
      packages: write

    env:
      TAG: linux

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: docker-config
        uses: containerbase/internal-tools@5da2b2ba4cbde318e17640f04c54306ddee36856 # v3.4.40
        with:
          command: docker-config

      - name: Build the Docker image
        run: docker buildx bake test

      - name: Test run
        run: docker compose --file docker-compose.test.yml run sut
        working-directory: ./linux
        env:
          IMAGE: ${{ env.IMAGE }}:${{ env.TAG }}

      - name: Log into registry
        if: github.ref_name == github.event.repository.default_branch
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

      - name: Publish the Docker image
        if: github.ref_name == github.event.repository.default_branch
        run: docker buildx bake build --provenance=false

  multi-arch:
    needs: [linux, windows]

    runs-on: ubuntu-latest

    timeout-minutes: 30

    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: ⚙️ Setup pnpm
        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
        with:
          standalone: true

      - name: ⚙️ Set up Node.js
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version-file: .node-version
          cache: pnpm

      - name: Installing dependencies
        run: pnpm install

      - name: Log into registry
        if: github.ref_name == github.event.repository.default_branch
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

      - name: Build the Docker multiarch manifest
        run: pnpm build --release latest

      - name: Publish the Docker multiarch manifest
        if: github.ref_name == github.event.repository.default_branch
        run: pnpm push --release latest

  release:
    needs: [multi-arch]

    runs-on: ubuntu-latest

    timeout-minutes: 30

    permissions:
      contents: write
      packages: write

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: ⚙️ Setup pnpm
        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
        with:
          standalone: true

      - name: ⚙️ Set up Node.js
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version-file: .node-version
          cache: pnpm

      - name: Installing dependencies
        run: pnpm install

      - name: Log into registry
        if: github.ref_name == github.event.repository.default_branch
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

      - name: semantic-release
        run: pnpm semantic-release --dry-run ${{env.DRY_RUN}} --ci ${{env.DRY_RUN != 'true'}}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}